Insights On Cybersecurity Insurance Every Business Should Know And Apply

It’s unfortunate and a bit scary that today’s business landscape is constantly at risk from significant security threats. With this in mind cybersecurity insurance can be a wise investment for businesses of any size seeking to protect against the financial consequences of a cyberattack or data breach.

Despite the complexities and costs of acquiring cyber insurance, it is still one of the best investments for mitigating the financial impact of a cyber incident – especially for small- and medium-sized businesses, which may not have the resources to cover the costs of a major cyberattack. Cyber insurance can also provide coverage for business interruption, a major concern for companies that rely on technology to conduct their operations.  

Be aware though that pricier premiums for cybersecurity insurance is an unfortunate consequence of the rising number of costly data breaches, ransomware, and other security attacks. Cyber insurance premiums increased by an average of 28% in the first quarter of 2022 compared with the fourth quarter of 2021, according to the Council for Insurance Agents and Brokers. According to Check Point Research, there was a 38% increase in global attacks in 2022 compared with 2021, accompanied by rising costs for insurers defending and settling cyber claims. IBM’s “Cost of a Data Breach Report 2023” (registration required) showed 83% of organizations experienced more than one data breach, while the average cost of a data breach reached $9.44 million in the United States and $4.25 million globally. Also, governments around the world are enacting stricter regulations to protect personal information and sensitive data, resulting in higher limits of liability, a broader definition of loss (reputation recovery, financial recovery, more detailed reporting requirements, etc.), and regular audits and assessments to ensure companies are adhering to enhanced privacy measures.

With stricter requirements, companies will need to be proactive in assessing their insurance needs, weighing the costs and benefits, and working with insurers to ensure they have the right coverage in place.  

Whether cyber insurance is necessary for your business depends on several factors, including the size of your business, the types of data you collect and store, and the potential impact of a data breach or cyberattack. If your business stores sensitive customer information, handles financial transactions, or relies on technology for daily operations, it’s particularly vulnerable to cyber threats. In such cases, cyber insurance can provide critical protection against financial losses, reputational damage, and legal liability in the event of a breach. Large enterprises, and even small businesses, can benefit from cyber insurance, as the cost of a breach could be substantial and possibly devastating for a business, regardless of its size. By purchasing cyber insurance, you can transfer some financial risk associated with cyberattacks to the insurance company.

Cyber insurance is an insurance policy that provides financial protection against losses resulting from cyberattacks, data breaches, and other cyber-related incidents. It may cover costs related to lost income, legal fees, data recovery fees, and the cost of hiring a public relations firm to help with damage control to a company’s brand. Cyber insurance policies typically include coverage for both first party (direct) losses (such as lost revenue or data recovery costs) and third-party losses (such as legal costs and settlement payments). However, insurance companies have now realized that the prevalence of ransomware, and its focus on backup systems, has significantly increased their liability. For this reason, the ability to gain cyber insurance, or maintain it, has changed. 

Of particular note is the reality that Insurance companies have become increasingly careful about underwriting cyber-insurance policies, making it harder for organizations to purchase policies at an affordable price point with the coverage level needed. It’s not difficult to figure out why insurers are hesitant — cyberattacks continue to increase while losses may exceed what the insurance market is able to absorb. For example, higher loss ratios for cyber insurance in 2020 and 2021 resulted in higher premiums in 2022 to manage that risk.  Going forward from 2023 and beyond this pattern will likely continue.

It’s not surprising that insurers themselves are now proponents of more effective cyber-risk management for policy holders. Expect to see underwriters do the following:

• Deny coverage if you don’t have bare-minimum controls in place. This may include raising the bar for minimum controls. For example, traditional multifactor authentication (MFA) may not be accepted as a strong enough control due to man-in-the-middle (MitM) attacks.
• Tie premiums to the maturity of your security controls.
• Include additional conditions and limitations on policies based on the security posture of policyholders and the controls in place when an incident occurs.

While many organizations see cyber insurance as a vital tool for managing cyber-risk, insurers are putting stricter coverage policies in place and increasingly denying claims. As organizations face heightened scrutiny and undergo tighter underwriting processes, it’s important to be able to show that your organization is worthy of cyber-insurance coverage.

So just what should organizations implement in order to satisfy the changing requirements of cyber-insurance underwriters. A good place to start is with these 10 controls to manage cyber-risk:

1. Use invisible/phishing-resistant MFA and move to a password less solution.
2. Segment and segregate networks.
3. Adopt a robust data backup strategy.
4. Disable administrative privileges on endpoints.
5. Conduct regular employee security awareness training.
6. Deploy endpoint detection and response (EDR) and anti-malware solutions.
7. Implement Sender Policy Framework (SPF) to prevent email spoofing and phishing attempts.
8. Create a security operation center (SOC) that operates 24/7.
9. Deploy a security information event management (SIEM) platform to enable threat detection, incident response, and compliance management.
10. Implement robust security measures for service accounts within Active Directory (AD) environments.

These 10 controls are a great starting point. But keep in mind it’s likely there are many more factors underwriters will evaluate as they review new policy applications (AND renewals). It’s a safe bet that underwriters will get more sophisticated about their requirements for identity protection, authentication mechanisms, access controls, and identity management processes to minimize the likelihood and potential impact of a data breach. 

Also, many cyber-insurance policies require organizations to comply with specific regulations related to data protection and privacy where they apply (think HIPAA, FISMA, and GLBA as examples). Demonstrating compliance with these regulations increases your likelihood of qualifying for coverage, possibly leading to more favorable policy terms as well. Compliance can also demonstrate your commitment to securing identities and personal information, which can positively influence insurance underwriting decisions, coverage terms, and premiums.

For starters, as an organization considering cybersecurity insurance it’s important that you have a conversation focusing on these two simple questions:

1.  Are you applying for a new policy, or do you have an existing policy coming up for renewal?