Cyber Insurance Will Reshape Cyber Security

Cyber security is broken as there is virtually no company that isn’t a potential target. From mom-and-pop storefronts to Fortune 500 companies, no business is immune to cyber risk. Even with the best possible cybersecurity posture, there is always a threat of a breach.
 
There are several factors driving the rise in cyber threats. They break down into a few core categories:  more areas of exposure, difficulty in law enforcement and more creative hackers.
 
Increased exposure. There is a lot of code out there, code that can be exploited for cyber-attacks. The sheer volume grows constantly as software companies write more lines of code for each solution. Further, there are more and more software offerings being implemented by all sizes of companies. In short, more software solutions with more lines of code for each. This presents many more opportunities for exploitation. Legacy code presents its own problem, as older code is hard to check adequately.
 
Hackers are hard to identify, harder to catch. Hackers don’t necessarily “phish where they live.” They often prefer to hack across borders, making it difficult to coordinate law enforcement efforts. Sophisticated hackers often work in groups, making traceability and accountability nearly impossible.
 
Hacking innovation. Since cybersecurity technologies adapt to threats after the fact, hackers improve their hacking techniques to be successful. Due to the cycle of hack-solution-new hack, cybersecurity providers primarily react to new attacks; they can’t predict them. Growing hacking opportunities, a lack of accountability and large financial rewards give hackers plenty of incentive to keep innovating their methods while more and more hackers join their ranks.
 
How it Affects the Market
 
There are two outcomes cropping out of this new era of cyber threats that affect businesses.
  • One is the inability of cybersecurity providers to guarantee the effectiveness of a cyber solution, or combination of products, to thwart a breach. 
  • Second, it is impossible to accurately quantify the cost/benefit of a cyber strategy since the likelihood and potential severity of cyber breaches is unknown.
Since the beginning of insurance, the industry has always sought ways to reduce risk, including incentivising clients to take preventative measures. Yet businesses need some form of cyber protection. How, then, can they determine an appropriate cyber budget and allocation plan, given the inherent uncertainties they face?
 
The solution: Cyber Insurance
The insurance industry is best poised to solve the cyber-security problem. There are three reasons: motivation, data and leverage.
 
Motivation. Cyber insurance carriers have the same end goal as the insured: not to get breached. The insured doesn’t want to experience a breach, and the carrier doesn’t want to pay out. The risk exposure for insurers is amplified, as risk understanding is less developed compared to more mature lines of insurance such as life, homeowners and auto.
When cyber-attacks are thwarted, it’s a “win-win” for both parties.
 
Data.Carriers have a lot of it, and they are only going to accumulate more. Large-scale breaches and widespread viruses make headlines, driving businesses of all sizes to demand cyber coverage. As the cyber insurance market grows, carriers will amass more data.
 
More than just volume, insurers are in the unique position of collecting proprietary information not accessible to other companies. Specifically, insurance providers collect four categories of data that can be analyzed for the purpose of minimising cyber threats.
  • Actual losses. Using accumulated claims data, carriers can identify the type and severity of breaches, and associate them with actual losses. Claims reports and breach investigations allow carriers to better understand the root causes of how an attack occurred and how to minimize future similar attacks.
  • Technology solutions and practices. Insurers know what technology products clients use by company and solution. Additionally, an increasing number of carriers are using technical solutions to assess the risk level of their insureds. This allows for deep analysis of which practices and solutions actually minimise losses, which don’t, and in which cases.
  • Company demographics. Cyber carriers know industry, company size, revenue and much more about their client base.
  • Company details. Carriers are in a unique position where they can require an applicant to provide additional qualitative and quantitative data to better understand the insured’s risk, including the type of data they store, their organisational processes and even governance. 
Some examples are number of credit card records housed, assessment of their incidence response plans to the type of regulations they follow. As carriers learn what information best drives ROI, they can adapt their questions to best serve their predictive models. These datasets help develop risk models that can better predict the likelihood of an attack, potential damage and the preventative steps necessary to minimise threats.
 
Leverage
 
Leveraging the above, cyber insurance can reshape cybersecurity. Once insurance carriers can understand and model cyber risk, they can drive adoption of best practices via financial incentives to the insureds. In time, cyber-security vendors will be measured on their ability to minimise cyber breaches, incentivising them to improve their offering. There is nothing new here. Since the beginning of insurance, the industry has always sought ways to reduce risk, including incentivizing clients to take preventative measures.
 
The US' first insurance company, The Philadelphia Contributionship  was founded in 1752 by none other than Benjamin Franklin, offering fire insurance in the city of Philadelphia. Before accepting a potential client, Franklin’s company would send a team of surveyors to inspect the property to assess risk of fire and set rates accordingly. As fire insurance evolved, several drivers helped reduce premiums and lower losses, including industry regulation, improved building standards, the creation of paid fire departments and financial incentives given to the customer based on taking recommended preventive actions. 
 
Take a more recent example: modern homeowners insurance. All other factors being equal, a homeowner who installs an alarm system and smoke detectors will see a lower premium than one who doesn’t.
 
Similarly, if cyber policyholders show they’ve adapted suggested actions, they will not only enjoy a maximised cyber posture but also savings on premiums. These actions will create demand for cyber products that adhere to insurance standards.
 
Cyber insurance carriers, armed with the best understanding and motivations, will spur businesses to take actions that allow for better cyber planning and budgeting, improved ability to withstand attacks, more accurate premiums on policies, and ultimately a stronger cybersecurity ecosystem. Cyber-security may be broken, but cyber insurance can help fix it.
 
Insurance Journal:       Carrier Management
 
You Might Also Read:
 
Effective Cybersecurity Requires Both Cyber Training & Insurance Cover:
 
« British Government Funds Chip Maker To Build Cyber Resilience
The Next Industrial Revolution »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Roka Security

Roka Security

Roka Security is a boutique security firm specializing in full-scale network protection, defending against advanced attacks, and rapid response to security incidents.

Logicalis

Logicalis

Logicalis are a leading provider of global IT solutions and managed services.

CyberArk Software

CyberArk Software

CyberArk is an established leader in privileged access management and offers the most complete set of Identity Security capabilities.

BioCatch

BioCatch

BioCatch uses behavioral biometrics for fraud prevention and detection. Continuous authentication for web and mobile applications to prevent new account fraud.

Unitrends

Unitrends

Unitrends helps IT pros do more with less by providing an all-in-one enterprise backup and continuity solution.

DataArt

DataArt

DataArt is a global technology consultancy that designs, develops and supports unique software solutions. Areas of activity include software security testing.

Women in CyberSecurity (WiCyS)

Women in CyberSecurity (WiCyS)

Women in CyberSecurity (WiCyS) is a non-profit organization dedicated to the recruitment, retention and advancement of women in the cybersecurity field.

Proton Data Security

Proton Data Security

Proton Data Security is a certified small business specializing in the design, manufacturing and sales of data security products for permanent erasure of hard drives, tapes and optical media.

Strike Graph

Strike Graph

The Strike Graph GRC platform enables Security Audits & Certifications.

Glocomp Systems

Glocomp Systems

Glocomp Systems is one of Malaysia’s premier ICT infrastructure distributor offering a comprehensive portfolio of solutions including cybersecurity and privacy.

DoQubiz Technology

DoQubiz Technology

DoQubiz is using the idea of security through obscurity to develop their proprietary Fractal Security Engine that implements a highly resilient data protection protocol.

IONOS

IONOS

IONOS is a leading provider of cloud infrastructure, cloud services, and hosting with more than 8.5 million customers contracts.

U2opia Technology

U2opia Technology

U2opia is a consortium with a proven track record of delivering groundbreaking technology, cybersecurity, and innovative business solutions.

Highen Fintech

Highen Fintech

Highen is a blockchain software development company with offices in the United States and development centers in India.

We Hack Purple

We Hack Purple

We Hack Purple is a Canadian company dedicated to helping anyone and everyone create secure software.

Security Risk Advisors (SRA)

Security Risk Advisors (SRA)

Security Risk Advisors deliver cybersecurity services to leading companies in the Financial Services, Healthcare, Pharmaceuticals, Technology and Retail industries.