Cyber Criminals Do Not Care Who Falls Victim

The first thing to know about cyber attacks is that they are not a new thing at all. In fact, the first recorded cyber attack happened almost 200 years ago in France in 1834, when the attackers sold financial information using the French Telegraph System!

To this day there are still many misconceptions around cyber attack, one of them being how vulnerable businesses are to them. There is a belief that smaller businesses are less at risk, but the reality is that all businesses are vulnerable.

Cyber attacks are not necessarily targeted at you, you may just be collateral damage. The criminals simply do not mind who falls victim; they will use ransomware against you, and they will try to extort money from you
We need to stop thinking about cyber attacks as how they’re portrayed in movies. Cyber criminals are sophisticated, with high-end software, and they spend just as much as a top-end global company on the best technology available.

Why Do Businesses Need Cyber Insurance

The truth is that cyber insurance should form part of every business' resilience strategy. In December 2023, the UK Parliamentary Joint Committee on the National Security Strategy (JCNSS) issued a report on ransomware, detailing its impact on businesses and national security, and how difficult it was to recover from such an attack.

One thing that is resoundingly clear from this report is that businesses who have bought cyber insurance fare better than those that have not.

If you get hit with a cyber attack and you have not got the resources to rebound and recover, your business can disappear. You only need to look in the press to see real-life examples of UK companies that have ceased trading because of a cyber-attack.

Outsourcing your IT does not make your business a lesser risk. Criminals are aware of these outsourced companies and if they can successfully infiltrate them, they don’t just get access to one business but potentially hundreds.

If you look at the SolarWinds attack in 2020, that's a classic example of hitting an outsourcer and getting access to a lot of businesses.

Policies

When you buy cyber insurance, it is a case of you get what you pay for. At the lower end of the scale, the £100 policies would provide just one part of the three most important elements of cover - the incident response element.
But if you look at the most comprehensive cyber insurance available, you’ll find protection that’s not just about intervention but also about preventing a cyber-attack in the first place.

When selecting your cover, you need to be looking at what the cover provides rather than the cost. Ultimately, it’s important to remember that this policy can be the difference between your business existing in 12 months and not.

Cyber Secruity Or Cyber Insurance

I think that both are vital. Robust security measures will help you minimise the risk of an incident. There’s no way we’ll ever be able to guarantee with 100% certainty that an attack won’t happen, but having the support of an insurer with specialist services can be the difference between your business existing in 12 months or ceasing.
When we talk about cyber insurance, you'll hear a term called “proactive cyber”, meaning that insurers are going to give you access to tools to help you to manage your risk and mitigate claims if they do occur.

Ideally, you should not consider cyber insurance to be part of your insurance spend but rather part of your IT expenditure.

If possible, you should put it under the control of your IT director and manager as, in the event of a cyber incident, they are going to be the ones dealing with it and trying to get your business back up and running. They are the team who will need access to these tools and support, and they will need it fast.

Worst Case Scenario

The worst-case scenario is that your business ceases to exist. If you watch the news, you will have seen that a very long-established company called Knights of Old suffered an incident last June which they couldn't survive. The BBC report stated the company suffered a cyber incident, and this has cost them their entire business. That incident alone cost 730 people their jobs.

How Cyber Insurance Could Evolve In The Next Five Years

I think ransomware will continue to be a dominant factor that businesses will need to consider very carefully. Ransomware has changed. When it first appeared, it took the form of targeted attacks and the demand for huge sums of money, whereas now it is more of a scattergun effect. They cast the net wide but demand lower ransom fees, so the severity of these attacks is in theory reducing but the frequency is increasing.

This in turn will inevitably lead to increased pressure on the cost of cover from insurers. In the UK, we are seeing new entries into the cyber insurance market so that may potentially offset the increases being levied because of ransomware.

I think risk management will become more important for clients and could be the deciding factor between being offered cover and not being able to obtain cover.

AI is something to keep an eye on. Cyber criminals are very adept at embracing new technology, probably more so than traditional businesses. I've heard of AI being used to dupe a finance director into making a significant payment that they thought they were discussing with their CEO on a video call, only to discover afterwards that it wasn't the CEO on the video call at all, so I think the insurance industry will be looking to harness AI to help counter the threat that is posed by cybercriminals.

Finally, there's always the unknown. If a major global cyber event occurs, what is the cost likely to be and what impact is it likely to have? What will happen in terms of the cover that's available and all the rates and costs of the insurance?

Marc Rocker is Head of Cyber at Towergate Insurance

Image: Unsplash

You Might Also Read: 

Cyber Insurance For Industrial Companies - Its Complex:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Britain's Cybersecurity Business Is Booming
Protecting Data In The Remote Working Era »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: Gen AI for Security: Adoption strategies with Amazon Bedrock

ON-DEMAND WEBINAR: Gen AI for Security: Adoption strategies with Amazon Bedrock

Watch this webinar and get a comprehensive roadmap for securely adopting generative AI using Amazon Bedrock, a fully managed service that offers a choice of high-performing foundation models (FMs).

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CW Jobs

CW Jobs

CWJobs.co.uk is a leading specialist IT recruitment website covering all areas of IT including Cyber Security.

Hack in the Box Security Conference (HitBSecConf)

Hack in the Box Security Conference (HitBSecConf)

HITBSecConf is a platform for the discussion and dissemination of next generation computer security issues. Our events feature two days of training and a two-day multi-track conference

CCL Solutions Group

CCL Solutions Group

CCL is one of Europe’s leading digital investigation specialists, supporting law enforcement, government and organisations across both public and private sectors.

Trinexia

Trinexia

Trinexia (formerly Credence Security) is a specialty Value-added Distributor of Cyber Security, Digital Forensics, Security Awareness, Data Security & Governance solutions.

WetStone Technologies

WetStone Technologies

WetStone develops software solutions that support investigators and analysts engaged in eCrime Investigation, eForensics and incident response activities.

Security & Intelligence Agency (SOA) - Croatia

Security & Intelligence Agency (SOA) - Croatia

SOA is the Croatian security and intelligence service. Areas of activity include Cyber Security and Information Security.

Telelogos

Telelogos

Telelogos is a European provider of Enterprise Mobility Management software, Digital Signage software and Data Transfer and Synchronization software.

Ioetec

Ioetec

Ioetec's mission is to connect users to their IoT devices securely, ensuring these devices remain safe to use in our increasingly connected world.

Nu Quantum

Nu Quantum

Nu Quantum is developing quantum photonics hardware to power the quantum revolution in communications, sensing and computing.

CyberNet Albania

CyberNet Albania

Cybernet Albania has been providing IT support and services to small businesses since 2016. We strive to eliminate your IT issues before they cause downtime and impact your operations.

Digital Identification & Authentication Council of Canada (DIACC)

Digital Identification & Authentication Council of Canada (DIACC)

DIACC is a non-profit coalition of public and private sector leaders committed to developing a Canadian framework for digital identification and authentication.

IgmGuru

IgmGuru

Igmguru offers certification online training courses for IT professionals and students. Get certified with high-in-demand job-oriented professional courses.

Resourcive

Resourcive

Resourcive is the first Value Added Sourcing “VAS” consultancy. We deliver strategic IT sourcing solutions to mid-market and enterprise clients.

Siren

Siren

Siren provides the leading Investigative Intelligence Platform to some of the world’s leading Law Enforcement, National Security and Cyber threat investigators.

Cyber Capital Partners

Cyber Capital Partners

Cyber Capital Partners build strategic and financial partnerships with small and mid-sized cybersecurity companies in highly regulated markets.

Contextal

Contextal

Contextal develops cutting-edge open-source cybersecurity solutions, designed to connect the dots and detect complex threats, which slip through the existing protections.