Advice For Cyber Insurance Buyers

The cyber insurance market continues to evolve, and the number of companies buying cyber insurance continues to expand. What’s more, that expanding cyber market offers a wide variety of coverage terms at different price points.

But companies interested in securing cyber insurance should know that the underwriting process requires careful diligence on their part. CFOs and risk managers need to have a firm grasp of the processes insurers use, not only to price a policy but also to determine whether they will agree to underwrite the risk at all.

One of the first steps in the underwriting process requires the company to submit an application to the insurer. The application will seek baseline information about the company’s size, number of records maintained, type of information maintained, security policies and procedures, and disaster planning.

The company’s ability to answer those questions with complete and detailed information is critical. Comprehensive answers can help ensure that the policy will be competitively bid by a number of insurers and secure the lowest premium pricing.

Underwriters will be most interested in companies that can communicate effectively that they know where their records are maintained and how many records are at risk. They’re also more open to companies that have implemented strong security measures to protect their records and minimise the likelihood of a breach.

Further, cyber carriers will also look for representations in their application about whether the corporation, and sometimes what’s termed “any insured” (which means all employees), has knowledge of claims, facts, or circumstances that can spawn a claim.

Some companies blunder by providing a response to that question without giving enough consideration as to who within the organisation is being asked to make that representation or on whose behalf the representation will be made. The consequence of failing to understand the importance of these requested representations can be severe.

For example, let’s look at the experience of a hypothetical credit card company which has just disclosed a hacking incident that compromised many customer email accounts several years ago. In its current disclosure, the company admitted that some of its employees, including senior executives and attorneys, knew about the breach at the time of the incident.

Even though the company had applied for and bought a cyber insurance policy late last year, coverage in this fact scenario could be seriously at risk. That’s because employee previous knowledge of the facts could lead to a claim by the insurer objecting to the fact that the company hadn’t disclosed that knowledge for several years.

Further, basing their claim on these facts, some insurers may seek to rescind the entire policy, asserting that a material misrepresentation was made in the application. In other words, insurers may argue that they have no coverage obligation for the undisclosed known breach or any other claims that may arise because the policy was issued under false pretenses.

“Meet and Greet” Underwriting

Once the application has been submitted, the underwriters may want direct access to the chief information officer or others responsible for protecting company information. Companies must understand that those individuals will play a key role in whether the insurer will agree to quote and/or how much will be charged to insure the risks.

But most CIOs and other “techies” aren’t familiar with the insurance procurement process and may not understand how information should be communicated to the insurer. To avoid missteps, companies should have a detailed planning meeting with representatives of the insurer along with the insurance broker and coverage counsel before information is relayed to the underwriter.

Finally, many insurers conduct their own diligence to evaluate whether to underwrite a risk and, if so, at what premium price point. Risk managers and CFOs should be aware that insurers are using a new type of metric to assess their companies’ cyber risk exposure. It’s called a “security score”, a concept akin to a credit score.

For example, BitSight Technologies is a risk assessment vendor that analyses companies for breach risk and response preparedness and assigns a security rating. According to its website, BitSight gathers data on security breaches from sensors deployed across the globe and uses algorithms to assess a company’s records management, encryption methods, and security vulnerabilities.

The firm then assigns a security rating and provides benchmarking information to demonstrate where the company falls short on the risk assessment spectrum. Companies on the lower end of the spectrum may not receive a quote for cyber insurance, while companies on the higher end may receive such better terms as lower premium or lower retentions. Companies looking to buy cyber coverage need to know that, in an important sense, they are not alone.

CFO:

For more information and help with your organisation’s security contact: Cyber Security Intelligence

You Might Also Read:

Five Pitfalls of Cybersecurity Insurance:

Cyber Crime Drives Up The Cost Of Insurance:

Cyber Should Be Standalone Insurance:

 

« Power Companies Cyber ‘Nightmare’
AI Meets Music’s Evolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Chatham House Cyber Conference

Chatham House Cyber Conference

14 June 2023 - Connect with cyber security experts and senior policymakers to explore the role of cyber security in the global economy and how to deliver an open and secure internet.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Digital Shadows

Digital Shadows

Digital Shadows is a cyber threat intelligence company that helps clients discover sensitive data exposed through social media, cloud services and mobile devices

Cyber Security Centre - University of Hertfordshire

Cyber Security Centre - University of Hertfordshire

The Cyber Security Centre provides training, teaching and research in the fast paced topics of cyber security and digital forensics.

APrivacy

APrivacy

APrivacy provides information and communication security products for the financial services industry.

European Network for Cyber Security (ENCS)

European Network for Cyber Security (ENCS)

ENCS’s core focus is around educating and solving cyber security challenges in the development and operation of energy grids across Europe.

Senrio

Senrio

Senrio provides a cybersecurity platform for the Internet of Things.

Appvisory

Appvisory

Appvisory by MediaTest Digital is the leading Mobile Application Management-Software in Europe and enables enterprises to work secure on smartphones and tablets.

Cybercrime Support Network (CSN)

Cybercrime Support Network (CSN)

CSN is a public-private, nonprofit collaboration created to meet the challenges facing millions of individuals and businesses affected each and every day by cybercrime.

PBOSecure

PBOSecure

PBOSecure is a dynamic and progressive IT consultancy company specializing in IT and Industrial Control System (ICS) security.

National Cybersecurity Preparedness Consortium (NCPC)

National Cybersecurity Preparedness Consortium (NCPC)

The mission of the NCPC is to provide research-based, cybersecurity-related training, exercises and technical assistance to local jurisdictions, counties, states and the private sector.

Global Accelerator Network (GAN)

Global Accelerator Network (GAN)

Global Accelerator Network are a highly curated community of independent Accelerators, Partners and Investors.

AuthLite

AuthLite

With AuthLite, you can keep using all your existing software, with added two-factor authentication security placed exactly where you need it.

BlockAPT

BlockAPT

BlockAPT, empowering you with an advanced, intelligent cyber defence platform. We protect our customers digital assets by unifying operational technologies against advanced persistent threats.

Trace3

Trace3

Trace3 is a pioneer in business transformation solutions, empowering organizations to keep pace with the rapid changes in IT innovations and maximize organizational health.

ATSG

ATSG

ATSG is a global leader in transformational technology solutions for today’s digital enterprise. Cybersecurity ranging from Advisory & Assessment to Fully Managed Detection and Response Services.

Brennan IT

Brennan IT

For over 25 years, Brennan’s expert team has helped businesses achieve real success through innovative and secure technology solutions.

Socura

Socura

Socura helps make the digital world a safer place; changing the way organisations think about cyber security through a dynamic, innovative, and human approach.