Companies recognise the growing value of technology and data assets relative to historical tangible assets — but they are spending four times more budget on insurance for property, plant and equipment (PP&E) risks.
This is one of the findings from the 2017 EMEA Cyber Risk Transfer Comparison Report, released by Aon in collaboration with the Ponemon Institute.
“Our goal is to compare the financial statement impact of tangible property and network risk exposure,” says Dr Larry Ponemon. “A better understanding of the relative financial statement impact will assist organisations in allocating resources and determining the appropriate amount of risk transfer resources to allocate to the mitigation of network risk exposures.”
The report found that, while 38% of businesses surveyed confirmed they have experienced a cyber loss in the past 24 months, only 15% of their probable maximum loss (PML) is covered by insurance.
This is in stark contrast to the policy limits purchased against physical assets like PP&E, where around 60 % of their PML is typically covered. The report also shows that the impact of business disruption to information assets is 50% greater than to PP&E.
Vanessa Leemans, chief operating officer” global cyber insurance solutions at Aon, comments: “This study compared the relative insurance protection of certain tangible versus intangible assets. We found that most organisations spend much more on fire insurance premiums than on cyber insurance, despite stating in their publicly disclosed documents that a majority of the organisation’s value is attributed to intangible assets.”
The report also found that only 30% of businesses are “fully aware” of the legal and economic consequences of European Union General Data Protection Regulation (GDPR).
GDPR comes into effect on 25 May 2018, and introduces a 72-hour notification for all personal data breaches — except those unlikely to pose a risk to individuals. Fines for non-compliance with the GDPR will increase to as much as €20-million or 4% of an organisation’s global turnover (whichever is highest).
Insurance carriers are starting to see an increase in demand for cyber coverage as cyber exposure awareness becomes an enterprise-wide issue.
Leemans adds: “With 65% of EMEA organisations expecting their cyber risk exposure to increase over the next two years, cyber risk needs to be approached at an enterprise-wide level in order to achieve cyber resilience. This should include enterprise-wide education, assessment and quantification, preventive risk management, incident response plan, as well as cyber insurance.
