Introduction
It’s common knowledge that cyberattacks, breaches, and leaks can have devastating financial consequences on victims. Breached companies not only suffer direct financial damage from issues like ransom payments, having accounts accessed, and business downtime, but also often suffer the loss of reputation that can come in the wake of a big cyberattack (especially if it’s highly publicized in the media). All of these effects can result in millions upon millions of dollars of lost income. Often, smaller entities with less liquidity or resources simply can’t weather the storm of a major cyberattack, and have to close shop.
Almost all companies invest (often quite heavily) in IT and security departments that focus on keeping the organization safe from hackers. That’s a proven solution, but, obviously, companies continue to fall foul of cyberattacks. It just takes one breach, even if thousands have been successfully defended against, to wreak havoc. To construct a stronger safety net with regard to cyberattack losses, cyber insurance is an increasingly attractive option.
What exactly cyber insurance is (and isn’t)
Cyber insurance is an insurance product designed to help businesses protect themselves against the potentially devastating financial effects of cyberattacks. Cyber insurance products are usually highly personalized and tailored to the companies that purchase them – every entity has dramatically different, unique cybersecurity risks.
Cyber liability insurance providers usually cover issues including:
- Data breaches (like incidents involving theft of personal information)
- Cyber attacks on your data held by vendors and other third parties
- Cyber attacks (like breaches of your network)
- Cyber attacks that occur anywhere in the world (not only in the United States)
- Terrorist acts
- Legal defense
- PR management
- Data recovery
- Customer management
- Loss of income
- Third-party breach damages
Cyber insurance policies can be intricate, and there are a number of areas that aren’t covered. Compliance fines issued by the government are rarely covered. And if any incidents, upon investigation, are found to be a result of negligently weak in-house cybersecurity measures, they won’t be covered. (Cyber insurance underwriters are very diligent about uncovering non-insurable weaknesses in companies’ security infrastructure.) It can also be difficult to get an insurer to cover a cyberattack that originates from a foreign government, because insurers can argue that those large-scale attacks fall under the category of “acts of war” (which are excluded from coverage).
Perceptions that cyber risks are skewed towards big corporations are now giving way to the realization that SMBs suffer greatly from cyber attacks, and that cyber insurance should supplement SMB’s internal cyber security and risk controls. Indeed, insurance products are being created to help SMBs specifically prepare for and manage cyber incidents by identifying (and correcting) any security vulnerabilities. This bodes well for the future: a bigger pool of businesses and data will assist insurers in building greater resilience and, over time, help deliver a sustainable, less volatile market.
Current volatility and challenges
During the COVID-19 pandemic, ransomware attacks increased and, thus, cyber insurance premiums went up. The trend continued as US cyber insurance premiums surged 50% in 2022, with further increases in ransomware attacks (and the ever-skyrocketing presence of online commerce) driving demand for coverage.
But cyber insurance rates dropped around 10% in June 2023 compared with a year earlier, reversing those sharp rate rises, with claims proving smaller than expected by analysts. Throughout mid to late 2022 and into early 2023, the number of global ransomware attacks fell by 20%, following the start of the conflict between Russia and Ukraine, as hackers in those countries focused on military-centered cyberwarfare.
Still, in the long term, ransomware attacks are predicted to continue to increase, and analysts have forecast that the cyber insurance market will grow from $12 billion (in 2022) to $50 billion (2030).
And, despite the current fall in insurance rates, major players are indeed proactively tightening their regulations and requirements – and reducing their coverage limits. Lloyd’s of London, which controls around a fifth of the global cyber insurance market, has discouraged its divisions from taking on cyber insurance business next year, industry sources have said. Additionally, U.S. insurer AIG said in August it was cutting cyber insurance payout limits in 2023. American International Group, Inc. has also reportedly been tightening the terms of its cyber insurance policies, as well.
What does it mean for cyber insurance terms and requirements to be tightened? Essentially, insurance companies want to see exactly how much risk they are taking on, including the cybersecurity history of the company, the current state of its security posture, the unique risks inherent to the company’s business model and industry, and the potential damages (and types of damages) expected in the event of a major breach.
The Role of Reliable, Real-Time Cybersecurity Metrics in Obtaining Cyber Insurance
When dealing with cyber insurance companies, one of the best ways to present the case that your company is insurable (and at a reasonable rate) is to bring reliable metrics to the table regarding your company’s security posture. For example, when insurance companies can examine an organization’s cyberattack history, breach and leak records, security culture status, and other information (such as third-party vendor risk), they can feel much more confident making informed decisions about a company’s insurability.
A full-spectrum threat intelligence platform such as HackNotice can go a long way toward building these sorts of vital statistics. With third-party monitoring, domain monitoring, end-user credential monitoring, a powerful dark web research service, and a user-centered threat awareness functionality, HackNotice gives you the raw data you need to see exactly where your company stands cybersecurity-wise. HackNotice monitors the dark web in real-time, so that you’re instantly alerted to any breaches or leaks. Real-time, data-driven threat intelligence not only keeps you safer, but lets cyber insurance providers know they can trust you.
Sources:
- https://www.cisco.com/c/en/us/products/security/what-is-cyber-insurance.html
- https://www.malwarebytes.com/cybersecurity/business/what-is-cyber-liability-insurance
- https://www.bloomberg.com/news/articles/2023-06-14/cyber-insurance-premiums-surge-by-50-amid-ransomware-attacks
- https://www.reuters.com/markets/europe/insurers-run-ransomware-cover-losses-mount-2021-11-19/
- https://www.reuters.com/business/aig-is-reducing-cyber-insurance-limits-cost-coverage-soars-2021-08-06
- https://www.reuters.com/technology/cyber-insurance-rates-drop-10-june-report-2023-07-04/
