Cyber insurance gaps leave APAC vulnerable to rising digital risks

Limited coverage, financial modeling, and training hinder cyber insurance adoption.

As cyber risks soar across Asia-Pacific, the region’s adoption of cyber insurance remains notably low. Despite the growing demand for digital transformation and rising concerns about cyber threats, only 17% of companies’ digital assets are insured, according to a new Aon report.

Industry experts attribute this gap to several factors, from a lack of financial modeling to insufficient coverage options.

Adam Peckman, Global Head of Cyber Risk Consulting and Head of Cyber Solutions for Asia Pacific at Aon, explains, “Cyber risk remains the number one concern for business leaders. Financial analysis is lacking with just 12.3% of companies using analytics to inform their cyber insurance decisions.”

Peckman identifies regulatory gaps as a key challenge. “There are fewer regulatory drivers in APAC compared to regions like North America and Europe, which often force companies to buy cyber insurance after major incidents,” he says. Despite this, he believes the trend is shifting, particularly as stricter regulations around data protection and cybersecurity emerge in the region.

Jennifer Braney, Head of International Cyber at Gallagher Re, highlights a different issue: the supply of appropriate cyber insurance products. “The coverage isn’t suitable for the APAC market, and agents often aren’t trained to sell it effectively,” Braney points out. She advocates for a more supply-driven solution in the region. “We need to take the supply of cyber capacity where the demand is, particularly for larger risks,” she adds.

Braney further stresses that while regulations are vital, they need to drive meaningful action. “In APAC, we see a patchwork of regulations. We need more comprehensive rules that motivate businesses to enhance their cybersecurity practices,” she says.

Both Peckman and Braney agree that regulators play a crucial role in fostering cyber resilience. Peckman suggests that regulators should elevate expectations around security, data protection, and risk governance, and introduce mandatory incident reporting to foster information-sharing across industries.