Your Insurance Premium is Now Determined by Your Data

For decades, buying commercial insurance was largely about answering questions on an application, meeting with a broker, reviewing loss history and establishing a price. That model is changing.

Increasingly, insurers are evaluating businesses through a vast digital lens before deciding what they will cover – and what they will charge. Satellite imagery can assess a property’s physical condition. IoT sensors can monitor temperature, water leaks and equipment performance. Cybersecurity ratings can influence how an insurer views a company’s digital defenses. Artificial intelligence and predictive analytics can combine those signals with claims history, geographic information and industry data to calculate risk.

The important question for business leaders is whether your company is being scored by people and systems you didn’t hire, using methodologies you may never see, with little visibility into how to challenge the result. That makes insurance an increasingly important story about asymmetric information.

Your Business is Being Evaluated Before You Ever Sit Down with an Insurer

According to broker and industry expert Ron Reza, an insurer doesn’t necessarily need to wait for an application to understand something about a company’s risk.

“For property coverage, satellite and aerial imagery can reveal roof age, building conditions, vegetation, proximity to other structures and potential wildfire exposure,” said Reza. “In California, where wildfires and earthquakes have transformed property-risk calculations, location can be particularly consequential.”

For cyber insurance, insurers can look at external cybersecurity indicators, including whether a company’s systems appear vulnerable to known threats, how effectively email security is configured and whether exposed digital assets present potential entry points.

For other commercial policies, data can come from connected sensors, telematics, supply-chain information, public records, historical claims and industry benchmarks.

The result is a fundamental shift in the relationship between insurer and insured. The business knows what it is doing. The insurer increasingly knows what the business looks like from the outside. Those aren’t necessarily the same thing.

A company may have invested heavily in cybersecurity, replaced an aging roof, installed sophisticated fire-detection equipment or implemented rigorous employee safety protocols. But if those improvements aren’t captured by the data an insurer uses, they may not receive the credit they deserve.

Technology Can Become an Insurance Asset

This creates an interesting opportunity for CEOs and CFOs. The same technology investments that make a company more resilient can potentially make it more insurable.

Consider a Southern California manufacturer that installs sensors capable of detecting abnormal equipment temperatures before a failure occurs. Or a commercial property owner that deploys water-leak detection systems that automatically shut off a supply line. Think of a company that implements multi-factor authentication, endpoint detection, continuous monitoring and employee cybersecurity training.

These are investments in risk reduction. The challenge is demonstrating that to an insurer.

“Businesses should be asking their broker and carrier which specific risk controls are recognized in underwriting – and what evidence is required to demonstrate them,” said Reza. “A sophisticated security system that isn’t documented may have less underwriting value than a less sophisticated system whose effectiveness can be clearly demonstrated.”

“In other words, risk reduction needs to become measurable, documented and communicable,” he said.

What Actually Matters to Your Score?

There is no single universal “insurance score” for every commercial business. Different carriers, lines of coverage and underwriting models use different data and methodologies.

But business leaders should assume that several categories can matter:

• Physical risk: building condition, roof age, fire protection, flood or wildfire exposure and property maintenance.
• Cyber risk: vulnerabilities, authentication practices, exposed systems, incident history and security controls.
• Operational risk: safety procedures, equipment maintenance, employee practices and business continuity planning.
• Geographic risk: location-specific exposure to wildfire, earthquake, flooding and other catastrophes.
• Financial and claims history: prior losses, claims frequency and severity.
• Resilience: backup systems, disaster recovery, redundancy and documented response plans.

For Southern California companies, that risk equation can be unusually complicated. Businesses operate in one of the nation’s most technology-intensive regions while simultaneously facing earthquakes, wildfires, extreme weather, supply-chain disruptions and an evolving cyber threat environment.

That makes the quality of a company’s risk data increasingly important.

Five Questions CEOs Should Ask Before Renewal

Before renewal season arrives, executives should ask more than “How much is our premium going up?”

According to Reza, they should ask:

What data is being used to evaluate us? Find out what information the carrier and broker rely upon.

Are there third-party risk scores involved? If so, ask who produces them and what categories they measure.

Can we see our risk assessment? Businesses should understand what the insurer believes their vulnerabilities are.

How can we correct inaccurate information? A satellite image may be outdated. A cybersecurity assessment may identify a vulnerability that has already been fixed. A database may contain an error. Companies should know the process for challenging or updating information.

Which investments would actually change our risk profile? Don’t spend $100,000 on a new technology simply because it sounds like a good risk-control measure. Ask whether the investment will be recognized by the insurer and what documentation will be required.

The New Support Documentation

Insurance is becoming less about simply presenting a business and more about presenting evidence of resilience. That could ultimately benefit sophisticated companies. Businesses that can quantify their safety improvements, document cybersecurity controls, demonstrate operational redundancy and provide credible evidence of risk mitigation may have a better chance at a lower premium than businesses that simply say they have “good systems.”

But there is an important caveat. As insurers increasingly rely on algorithms and third-party data, business leaders should not accept an opaque risk score as an unquestionable verdict. If an outside party is influencing the price a company pays for coverage, executives have a legitimate interest in understanding what information is being used, whether it is accurate and whether there is a meaningful way to appeal it.

The future of commercial insurance may therefore be less about who has the most data.

It may be about who controls the data, who interprets it – and whether the business being judged gets a seat at the table.

For Southern California’s technology-forward business community, that is becoming a boardroom issue, not merely an insurance issue.