Companies Are Buying Cyber Insurance 'in mad panic'

With cyber-attacks increasing in frequency and severity, many companies are turning to insurance to cover their mounting losses. But can insurers quantify the risk accurately and could insurance lead to corporate complacency?
Many firms feel like they're under siege.

Cyber-attacks are coming thick and fast and the tools at the hackers' disposal seem to be getting more, not less, powerful.
Estimated annual losses from cybercrime now top $400bn (£291bn), according to the Center for Strategic and International Studies. The cost in lost productivity of last year's WannaCry ransomware attack alone was estimated at $4bn. So many businesses are buying cyber insurance "in a mad panic", warns Charl van der Walt of SecureData, a cyber-security company.

"Unfortunately this will mean that businesses of all sizes will seek out the minimum cyber-security investment laid out by insurers, government, and regulators, rather than going above and beyond to protect their own, and their customers' data."

Ransomware attacks, whereby criminals break in to your network, encrypt all your data, then demand money in return for the decryption key, are particularly virulent. Firms have even been stocking up on Bitcoins, the hackers' cryptocurrency payment of choice, to pay the ransoms. It's not just the immediate ransom costs they have to worry about. There are the costs of investigating and closing the breach, legal and public relations costs, the damage to your share price as consumers and clients lose confidence, and the loss of business resulting from a damaged reputation.

There are also potential regulatory fines to pay, particularly when the European Union's General Data Protection Regulation (GDPR) comes into force in May. Under the new rules your firm could be fined up to 4% of turnover or €20m, whichever is the greater, if regulators think you haven't protected customers' personal data adequately.

The average cost of a cyber breach was $349,000 in 2017, according to NetDiligence, whose data is based on actual cyber insurance claims. For a big company the average cost was $5.9m.

But US retailer Target, which had more than 40 million customer credit card details stolen in 2013, had to fork out $279m in total as a result of the breach, says specialist insurance market Lloyd's of London in a report compiled with consultancy KPMG and international law firm DAC Beachcroft. Around $100m of that was on lawsuits.

Telecoms company TalkTalk suffered losses of nearly $100m after its breach in 2015, says Lloyd's, and this included a £400,000 fine from the UK Information Commissioner's Office.

So it's perhaps little surprise that interest in cyber insurance has spiked recently.

The number of insurers offering cyber insurance via Lloyd's of London has leapt to more than 70, nearly double the number a few years ago. And insurance giant Allianz predicts that global cyber insurance premiums will grow to $20bn by 2025, up from around $3-4bn now. 

One insurer, Hiscox, says it has been enjoying robust growth in its cyber insurance business, particularly following the TalkTalk breach and as GDPR approaches.

"We're seeing annual growth of around 40% in cyber," says Gareth Wharton, chief executive of cyber at the insurer. "We expect to have taken around $100m in premiums in 2017."

But how do insurers know how to assess cyber risk accurately and set the right premium levels? "Cyber isn't like car or house insurance where the risks are known and the products haven't changed that much," says Mr Wharton. "The types of risk are changing all the time and there's no easy way of quantifying the cost of stolen data." So it's up to the insurer to make sure the client is an acceptable risk, he says.

"Firstly we need to understand how seriously the board takes cyber-security," says Mr Wharton. "Does it have a disaster recovery plan and how often does it test it?" 

The firm checks obvious security measures, too, such as the presence of antivirus and firewall protection, the frequency of software updates and data back-ups, and whether critical data is encrypted, he says. 

"We're trying to be a partner with our clients, not just a seller of insurance, so we offer free cyber security training as well. We have a responsibility to drive up standards and encourage better practice."

While there are several recognised ISO [International Organisation for Standardisation] standards covering various aspects of information security, there isn't one catch-all standard that global businesses can adopt to help insurers assess their cyber risk. 

The UK government insists that any company it does business with has to conform to the Cyber Essentials standards set by the National Cyber Security Centre. That's a start at least. "One of the biggest issues in cyber insurance is how to price it effectively and cover indirect as well as direct costs a company suffers following a cyber-attack," says Nik Whitfield, chief executive of Panaseer, a cyber risk assessor. Firms seeking insurance would be happy to be assessed in the hope of securing lower premiums, he argues.  

"Such a service would be the equivalent of a telematics box in your car which tells the insurance company how well you're driving."

But if firms see cyber insurance merely as an excuse to skimp on their cyber-security defences, they could find themselves in trouble, he warns. "Businesses must understand that cyber insurance is not a silver bullet, you don't get car insurance and drive like a maniac," he says.

BBC:    Image: Nik Youngson

You Might Also Read: 

Cyber Risk Insurance: A View From The Prudential Regulation Authority:

Insurance Will Reduce Cyber Losses:

Cyber Security Insurance:

 

 

« What Is Fog Computing?
World Economic Leaders Fear Increasing Cyber Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BH Consulting

BH Consulting

BH Consulting we are a vendor independent consulting firm providing market leading range of information security services focused on data protection and cybersecurity.

CROW - University of Waikato

CROW - University of Waikato

CROW is the first cyber security lab established in a New Zealand educational institution at the University of Waikato.

DirectDefense

DirectDefense

DirectDefense is an information security services and managed services provider.

CyberGreen Institute

CyberGreen Institute

The CyberGreen Institute is a global non-profit and collaborative organization conducting activities focused on helping to improve the health of the global Cyber Ecosystem.

IoT Defense

IoT Defense

IoT Defense (IOTD) is a cybersecurity and networking company building solutions that enable the protection of networks and the ever-increasing prevalence of IoT devices.

Cyber Threat Alliance

Cyber Threat Alliance

CTA is working to improve cybersecurity of our digital ecosystem by enabling near real-time cyber threat information sharing among companies and organizations in the cybersecurity field.

Cyber Struggle

Cyber Struggle

At Cyber Struggle, our aim is training and certifying the special forces of the cyber world.

Tier1Asset (T1A)

Tier1Asset (T1A)

T1A is Europe’s leading IT refurbisher. We offer certified data erasure using blancco on site and at our facilities, providing environmentally sound disposal of your used equipment.

ITRenew

ITRenew

ITRenew is a leading global IT lifecycle management solutions company, specializing in onsite data center decommissioning and data erasure services.

Authomize

Authomize

Authomize aggregates identities and authorization mechanisms from any applications around your hybrid environment into one unified platform so you can easily and rapidly manage and secure all users.

Tactical Network Systems (TNS)

Tactical Network Systems (TNS)

Tactical Network Solutions helps you discover hidden attack vectors in IoT and connected devices before someone else does.

Quantum Security Solutions (QSec)

Quantum Security Solutions (QSec)

QSec is an innovative information security consultancy based in Ghana. We can provide your organisation with information security products and services that assure against information risk.

GitProtect.io

GitProtect.io

​GitProtect is a fully manageable, professional GitHub and Bitbucket backup and recovery software that protects repositories and metadata from any event of failure.

In-Q-Tel (IQT)

In-Q-Tel (IQT)

IQT is the non-profit strategic investor that accelerates the development and delivery of cutting-edge technologies to U.S. government agencies that keep our nation safe.

Minorities in Cybersecurity (MiC)

Minorities in Cybersecurity (MiC)

MiC was developed out of a unique passion to help fill the gap that exists in the support and development of women and minority leaders in the cybersecurity field.

Technoware Solutions

Technoware Solutions

Technoware Solutions is a global company committed to helping entities navigate the digital waters of modernizing their system processes in an ever changing cybersecurity landscape.