Cyber insurance has become a crucial safety net for businesses, particularly in the face of escalating ransomware attacks.
By Greg Day, vice-president and global chief information security officer at Cybereason
This financial safeguard promises protection against the often devastating consequences of cyberattacks. However, as ransomware incidents have surged, so too have the premiums for cyber insurance.
Fortunately, recent trends suggest that the cost of cyber insurance may be stabilising. This stabilisation could signal that businesses are maturing in their approach to cybersecurity and that more effective cybersecurity programs are taking hold.
More than just a safety net
For many businesses, cyber insurance is more than just a financial safety net – it’s an essential component of their broader cybersecurity strategy. Research indicates that companies with cyber insurance are generally better equipped to handle data breaches and cyberattacks compared to those without coverage.
One significant advantage is the support that insurers provide. Insurers often work closely with their clients to prepare them for potential incidents, offering guidance on best practices and response strategies.
The market for cyber insurance is changing rapidly, and both insurers and businesses must stay abreast of these changes to ensure adequate protection. One key challenge is evaluating cyber insurance coverage against emerging threats.
Our recent research, based on a survey of over 1 000 companies across EMEA and the USA, reveals that while nearly all respondents had cyber insurance, only 40% were confident that a ransomware attack would be covered.
Furthermore, among those who had made claims for ransomware attacks, only half felt they had recovered the full costs. This discrepancy underscores the need for businesses to fully understand their policy details and coverage limits.
Evaluating cyber insurance coverage
When evaluating cyber insurance coverage, it’s essential for businesses to have a clear understanding of what their policy covers and excludes. Typically, cyber insurance can cover first-party and third-party losses, including the costs of responding to an attack.
However, policies generally do not cover legal or regulatory losses. Businesses must consider what level of coverage is necessary based on their specific risks and the potential commercial impact of a breach.
To make informed decisions, businesses should collaborate closely with their cybersecurity team and legal advisors. It’s crucial to scrutinise the fine print of insurance policies, clarify coverage details, and understand the insurer’s expectations regarding cybersecurity measures and incident response capabilities.
Some companies have resorted to taking out multiple policies to mitigate risks, but this approach can lead to more complex and time-consuming claims processes.
Innovations in cyber insurance
As cyber threats change, so too must the strategies employed by insurers. Cyber insurance companies are increasingly collaborating with cybersecurity professionals to gain better insights into emerging threats and targeted industries. This collaboration helps insurers develop more accurate risk assessments and actuarial tables, which are crucial for pricing policies appropriately.
Moreover, insurers are moving beyond traditional paper-based surveys to validate their clients’ cybersecurity capabilities. They are now incorporating more rigorous checks, such as verifying cybersecurity certifications and conducting penetration tests. Some insurers offer discounts based on these validations, incentivising businesses to strengthen their security posture.
Cyber insurance and operational resilience
Cyber insurance is a critical component of operational resilience. While it provides financial protection against cyber incidents that traditional security measures may not fully address, it is not a substitute for robust cybersecurity practices. Instead, it should complement existing security controls by offering financial reassurance in the event of a breach.
In addition to financial protection, cyber insurance can serve as a benchmark for assessing a company’s cybersecurity capabilities relative to industry peers. This benchmarking can provide valuable insights into areas where a company may need to enhance its security measures.
Weighing the cost of cyber insurance
When considering the cost of cyber insurance, businesses should evaluate their potential risks and the impact of various types of coverage. Understanding what is covered under the policy and what is not – such as legal or regulatory costs – is crucial. Businesses should also assess the commercial impact they can bear and determine the level of coverage needed to mitigate that impact effectively.
This decision should be made collaboratively, involving both the cybersecurity team and the broader business leadership. Regularly reviewing and updating the insurance policy in light of growing threats and changes in the business environment is also essential.
Cyber insurance remains a vital tool for businesses seeking to manage the financial risks associated with cyberattacks. As cyber threats continue to evolve, so too must the strategies employed by both insurers and businesses.
By staying informed about policy details, leveraging innovations in the insurance market, and integrating cyber insurance with comprehensive security measures, businesses can better explore the complexities of digital risk management.