Offshore energy platforms have become the nexus of economic, energy, and cyber security in the United States. A study by the U.S. Government Accountability Office (GAO) has found that an attack on the country’s network of 1,600 offshore facilities could lead to effects resembling those of the 2010 Deepwater Horizon loss. At more than US$3 billion, the most-extensive insured loss in the PCS Global Marine and Energy database.

The lack of cyber security strategy identified by the GAO dovetails with the broader security strategy issues involved, which should include a role for the global re/insurance industry.

The cyber security threat environment has been characterized by volatility over the past 12–18 months, particularly with the run-up to the conflict in Ukraine and subsequent kinetic engagement.

Cyber operations have moved toward the background throughout the conflict, given that such activity has not proved to be as impactful as traditional military activity. That said, the conflict has made clear the interconnectedness of economic, energy, and physical security, as evidenced by damage to energy assets in Ukraine. An escalation of the cyber threat environment could have significant consequences, with the Colonial Pipeline cyber-attack from last year as an indicator of the overall potential impact.

While the GAO report focuses on the need for cyber security strategy, a holistic view of the risk environment necessarily involves insurance. Unlike other security strategies – such as nuclear –cyber-attacks are more easily reversed. Investing in accelerating post-attack recovery can be as important as up-front protection.

To that end, PCS has conducted research into the role of re/insurance in cyber security can be applied to the cyber threat in the offshore energy sector. In addition to the broader security concerns raised by the GAO, using the risk-transfer capacity to support faster recovery could mitigate the economic and societal impacts of cyber-attacks on offshore energy assets, leading to a more robust overall security strategy.

Of course, the use of insurance in broader strategic security frameworks requires the availability of capital, and turbulence in the cyber market right now could serve to exacerbate the problem.

However, this can be remedied in the short term with several tactical efforts that could have an outsized effect.

Marshalling retrocession and insurance-linked securities capital could be timely, especially given the demand for such covers. Cyber inclusions – structured appropriately – could provide the market time it needs to develop a robust solution.