Cyber Insurance Policies: Worth the Money?

Screen-Shot-2015-09-14-at-12.24.50-PM.png

The global cyber insurance market is expected to triple in size, reaching an estimated $7.5 billion in annual premiums by the year 2020, according to a new research study from PwC. http://ow.ly/T4rW2

The report, titled “Insurance 2020 & beyond: Reaping the dividends of cyber resilience,” states that 71 percent of insurance CEOs, 79 percent of banking CEOs, and 61 percent of business leaders across all industries see cyber attacks as a threat to growth.

Respondents also ranked cyber attacks as a greater threat than shifts in consumer behavior, the speed of technological change and supply chain disruption. Furthermore, PwC’s annual survey of security, IT and business executives found that there were nearly 43 million global security incidents detected in 2014 – an equivalent of more than 100,000 attacks a day.
“Boards are coming to realize the need for safeguards against the most damaging cyber attacks,” read the report.
Cyber security concerns and massive data breaches are part of our daily news cycle. As a result, companies of every size and industry are carefully examining their cyber security preparedness, both as a matter of good business and because they are being forced to do so by regulators and their customer and client base. An integral part of that self-reflection process is (or at least should be) the availability of insurance coverage for the risks presented by security breaches.
Some companies have purchased “dedicated” cyber insurance policies that provide coverage for first-party and third-party risk exposures. Other companies are still in the evaluation phase and are appropriately wondering whether such policies are needed, and, if so, whether insurers are paying claims under them.

 Are We Covered for That?
At present, the only meaningful generality that can be made about the scope of coverage available under a dedicated cyber policy is that there is no “standard” coverage available. Several different insurers are offering cyber liability coverage and the nature of what is covered versus what is not varies significantly.
In addition, many of these policies include a series of coverage enhancements that can be added to the policy, sometimes at no additional premium. But the policyholder must be a savvy consumer who makes the right “ask” and has a good handle on the risks that it is seeking to insure.
For example, some insurers are willing to provide coverage for PCI-DSS assessments while other insurers are not. Moreover, many insurers willing to provide coverage for this type of claim will not provide “full limit” coverage for the risk exposure and instead will place a “sub-limit” for such claims.
The insurer’s willingness to provide this coverage, and the extent of limit available for it, will depend on the number of records handled, the strength of the insured’s existing procedures to prevent security breaches, and the data breach claims history.

Are Claims Being Paid?
We are still in the very early stages of evaluating the claims history associated with cyber insurance policies. For the past several years, insurers have been grappling with how to underwrite the risks that will be insured, how to offer the “right” limits, and how to appropriately price the policies, both in terms of premiums and self-insured retentions.
So far, there is anecdotal evidence to support the proposition that some of the headline- grabbing data breaches involved recovery of at least some cyber insurance. But we have not yet seen the emergence of hotly contested coverage litigation associated with new cyber insurance policies. Rather, most court battles addressing security and data breaches continue to focus on the availability of coverage under “traditional” insurance policies.

In some instances, we have seen insurers pay a claim because there was an extremely low sub-limit and the insurer recognized that the scope of the loss far exceeded any coverage fight worth having. In other instances, we have seen policyholders manage the size and scope of the risk to a level that stays within the (often very high) self-insured retention such that the insurer is not required to pay.

But earlier this year, there was an interesting lawsuit filed that suggests insurers may be prepared to pay their insureds’ claims and then pursue recovery from responsible third parties. In that case, Travelers Casualty and Surety Co. of America paid a claim submitted by its policyholder for a security breach that resulted from a hacking event.
The policyholder, Alpine Bank, had hired a professional designer to design the company’s website and maintain the host server. Hackers accessed the website and gained entry to customer information. As a result, the policyholder was required to incur significant breach-notification costs.

Travelers paid the claim and then sued the designer, alleging that the designer failed to place basic anti-malware software on the server and failed to maintain adequate encryption controls over the customer data. It is premature to predict the outcome of the lawsuit. Nevertheless, it does offer some hope that insurers intend to stand by the coverage provided under cyber policies and then take up the fight to pursue responsible third parties for breach events.
How Do We Maximize Recovery?

There are two critically important steps that companies must take to maximize the likelihood and amount of their insurance recovery under cyber policies.

First, companies must take great care to conduct detailed and comprehensive due diligence during the application process of buying the cyber policies. Many insurers are requiring prospective insureds to supply a warranty letter along with a formal insurance application before issuing the cyber policy. Policyholders are well served to provide more, not less, information from the appropriate constituencies in connection with these requirements. Robust disclosure will reduce an insurer’s attempt to cry “foul” after a loss has occurred.

Second, companies must understand the importance of providing timely written notice after a loss, even if the loss may not exceed the retention. The new cyber policies are written on a “claims-made” basis such that a delay in providing notice of the claim may result in complete forfeiture of coverage. Moreover, insurers will not give credit to dollar amounts spent against the retention unless and until they are on notice of a claim.

PWC: http://ow.ly/T4rW2
Security Affairs: http://bit.ly/1OihiBM
WW2: http://bit.ly/1jMcrOj

 

« Bitcoin Made Official by US Trade Commission
Where’s The Money in Data? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Redcentric

Redcentric

Redcentric is a leading UK IT managed services provider. We deliver managed IT, cloud computing, data backup, information security services and managed networks.

CSA Events

CSA Events

Cloud Security Alliance conducts a series of conferences around the world. This listing provides a link to details of upcoming events.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

CyberGuarded

CyberGuarded

CyberGuarded are an accredited vendor independent information security testing and auditing company.

BankVault

BankVault

BankVault is a new type of cyber technology (called remote isolation) which sidesteps your local machine and any possible malware.

Pentest People

Pentest People

Pentest People are a UK-based security consultancy focussing on bringing the benefits of Pentesting as a Service (PTaaS) to all its clients.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Emirates International Accreditation Center (EIAC)

Emirates International Accreditation Center (EIAC)

EIACI is the national accreditation body for the United Arab Emirates. The directory of members provides details of organisations offering certification services for ISO 27001.

Naukrigulf

Naukrigulf

Naukrigulf.com is one of the fastest growing job sites in the Gulf, with thousands of registered job seekers and a robust CV database across many sectors, including cybersecurity.

Defensity

Defensity

Defensity offer bespoke & pre packaged IT Security Solutions for Small business to help companies reduce overall IT related risk.

LeadingIT

LeadingIT

Leading IT provides IT support, cloud computing, email support, cybersecurity, networking and firewall services to Chicagoland businesses.

ITConnexion

ITConnexion

From cloud migration to ransomware protection, our managed IT services can be customised to address the most prevalent IT issues for your business.

Deft

Deft

Deft (formerly ServerCentral Turing Group) is a trusted provider of colocation, cloud, and disaster recovery services.

Innefu Labs

Innefu Labs

Innefu is an Information Security R&D startup, providing cutting edge Information Security & Data Analytics solutions.

Kralos

Kralos

Kralos are an experienced team of Software and IT experts, specialized in the development of innovative cybersecurity solutions.

Boecore

Boecore

Boecore is an aerospace and defense engineering company that specializes in software solutions, systems engineering, cybersecurity, enterprise networks, and mission operations.