Report on the new realities of severe weather resilience examines successes and reveals learnings from 2018’s Hurricane Florence

NEW ORLEANS — The study looks in detail at the floods and the consequences that resulted from 2018’s Hurricane Florence in North Carolina. Written in collaboration with Zurich North America, Zurich Flood Resilience Alliance, and ISET-International, the new report, Hurricane Florence: Building resilience for the new normal focuses on opportunities, successes and learnings following Hurricane Florence.

“Despite the double hit of Matthew and then Florence, along with an extremely active though not directly damaging to North Carolina hurricane season in 2017, people and businesses are missing an opportunity to improve their resilience,” said Paul Lavelle, chief claims officer of Zurich North America. “The trends are clear – natural hazards are getting worse. Now is a key window of opportunity with the recovery still ongoing in many communities to take action and reduce future risk.”

Key Findings

Weather events are changing in nature and sea levels have visibly risen
In North Carolina and elsewhere, climate has visibly changed, sea levels have visibly risen, and these trends are likely to continue. Given that extreme events will become potentially more frequent and more severe, communities and states should take steps to learn from past events and implement key insights as part of their recovery and development to mitigate areas of known risk.

Economic motivators can be used as levers for both action and inaction
In many industries, proven technology exists to address environmental damages and in many cases regulations are on the books requiring action or punitive fines and taxes. Additionally, public opinion is increasingly turning against industries and organizations that aren’t taking steps to become more resilient and environmentally responsible. As acute weather events become more common, delaying action will damage reputations and impact profits.

“In the face of this increasing risk, it is critical to learn from events such as Florence, to minimize the damages and streamline the response and recovery for the next storm,” said Lavelle. “Communities can no longer afford business as usual, quite literally. The growing economic and human cost of these events requires that we not only change how we respond, but also do so far more quickly than we have in the past.”

Floods contribute to marginalizing vulnerable communities
Shortened recovery time and limited recovery support from various authorities exacerbates disparities in recovery between higher income households compared to their lower-income, resource scarce neighbors. Communities that are better resourced and insured recover and rebuild faster, and more likely in time for the next storm, than those communities with less resources and insurance coverage. In many hard-hit properties in Wilmington, North Carolina were inexpensive apartments in low-lying parts of town. In the hot, humid aftermath of the storm, water-damaged properties rapidly started to mold and landlords began issuing lease termination notices, sparking an unexpected wave of sheltering demands a week to 10 days after the storm.

The Saffir-Simpson Scale is not sufficient to explain hurricane consequences
The Saffir-Simpson scale used to characterize hurricane strength is proving increasingly inadequate as a way to describe to the general public the risk posed by a hurricane. Category 4 and 5 hurricanes are terrifyingly destructive storms and should clearly be acknowledged as such. But large, wet, slow Category 1 and Tropical storms like Hurricanes Harvey and Florence that result in torrential rainfall and flooding can be just as destructive and deadly.

Shift from siloed interventions to a holistic approach
Like the key findings, recommendations contained in the report bring together the numerous themes that have the power to impact a community’s resilience during extreme weather events. Rather than solely addressing issues in isolation, communities and government officials should work holistically to assess and address systemic issues.

“As floods events become more intense and more frequent, we need to be more proactive,” said Dr. Karen MacClune, executive director of ISET-International. “Yet our resources remain finite. This means we need to more effectively use the resources we have. A key way to do that is through coordination and collaboration. Most of those who are leading on resilience are doing so by building active, diverse networks focused on common goals.”

Now is the time to act on building in community-level resilience
Research from the Zurich Flood Resilience Alliance has shown that community-level resilience-building projects avoid, on average, five dollars of losses for every dollar spent up front. A recent study by the National Institute of Building Sciences (NIBS)¹ conducted on available data in the United States found cost-benefit ranges of 1:4 up to 1:12, and for flooding specifically ranging from 1:5 up to 1:8 – solid numbers highlighting that investing early in resilience building pays off.

“I’ve seen firsthand how resilient people and businesses can be – able to overcome and persevere through some of the most devastating experiences. However, it usually takes a trailblazer to insist on change and build back better or develop something innovative and new,” said Lavelle.

Critically assess where all stakeholders chose to build
Coastal counties, Charlotte, and the Triangle area saw² an increase in the population in the floodplain from 2000-2016. That, coupled with the increase in hurricane intensity, means that without change in awareness, preparedness, and risk reduction, the social and economic impacts of major natural hazard events will continue to increase.

And yet, policy and regulatory decisions that fail to discourage development in highly exposed areas are resulting in increased flood risk throughout the state. The report calls on developments to be more intentional about where to build, how to build, and in managing expectations for how communities will live within and interact with the environment to stay safe.

Insurance plays an important role in resilience
Flood insurance is critical to recovery as households and businesses with insurance fare better than those without. In the face of known flood risk, insurance should be one of a suite of actions. However, insurance can only go so far if it is not coupled with other preventative/risk reduction measures.

The report’s key findings revolve around a variety of human, social, economic and political themes. Society continues to support and subsidize investment and unprotected development in high-risk areas such as exposed coasts and river inlets. Insurance that does not accurately price for risk exacerbates the problem.

This new report on Florence is Zurich’s 14th post-event review of a severe weather event. The lessons learned and recommendations outlined in the report are part of a wider series of post-event reviews, using the Post Event Review Capability (PERC) methodology, which the Zurich Flood Resilience Alliance has been conducting since 2013. Post-event reviews generate actionable recommendations for reducing future damages.

About Zurich North America
For more information about Zurich, go to https://www.zurichna.com/zna/services/about-zurich

¹https://www.nibs.org/page/mitigationsaves
² The Triangle, shorthand for “The Research Triangle” is a region in North Carolina that consists of the cities of Raleigh, Durham, and Chapel Hill and the three research universities they house: Duke University, the University of Carolina Chapel Hill and North Carolina State University.

NEW YORK — Hiscox, the international specialist insurer, today released The Hiscox Cyber Readiness Report 2019™, which gauges how prepared businesses are to combat cyber attacks. The annual report surveyed nearly 5,400 professionals from the US, UK, Germany, Belgium, France, Spain and the Netherlands who are responsible for their company’s cybersecurity and found that the cost and frequency of attacks are on the rise. Sixty-one percent of firms experienced a cyber attack in the past year, compared to 45% in 2018. The median cost for losses associated with cyber incidents also soared from $229,000 to $369,000.

To determine the respondents’ preparedness to handle cyber attacks, Hiscox evaluated the firms’ strategy (oversight and resourcing) and execution (technology and process) and ranked them as a ‘cyber novice,’ ‘cyber intermediate’ or ‘cyber expert.’

Key findings specific to the more than 1,000 US companies surveyed include:

• Leaky bucket budgets: Seventy-two percent of firms plan to increase spending on cyber security in the coming year. However, increased spend without proper infrastructure and training is the equivalent of pouring water into a leaky bucket. Only 11% of respondents cited increased spending on employee training and culture changes as a result of a cyber security incident, both of which are crucial components of a company’s defense against cyber risks.
• Attacks are on the rise:Fifty-three percent of respondents reported an attack in the past 12 months, compared to 38% last year. Many companies do not take proper action following an attack, with 45% of companies reporting experiencing three or more attacks in the past year. Cyber incidents come with a large price tag. The mean cost of cyber incidents in the US was $119,000.
• Fewer large companies are ‘cyber experts:’ While it would seem they have the resources to be prepared, only 11% of large and enterprise firms ranked as ‘cyber experts,’ compared to 26% of large and enterprise firms last year.
• Unexpected risks in the supply chain:Fifty-six percent of firms experienced cyber-related issues in their supply chain in the past year. However, only 7% of respondents cited increased evaluation of the supply chain as a result of a cyber security incident occurring in the past 12 months.
• Lack of insurance heightens the stakes: Twenty-seven percent of respondents have no plans to purchase cyber insurance, and 5% are unsure of what cyber insurance is.

“The message that cyber risk is a real threat to businesses of all sizes is sinking in. Companies are increasingly aware of the risks and pouring more resources into cyber protection, and yet, there is still a tremendous gap between awareness of the issue and actually having an effective defense,” said Meghan Hannes, Cyber Product Head for Hiscox in the US. “Many believe that increasing cyber-related spending fully protects a business, but it isn’t enough. Businesses must take a holistic approach, ensuring they can properly maximize their investment with appropriate internal protocols, staffing, and employee training, ultimately creating a human firewall as the first line of defense.”

Creating a Line of Defense: Cybersecurity Best Practices

Based off Hiscox’s proprietary module, companies in the seven countries surveyed had to achieve a minimum score of 4.0/5 in strategy and execution to qualify as a ‘cyber expert.’ The study identified ‘cyber expert’ best practices that ‘cyber novices’ lack, and, based on the global findings, these include:

• Securing executive buy-in: Only 54% of ‘cyber novices’ globally believe cybersecurity is a top priority for their firm’s executive management/board as compared to 85% percent of ‘cyber experts.’
• Creating a well-defined strategy with input from multiple stakeholders and determining a formal and adequate cyber budget: On average, ‘cyber experts’ globally devote 14.7% of their IT budget to cybersecurity, but ‘cyber novices” cybersecurity spending accounts for just 8.7% of their overall IT budget.
• Dedicating a cyber head tasked with overseeing the strategy, supported by a team if necessary: Globally, 51% of ‘cyber experts’ have a dedicated leader who oversees cybersecurity, compared to just 39% of ‘cyber novices.’
• Regularly evaluating the supply chain: Only 18% of ‘cyber novices’ strongly feel that they have good visibility into their suppliers’ security arrangements, compared to 34% of ‘cyber experts’ globally.
• Defining a process that spans from when a cyber incident is detected to when it has been mitigated, and making sure employees are ready to learn, respond and make changes to this process if an incident occurs: Eighty-five percent of all ‘cyber experts’ have a clearly defined cybersecurity strategy, compared to just 53% of ‘cyber novices.’
• Conducting proactive testing through simulated attacks and regular phishing experiments: Forty-one percent of ‘cyber novices’ globally have conducted phishing experiments to understand employee behavior and readiness for attacks, compared to 69% of ‘cyber experts.’
• Insuring your business with a cyber policy: Globally, 59% of ‘cyber experts’ currently have already adopted cyber insurance, compared to only 37% of ‘cyber novices.’

Hiscox USA provides a variety of specialty risk solutions including a broad spectrum of professional errors & omissions, general liability, cyber and data security, media liability, management liability, crime, kidnap & ransom, terrorism and commercial property insurance products.

Hiscox offers an online interactive suite of cyber security training modules included as part of its Cyber and data insurance policies that helps customers prepare their employees and reduce the risk of a cyber incident occurring.

In the US, Hiscox has offices in New York, NY; Atlanta, GA; Chicago, IL; Dallas, TX; Los Angeles, CA; Phoenix, AZ; San Francisco, CA and White Plains, NY.

Related Materials:

The Hiscox Cyber Readiness Report 2019™

About the Study

Hiscox commissioned Forrester Consulting to assess organizations’ cyber readiness. In total 5,392 professionals responsible for their organization’s cyber security strategy were contacted (1,000 plus each from the UK, US and Germany, and 500 each from Belgium, France, Spain and the Netherlands). Thirty-nine percent of respondents were from organizations with fewer than 50 employees (small firms), 16% from medium-sized firms employing 50-249 people, 16% from large firms employing 250-999 personnel and the remaining 28% from enterprises with 1,000 or more employees. Respondents completed the online survey between 22 October and 7 December 2018.

About The Hiscox Group

Hiscox is a global specialist insurer, headquartered in Bermuda and listed on the London Stock Exchange (LSE:HSX). Our ambition is to be a respected specialist insurer with a diverse portfolio by product and geography. We believe that building balance between catastrophe-exposed business and less volatile local specialty business gives us opportunities for profitable growth throughout the insurance cycle. It’s a long-standing strategy which in 2018 saw the business deliver a profit before tax of $137.4 million in a challenging year for insurers.

The Hiscox Group employs over 3,300 people in 14 countries, and has customers worldwide. Through the retail businesses in the UK, Europe, Asia and the US, we offer a range of specialist insurance for professionals and business customers as well as homeowners. Internationally traded, bigger ticket business and reinsurance is underwritten through Hiscox London Market and Hiscox Re & ILS. In the US, Hiscox underwrites admitted insurance products through Hiscox Insurance Company Inc., a Chicago-based insurer.

Our values define our business, with a focus on people, quality, courage and excellence in execution. We pride ourselves on being true to our word and our award-winning claims service is testament to that. For more information, visit www.hiscoxgroup.com.