Cyber Insurance: 7 Questions To Ask

Cyber insurance is a growing field putting business and security leaders to the test as they navigate the often tricky process of researching and purchasing policies. Technology is quickly changing, and so is risk.

Insurance for cyber-security is different from other types of insurance because the nature of threats is constantly changing. A hurricane doesn't change intensity because a building code changes, but cyber-criminals will change their strategies as technology and risk evolve.

"New trends like BYOD, and IoT make tech strategy change all the time," says Portnox CEO Ofer Amitai. "It's really a problem for businesses to assess their policies and terms. Technology is so dynamic. It's difficult to say what's going on; what's their risk." 

These changes make it harder for underwriters and companies to stay abreast of the landscape. During the tricky process of buying cyber insurance, you'll ask and answer questions about your company, security posture, and other factors to determine which policy is best for you, and how much coverage you should buy. 

It's worth noting the research process is changing for businesses as the marketplace gets more competitive, notes David Bradford, chief strategy officer and director of strategic partner development at Advisen. Because insurers are fighting to underwrite the same businesses, they're making the purchasing process less burdensome for clients.

That said, insurance remains a tricky field to navigate, especially for companies new to it.

1.What am I afraid of ?

A key step in buying cyber insurance is figuring out what to protect, Amitai explains. This goes beyond the common concerns around customer and employee data to include things like brand reputation.

If a data breach hits, your business will need to worry about more than IT damage. The cost of public relations expertise, to recover a brand name following an attack, may not be covered under a cyber insurance policy.

 2.Cyber insurance is data breach insurance, right?

Oftentimes companies perceive cyber insurance as data breach insurance but it is important to understand breaches make up one portion of cyber insurance coverage. 

Policies also cover the cost of forensics, legal fees, business interruption, and a whole variety of expenses incurred related to a cyber incident.

3.Where do my Exposures lie?

Many companies struggle to purchase insurance because they don't know where their weaknesses are. Risk assessments help them identify their exposures, where their greatest vulnerabilities lie, and which assets are most vulnerable. Where does sensitive data reside? For multi-national firms, how large and varied is your attack surface? Are you protected in all the areas where sensitive data is stored?

Because cyber insurance is a fairly new field, companies often neglect to do this. Quantifying risk is a critical step in determining how much insurance coverage to buy.

4.What is the potential damage?

Once you determine your most critical assets and where your vulnerabilities lie, it's important to gauge the likelihood and potential cost of an attack. Which scenarios do you care about? 

How much will it cost if your most valuable information is exposed to cyber-crime? This number is likely to change as businesses adopt new technologies like cloud, mobile, and IoT, all of which will increase the attack surface and potential cost of a breach.

Cyber insurance isn't a replacement for strong security measures, and businesses should continue to change their strategies to acknowledge the risk these products will bring.

Insurance is something you want to have in place, but it's not a replacement for best practices. It ensures a loss and you won't have to close the business if you get a major breach.

5.How does the size of my business affect my insurance policy?

Small companies undergo a simple insurance application process. They may answer four to five questions that don't require investigation; for example: Do you have a firewall? Do you encrypt at-risk data? Inquiries won’t go much deeper than that, and smaller businesses will be given a fixed price for their risk.

The process gets more complicated for mid-size organisations, which typically answer a questionnaire about the security controls they have in place. They will provide information about firewalls and other data protection policies, data access and recovery, outsourcing, and compliance.

Larger businesses have to do the most work in developing information for underwriters. Insurers typically require an audit of most big organisations. Underwriters have to speak with CISO, CIO, and IT teams, making the process burden-some and complex.

6.Where are there gaps in my policy?

Given the range of cyber insurance policies, businesses need to put in their due diligence to determine which one is right for them. 

One of the biggest problems with cyber insurance is organisations don't have a firm grasp of what is and isn't covered. Many make the mistake of not buying the correct amount of the insurance that best suits their needs.

Different types of businesses face different threats. Misunderstanding your policy can lead to some unfortunate outcomes. What happens if a hacker breaks into a medical device and causes physical harm? Is bodily injury covered under your insurance policy? It's understandable to think so, but this isn't included in many plans.

Manufacturers, another example, are exposed to property damage. If someone hacks into their control system and wreaks havoc in production, the business may expect their cyber-insurance policy will cover it. Many of them don't.

7. How can I make sure I'm doing this right?

Experts recommend consulting a broker when things get difficult, but to choose with caution. There are some excellent brokers in the field, but many are so new they don't have enough experience to effectively advise clients.

Work with a broker who has domain expertise in cyber insurance. This is important because cyber insurance policies vary from carrier to carrier. Auto policies, for example, are generally similar. Cyber varies in language and policies.

Most major brokerage operators have on-staff experts who know enough to work with large businesses purchasing cyber insurance policies. Small companies buying via local agents or brokers, in contrast, may find those don't have the level of expertise they need.

Contact Cyber Security Intelligence for more Information
www.cybersecurityintelligence.com

 

« WikiLeaks Will Share CIA's Hacking Secrets
DeepMind Uses Blockchain To Track Health Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

UpGuard

UpGuard

UpGuard's discovery engine brings visibility to complex IT environments, enabling teams to identify risk, confirm compliance and make business safer.

Maryville Online - Cybersecurity Program

Maryville Online - Cybersecurity Program

The Cybersecurity Program at Maryville Online is designed to help students reach opportunities in cybersecurity leadership and management through an entirely online curriculum.

CYBER 1

CYBER 1

CYBER 1 provides cyber security solutions to customers wanting to be resilient against new and existing threats.

MerlinCryption

MerlinCryption

MerlinCryption develops infrastructure security software, delivering advanced encryption, authentication, and random data generators, for Cloud, VoIP, eCommerce, M2M, and USB hardware.

KeepSolid

KeepSolid

KeepSolid is a Virtual Private Network services provider offering secure encrypted access to the internet.

Red Snapper Recruitment

Red Snapper Recruitment

Red Snapper Recruitment is a market leading staffing services provider to the law enforcement, cyber security, offender supervision and regulatory services markets.

IFE Digital Systems

IFE Digital Systems

IFE Digital Systems conducts research, development and consultancy in risk, safety and security related to digital systems in critical infrastructure.

QuillAudits

QuillAudits

QuillAudits offers advanced Ethereum, EOS, TRON smart contract audit, blockchain protocol security and formal verification to ensure your platform’s integrity.

Trusted CI

Trusted CI

Trusted CI, the NSF Cybersecurity Center of Excellence is comprised of cybersecurity experts who have spent decades working with science and engineering communities.

Griffeshield

Griffeshield

Griffeshield is a company specialised in new information technologies used to protect Intellectual Property.

Human Security

Human Security

Human (formerly White Ops) Bot Mitigation Platform enables complete protection from sophisticated bot attacks across advertising, marketing and cybersecurity.

NetNordic Group

NetNordic Group

NetNordic is a Nordic system integrator focusing on solutions and services in the area of networking, smart data centers, cybersecurity, and unified communication.

AppOmni

AppOmni

AppOmni is the only SaaS CSPM solution that gives teams all the tools they need to be successful – from security posture management to monitoring and detection to continuous compliance.

Apptega

Apptega

Apptega is an award-Winning Cybersecurity and Compliance Platform. Our mission is to make cybersecurity and compliance easy for everyone.

Rebellion Defense

Rebellion Defense

Rebellion Defense is a technology company developing advanced software to ensure mission-critical organizations stay ahead of emerging threats.

SOCRadar

SOCRadar

SOCRadar is an Extended Threat Intelligence (XTI) SaaS platform that combines External Attack Surface Management (EASM), Digital Risk Protection Services (DRPS), and Cyber Threat Intelligence (CTI).