Cyber Insurance Policies: Worth the Money?

Screen-Shot-2015-09-14-at-12.24.50-PM.png

The global cyber insurance market is expected to triple in size, reaching an estimated $7.5 billion in annual premiums by the year 2020, according to a new research study from PwC. http://ow.ly/T4rW2

The report, titled “Insurance 2020 & beyond: Reaping the dividends of cyber resilience,” states that 71 percent of insurance CEOs, 79 percent of banking CEOs, and 61 percent of business leaders across all industries see cyber attacks as a threat to growth.

Respondents also ranked cyber attacks as a greater threat than shifts in consumer behavior, the speed of technological change and supply chain disruption. Furthermore, PwC’s annual survey of security, IT and business executives found that there were nearly 43 million global security incidents detected in 2014 – an equivalent of more than 100,000 attacks a day.
“Boards are coming to realize the need for safeguards against the most damaging cyber attacks,” read the report.
Cyber security concerns and massive data breaches are part of our daily news cycle. As a result, companies of every size and industry are carefully examining their cyber security preparedness, both as a matter of good business and because they are being forced to do so by regulators and their customer and client base. An integral part of that self-reflection process is (or at least should be) the availability of insurance coverage for the risks presented by security breaches.
Some companies have purchased “dedicated” cyber insurance policies that provide coverage for first-party and third-party risk exposures. Other companies are still in the evaluation phase and are appropriately wondering whether such policies are needed, and, if so, whether insurers are paying claims under them.

 Are We Covered for That?
At present, the only meaningful generality that can be made about the scope of coverage available under a dedicated cyber policy is that there is no “standard” coverage available. Several different insurers are offering cyber liability coverage and the nature of what is covered versus what is not varies significantly.
In addition, many of these policies include a series of coverage enhancements that can be added to the policy, sometimes at no additional premium. But the policyholder must be a savvy consumer who makes the right “ask” and has a good handle on the risks that it is seeking to insure.
For example, some insurers are willing to provide coverage for PCI-DSS assessments while other insurers are not. Moreover, many insurers willing to provide coverage for this type of claim will not provide “full limit” coverage for the risk exposure and instead will place a “sub-limit” for such claims.
The insurer’s willingness to provide this coverage, and the extent of limit available for it, will depend on the number of records handled, the strength of the insured’s existing procedures to prevent security breaches, and the data breach claims history.

Are Claims Being Paid?
We are still in the very early stages of evaluating the claims history associated with cyber insurance policies. For the past several years, insurers have been grappling with how to underwrite the risks that will be insured, how to offer the “right” limits, and how to appropriately price the policies, both in terms of premiums and self-insured retentions.
So far, there is anecdotal evidence to support the proposition that some of the headline- grabbing data breaches involved recovery of at least some cyber insurance. But we have not yet seen the emergence of hotly contested coverage litigation associated with new cyber insurance policies. Rather, most court battles addressing security and data breaches continue to focus on the availability of coverage under “traditional” insurance policies.

In some instances, we have seen insurers pay a claim because there was an extremely low sub-limit and the insurer recognized that the scope of the loss far exceeded any coverage fight worth having. In other instances, we have seen policyholders manage the size and scope of the risk to a level that stays within the (often very high) self-insured retention such that the insurer is not required to pay.

But earlier this year, there was an interesting lawsuit filed that suggests insurers may be prepared to pay their insureds’ claims and then pursue recovery from responsible third parties. In that case, Travelers Casualty and Surety Co. of America paid a claim submitted by its policyholder for a security breach that resulted from a hacking event.
The policyholder, Alpine Bank, had hired a professional designer to design the company’s website and maintain the host server. Hackers accessed the website and gained entry to customer information. As a result, the policyholder was required to incur significant breach-notification costs.

Travelers paid the claim and then sued the designer, alleging that the designer failed to place basic anti-malware software on the server and failed to maintain adequate encryption controls over the customer data. It is premature to predict the outcome of the lawsuit. Nevertheless, it does offer some hope that insurers intend to stand by the coverage provided under cyber policies and then take up the fight to pursue responsible third parties for breach events.
How Do We Maximize Recovery?

There are two critically important steps that companies must take to maximize the likelihood and amount of their insurance recovery under cyber policies.

First, companies must take great care to conduct detailed and comprehensive due diligence during the application process of buying the cyber policies. Many insurers are requiring prospective insureds to supply a warranty letter along with a formal insurance application before issuing the cyber policy. Policyholders are well served to provide more, not less, information from the appropriate constituencies in connection with these requirements. Robust disclosure will reduce an insurer’s attempt to cry “foul” after a loss has occurred.

Second, companies must understand the importance of providing timely written notice after a loss, even if the loss may not exceed the retention. The new cyber policies are written on a “claims-made” basis such that a delay in providing notice of the claim may result in complete forfeiture of coverage. Moreover, insurers will not give credit to dollar amounts spent against the retention unless and until they are on notice of a claim.

PWC: http://ow.ly/T4rW2
Security Affairs: http://bit.ly/1OihiBM
WW2: http://bit.ly/1jMcrOj

 

« Bitcoin Made Official by US Trade Commission
Where’s The Money in Data? »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

AirCUVE

AirCUVE

AirCUVE provide authentication and access control solutions for networks and mobile security.

Verimuchme

Verimuchme

Verimuchme is a digital wallet and exchange platform to secure, verify and re-use personal information.

Jiran Security

Jiran Security

Jiran Security provides data and application security solution over email, mobile device and endpoints.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

OpenText

OpenText

OpenText is a leader in Enterprise Information Management software and a portfolio of related solutions for Information Governance, Compliance, Information Security and Privacy.

Fyde

Fyde

Fyde helps companies with an increasingly distributed workforce mitigate breach risk by enabling secure access to critical enterprise resources.

Deepwatch

Deepwatch

The Deepwatch Platform helps organizations reduce risk through early and precise threat detection and remediation.

Absa Cybersecurity Academy

Absa Cybersecurity Academy

Absa Cybersecurity Academy is an initiative aimed at empowering marginalised South African youths to become certified cybersecurity specialists.

Netenrich

Netenrich

The Netenrich operations intelligence platform is built from the ground up to help enterprises resolve everyday and futuristic problems for stable, secure environments and infrastructures.

Tabidus Technology

Tabidus Technology

Tabidus Technology is a cybersecurity association that unites and provides the global protection options against cyber threats.

Infiot

Infiot

Infiot is a pioneer in enabling secure, reliable access with zero trust security, network optimization, edge-intelligence and AI driven operations for all remote users, devices, sites and cloud.

Aiden Technologies

Aiden Technologies

Aiden simplifies your IT process, giving you peace of mind and security by ensuring your computers get exactly the software they need and nothing else.

TokenEx

TokenEx

TokenEx Cloud Security Platform protects sensitive data to strengthen our clients' security postures while future-proofing their operations.

Intel 471

Intel 471

Intel 471 provides adversary and malware intelligence for leading intelligence, security and fraud teams.

Core4ce

Core4ce

Core4ce is a mission-oriented company that serves as a trusted partner to the national security community.

AKS iQ

AKS iQ

AKS iQ leads the RegTech sector with AI, automating regulatory compliance in the banking industry and ensuring paperless TBML and CFT adherence in finance.