Cyber Insurance: Well Worth it but Beware of Exclusions

It’s what all sensible people do to mitigate the risk of catastrophic financial damage: Buy insurance. There’s not even a choice when it comes to auto and health risks – insurance is a legal mandate. And most people would agree that anyone with a house who does not carry homeowner’s insurance is a fool or fabulously wealthy.

So, why not use cyber insurance? Indeed, the case for it is compelling. The costs of data breaches are in the millions and rising fast. As the Ponemon Institute put it in a synopsis of one of its recent reports on the issue, “data breaches have become as common as a cold, but far more expensive to treat.”

In another report sponsored by HP Enterprise Security, Ponemon found that, “the average annualized cost of cyber crime incurred by a benchmark sample of U.S. organizations was $12.7 million,” up 96% since five years ago. The average cost to resolve a single breach was $1.6 million.

Most policies are nowhere near inclusive of all cost associated with breaches. So, as Wendi Rafferty, vice president of services at CrowdStrike, put it to CSO in an earlier interview, part of any prudent organization’s advance plan to respond to a data breach should include data breach insurance.

The biggest reason is that a general liability policy is no longer enough. It covers, “third-party claims of bodily injury or property damage, but the trend among insurance providers is to exclude electronic records and data,” said Jared Kaplan, executive vice president and CFO of Insureon.

Getting effective cyber insurance is not simple, however. Data breaches, in addition to being expensive, are notoriously complicated. They require a host of costly responses, including forensic investigation, notification of first and third parties, fulfillment of legal and compliance obligations, possible litigation, working with law enforcement, public relations, credit monitoring fees, crisis management – the list goes on.

As technology risks continue to evolve, many carriers are starting to pull back on the types of industries and risks they will cover.
Also different industries have different kinds of risks, health care is not the same as retail, which is not the same as buying for Education.
That means simply buying a “cookie-cutter, off-the-shelf” policy is asking for trouble since it will likely have exclusions for significant expenses.

According to a recent post in Dark Reading, many such policies exclude coverage for:

  • Breaches of protected information in paper files.
  • Claims brought by the government or regulators, including the Office of Civil Rights, the Department of          Health and Human Services, and the Office of the Attorney General.
  •  Vicarious liability, for data entrusted to a third-party vendor, when the breach occurs on the vendor’s system.
  •  Unencrypted data.

Some damages, of course, cannot be measured exactly. But there are ways to close coverage gaps. One of the most obvious is to practice good security “hygiene,” including end-to-end encryption of data and keeping software up to date with all recent patches.

Common exclusions in “off-the-shelf” cyber insurance policies:

  •     Breaches of protected information in paper files
  •     Claims brought by the government or regulators
  •     Vicarious liability, for data entrusted to a third-party vendor that is     breached
  •     Unencrypted data
  •     Negligence: Failure to install software updates or security patches
  •     First-party notification expenses for disclosure of PII or PHI
  •     Many of the policies, with premiums ranging from $6,000 to $37,000, limit coverage to just $1 million, which      in today’s world rarely comes close to covering the total expenses.

In short, cyber insurance can ease the pain, but it won’t eliminate it.  

Techpageone

« 5 Ways to Use Virtual Reality in the Enterprise
Report Claims Huawei Don’t Pose a Risk to UK Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

WEBINAR: How To Build And Implement An Effective Endpoint Detection And Response Strategy

WEBINAR: How To Build And Implement An Effective Endpoint Detection And Response Strategy

Join this webinar to learn how the cloud threat landscape is evolving and organizations are deploying more advanced and capable security controls at scale.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Bloombase

Bloombase

Bloombase is the leading innovator in Next-Generation Data Security solutions for Global 2000-scale organizations

Indium Software

Indium Software

Indium Software is an Independent Software Testing Company offering software testing services (including security testing) and offshore Quality Assurance solutions.

CyberDefcon

CyberDefcon

CyberDefcon is an independent organization dedicated to the pursuit of making the internet a safer place.

Cyber, Space, & Intelligence Association (CSIA)

Cyber, Space, & Intelligence Association (CSIA)

CSIA focuses on issues critical to Cyber Security, Military Space and Intelligence.

App-Ray

App-Ray

App-Ray provides fully automated security analysis of mobile applications to find security issues, privacy breaches and data leaking potentials.

Sandia National Laboratories

Sandia National Laboratories

Sandia National Laboratories is a premier science and engineering lab for national security and technology innovation. Activity areas include Cyber and Infrastructure Security.

HumanFirewall

HumanFirewall

Your secuirty is dorectly proportional to the awareness of your employees. Use Phishing simulation across your organization to train & profile user behavior.

Arceo

Arceo

Arceo enables insurers and brokers to better assess, underwrite, and manage cyber risks using curated security data for accuracy and AI for advanced risk assessment.

Paladin Capital Group

Paladin Capital Group

Paladin is a leading global investor that supports and grows the world’s most innovative cyber companies.

Electric Power Research Institute (EPRI)

Electric Power Research Institute (EPRI)

The Electric Power Research Institute’s Cyber Security Research Laboratory (CSRL) addresses the security issues of critical functions of electric utilities.

Partners in Regulatory Compliance (PIRC)

Partners in Regulatory Compliance (PIRC)

Partners in Regulatory Compliance provides an array of cybersecurity services including cybersecurity policy management, risk assessments and regulatory compliance consulting.

JupiterOne

JupiterOne

JupiterOne is the security product that is changing how organizations manage and secure their software defined assets.

Paradyn

Paradyn

Paradyn-managed security services can provide a holistic view of your business environment, no matter how simple or complex it is.

Lockheed Martin

Lockheed Martin

Lockheed Martin deliver full-spectrum cyber capabilities and cyber resilient systems to defense, intelligence community and global security customers.

Asimily

Asimily

Asimily’s IoMT risk remediation platform holistically secures the mission-critical healthcare devices that deliver safe and reliable care.

The PenTesting Company

The PenTesting Company

The PenTesting Company is owned and operated by offensive security professionals. Penetration Testing is essentially all we do.