What is Cyber Insurance? Who needs It & What does it Cover?

What is Cyber Insurance?

Cyber insurance is a specialized form of insurance designed to protect businesses and individuals from the financial fallout of cyber threats and data breaches. In an era where digital technologies are integral to operations, cyber insurance helps mitigate the potentially devastating financial impact of cyber incidents.

The coverage typically includes protection against the costs associated with data breaches, such as notification expenses, credit monitoring, and legal liabilities. Additionally, cyber insurance may cover losses related to business interruptions, data restoration, and expenses incurred in dealing with ransomware attacks.

The goal is to provide financial support for the various aspects of recovery, including legal defense, settlements, and crisis management, thereby helping organizations navigate the complex landscape of cybersecurity risks. While cyber insurance is a valuable tool in managing digital risks, it’s important to complement it with robust cybersecurity measures and proactive risk management strategies.

Who needs cyber insurance and why?

Businesses of any size should consider cyber insurance as a way to protect against the financial losses that can occur from a security breach. It is important to note that cyber-criminals frequently target small companies as they generally have weaker security controls, and are thus an easier target. In fact, according to Securitymagazine.com, small businesses are the target of 43% of cyberattacks, and the fallout from these breaches can be very expensive in terms of lost productivity and brand reputation. The article states that 60% of all small firms that suffer a data breach close their doors permanently within six months of the incident.

What risks does cyber insurance cover?

Cyber insurance typically covers costs associated with cyber-related incidents, including legal expenses and fines. Examples of typical insurance clauses include;

• Data breach or incident response and crisis management.
• Data privacy liability.
• Cyber extortion.
• Network business interruption.
• Data asset protection.
• Network security liability.
• System failure, and more.

Does cyber insurance cover major cybersecurity events?

Yes, some cyber insurance policies do provide coverage for major cybersecurity events such as ransomware attacks, distributed denial of service (DDoS) attacks, data breaches, and other cyber-related incidents. There is limited public information about the largest claims made, however, the average total cyber insurance claim is said to be around USD 345,000, according to NetDiligence.

What isn’t covered by cyber insurance?

While cyber insurance policies vary among providers, there are certain aspects and scenarios that are commonly excluded or limited in coverage. It’s crucial for businesses to carefully review the terms and conditions of their cyber insurance policies to understand the scope of coverage. Here are some typical exclusions or limitations:

• Nation-State Attacks: Some policies may exclude coverage for cyberattacks carried out by or on behalf of nation-states or government-sponsored entities.
• War and Terrorism: Cyber insurance policies may not cover damages caused by acts of war or terrorism.
• Bodily Injury and Property Damage: Many cyber insurance policies focus on financial losses related to data breaches and may exclude coverage for bodily injury or physical property damage resulting from a cyber event.
• Criminal Acts by Insured: If the insured party is involved in criminal activities or intentionally causes a cyber event, coverage may be denied.
• Unapproved Third-Party Vendors: Some policies may not cover incidents arising from the actions of third-party vendors or service providers that were not explicitly approved by the insured.
• Failure to Implement Security Measures: Insurers may investigate whether the insured party has taken reasonable steps to implement cybersecurity measures. Failure to follow recommended security practices may result in limited coverage.
• Pre-existing Conditions: Some policies may exclude coverage for losses related to known vulnerabilities or breaches that occurred before the policy’s effective date.
• Losses from Physical Events: Damages caused by physical events, such as earthquakes, floods, or other natural disasters, may not be covered under cyber insurance policies.
• Intellectual Property and Trade Secrets: Coverage for losses related to intellectual property theft or trade secret breaches may be limited in some policies.
• Fines and Penalties: Cyber insurance may not cover fines and penalties imposed by regulatory authorities for non-compliance with data protection laws.
• Social Engineering and Employee Fraud: Some policies may have limitations on coverage for losses resulting from social engineering attacks or fraudulent activities carried out by employees.
• Data Loss without Breach: Policies may focus on data breaches, and data loss without evidence of unauthorized access may not be covered.

It’s important for businesses to work closely with their insurance providers and legal advisors to understand the specific terms and conditions of their cyber insurance policies, as well as to identify potential gaps in coverage. Regularly reviewing and updating policies to address evolving cyber threats is also advisable.

The cost of cyber insurance and its future

The cost of cyber insurance depends on a variety of factors, including the size of the company, the industry, and the level of coverage desired. Policies can range from a few hundred dollars per year to several thousand dollars per year. According to the following article, the average cost of cyber insurance in the U.S. in 2021 was $1,589 per year or $132 per month.

The demand for cyber insurance is expected to continue to grow as businesses become increasingly reliant on digital technology, and as more employees continue to access their company’s network from remote, unsecured locations. As technology evolves, cyber insurance policies will need to keep pace with new cyber threats, such as ransomware and artificial intelligence (AI) attacks. According to the following blog post on Security.org, in 2020, the global cyber insurance market was worth $7.8 billion, and is estimated to be worth around $20 billion by 2025.

What can companies do to reduce cyber insurance premiums?

There are many things that companies can do to reduce their cyber liability insurance premiums, such as;

• Establishing a comprehensive set of well-documented security policies and procedures that can be reviewed by the insurer.
• Having a tried and tested incident response plan in place.
• Carrying out regular security awareness training.
• Implementing multi-factor authentication.
• Implementing strict access controls that are clearly documented.
• Carrying out penetration tests and vulnerability scans.
• Using an automated patch management solution.
• Adhering to best practices for data backup and recovery.
• Using a real-time auditing solution that can detect, alert, and respond to anomalous events, and instantly generate detailed reports that can be presented to the insurers to demonstrate the effectiveness of their security measures.

How can Lepide Help to Reduce Cyber Insurance Premiums?

The Lepide Data Security Platform is designed to give you the visibility you need to accurately assess the state of your organization’s security posture. Any time privileged accounts or sensitive data are accessed and used in a way that is not typical for a given user, a real-time alert is sent to the administrator’s inbox or mobile device. At the click of a mouse, you can generate detailed reports that can be delivered to your insurance provider to demonstrate your compliance efforts and to give them reassurance that you have the necessary controls in place to keep your data secure.

If you’d like to see how the Lepide Data Security Platform can help you reduce your cyber insurance premiums, schedule a demo with one of our engineers.