Cyber insurance is a growing field putting business and security leaders to the test as they navigate the often tricky process of researching and purchasing policies. Technology is quickly changing, and so is risk. Insurance for cyber-security is different from other types of insurance because the nature of threats is constantly changing. A hurricane doesn’t change intensity because a building code changes, but cyber-criminals will change their strategies as technology and risk evolve.
“New trends like BYOD, and IoT make tech strategy change all the time,” says Portnox CEO Ofer Amitai. “It’s really a problem for businesses to assess their policies and terms. Technology is so dynamic. It’s difficult to say what’s going on; what’s their risk.”
These changes make it harder for underwriters and companies to stay abreast of the landscape. During the tricky process of buying cyber insurance, you’ll ask and answer questions about your company, security posture, and other factors to determine which policy is best for you, and how much coverage you should buy.
It’s worth noting the research process is changing for businesses as the marketplace gets more competitive, notes David Bradford, chief strategy officer and director of strategic partner development at Advisen. Because insurers are fighting to underwrite the same businesses, they’re making the purchasing process less burdensome for clients.
That said, insurance remains a tricky field to navigate, especially for companies new to it.
1.What am I afraid of ?
A key step in buying cyber insurance is figuring out what to protect, Amitai explains. This goes beyond the common concerns around customer and employee data to include things like brand reputation.
If a data breach hits, your business will need to worry about more than IT damage. The cost of public relations expertise, to recover a brand name following an attack, may not be covered under a cyber insurance policy.
2.Cyber insurance is data breach insurance, right?
Oftentimes companies perceive cyber insurance as data breach insurance but it is important to understand breaches make up one portion of cyber insurance coverage. Policies also cover the cost of forensics, legal fees, business interruption, and a whole variety of expenses incurred related to a cyber incident.
3.Where do my Exposures lie?
Many companies struggle to purchase insurance because they don’t know where their weaknesses are. Risk assessments help them identify their exposures, where their greatest vulnerabilities lie, and which assets are most vulnerable. Where does sensitive data reside? For multi-national firms, how large and varied is your attack surface? Are you protected in all the areas where sensitive data is stored? Because cyber insurance is a fairly new field, companies often neglect to do this. Quantifying risk is a critical step in determining how much insurance coverage to buy.
4.What is the potential damage?
Once you determine your most critical assets and where your vulnerabilities lie, it’s important to gauge the likelihood and potential cost of an attack. Which scenarios do you care about? How much will it cost if your most valuable information is exposed to cyber-crime? This number is likely to change as businesses adopt new technologies like cloud, mobile, and IoT, all of which will increase the attack surface and potential cost of a breach.
Cyber insurance isn’t a replacement for strong security measures, and businesses should continue to change their strategies to acknowledge the risk these products will bring. Insurance is something you want to have in place, but it’s not a replacement for best practices. It ensures a loss and you won’t have to close the business if you get a major breach.
5.How does the size of my business affect my insurance policy?
Small companies undergo a simple insurance application process. They may answer four to five questions that don’t require investigation; for example: Do you have a firewall? Do you encrypt at-risk data? Inquiries won’t go much deeper than that, and smaller businesses will be given a fixed price for their risk.
The process gets more complicated for mid-size organisations, which typically answer a questionnaire about the security controls they have in place. They will provide information about firewalls and other data protection policies, data access and recovery, outsourcing, and compliance.
Larger businesses have to do the most work in developing information for underwriters. Insurers typically require an audit of most big organisations. Underwriters have to speak with CISO, CIO, and IT teams, making the process burden-some and complex.
6.Where are there gaps in my policy?
Given the range of cyber insurance policies, businesses need to put in their due diligence to determine which one is right for them.
One of the biggest problems with cyber insurance is organisations don’t have a firm grasp of what is and isn’t covered. Many make the mistake of not buying the correct amount of the insurance that best suits their needs.
Different types of businesses face different threats. Misunderstanding your policy can lead to some unfortunate outcomes. What happens if a hacker breaks into a medical device and causes physical harm? Is bodily injury covered under your insurance policy? It’s understandable to think so, but this isn’t included in many plans.
Manufacturers, another example, are exposed to property damage. If someone hacks into their control system and wreaks havoc in production, the business may expect their cyber-insurance policy will cover it. Many of them don’t.
- How can I make sure I’m doing this right?
Experts recommend consulting a broker when things get difficult, but to choose with caution. There are some excellent brokers in the field, but many are so new they don’t have enough experience to effectively advise clients.
Work with a broker who has domain expertise in cyber insurance. This is important because cyber insurance policies vary from carrier to carrier. Auto policies, for example, are generally similar. Cyber varies in language and policies.
Most major brokerage operators have on-staff experts who know enough to work with large businesses purchasing cyber insurance policies. Small companies buying via local agents or brokers, in contrast, may find those don’t have the level of expertise they need.
Source: Cyber Security Intelligence
