Half Of US Firms Do Not Buy Cyber Insurance

A full 50 percent of US firms do not have cyber risk insurance and 27 percent of US executives say their firms have no plans to take out cyber insurance, even though 61 percent of them expect cyber breaches to increase in the next year.

Even among those that have insurance, only 16 percent said they have cyber-security insurance that covers all risks.

The US lags behind the UK and Canada, where about 40 percent have no cyber coverage. Mistrust about insurance pricing is one reason some firms aren’t buying.

These findings come from a survey conducted by research firm Ovum for Silicon Valley analytics firm FICO. The researchers conducted telephone interviews with 350 c-suite executives and senior security officers from financial services, telecommunications, healthcare, retail, e-commerce and media service providers. The respondents represented various size companies: 30 percent had 500 to 1,000 employees; 28 percent had 1,001 up to 4,999; 17 percent had 5,000 up to 9,999, and 25 percent had more than 10,000.

In the US, the healthcare industry is particularly behind on fully protecting itself with cyber insurance, according to the survey. None of the healthcare firms represented in the survey have insurance that covers all risk, while 74 percent have none at all.

“With so many firms concerned about a rise in the likelihood of cyber breaches in the next year, it’s troubling to see that half of them don’t have any cybersecurity insurance protection,” said Bob Shiflet, who oversees fraud and financial crime solutions at FICO.

“There are steps the insurance industry can take to make guidelines clearer and explain premium adjustments, but companies need to be willing to dedicate the resources required to protect themselves from the breaches they themselves see as likely, if not inevitable.”

The authors identify the cost and lack of clarity about insurance pricing as an obstacle to increased sales. Only 25 percent of survey respondents believe that premiums provide a genuine reflection of the risk profile of their organisation. Only 23 percent believe that the insurance industry is clear and transparent in its approaches to pricing.

US executives identified several ways the risk assessment process that insurers use could be improved. Twenty-nine percent say that insurers should provide clear guidelines about how premiums are chosen, 28 percent would like clearer communications as to why premium adjustments happen and 23 percent would like insurers to introduce an industry standard for benchmarking cyber risk.

Related Reports

Other reports have looked at why some companies are not buying cyber coverage.

A cyber readiness survey released in February by specialist insurer Hiscox suggested that momentum is building behind cyber insurance. In its survey, overall 55 percent of US firms said they had taken out cyber insurance. Hiscox analysts said its higher take-up figures may partly reflect confusion over what exactly constitutes cyber coverage with some companies believing they are protected under their existing policies.

In the Hiscox survey, among the firms that had not bought cyber cover – 26 percent of the survey sample – and do not plan to do so, two in five (41 percent) of them said “a cyber insurance policy is not relevant for me.”

More than one in six (17 percent) of those that have no plans to take out cyber insurance agreed with the statement: “Cyber insurance policies are so complicated, I don’t understand what cyber insurance would cover me for.”

A report published by Deloitte consultants suggested buyers often don’t understand cyber risks or insurance options and also cited a lack of standardization of cyber policies.

“Similar cyber insurance products offered by different providers often include alternative features, which makes it difficult for buyers to compare policies by value and price,” according to the report. Concerned about potential coverage gaps, businesses want to avoid buying coverage they don’t fully understand with language that may be subject to interpretation, the report said.

The Deloitte report recommended steps the industry could take to overcome buying obstacles including standardising policy language, developing a “risk-informed model” rather than a definitive predictive model for cyber risks, employing more targeted underwriting by industry or exposure, and offering more holistic cyber risk management programs.

Not a Big Deal

Yet another report, this one by the nonprofit RAND Corp., hints at another reason not all companies see cyber insurance or further investment in cyber-security as a good investment. The typical cost of a breach is about $200,000 and most cyber events cost companies less than 0.4 percent of their annual revenues, the study found. The $200,000 cost is roughly equivalent to a typical company’s annual information security budget.

“Relative to all the other risks companies face, the cyber risks often aren’t as big a deal as we think,” said Sasha Romanosky, author of the study and a policy researcher at RAND. “It may be bad for you if you are the victim, but it doesn’t change the behavior or strategy of a company. Like you and me, companies are self-interested and operate in ways that minimize their costs. You can’t begrudge them for working that way.”

The RAND study ‘s cost estimate is a lot less than the estimate in a May 2014 report by the Ponemon Institute at the University of Michigan. The Ponemon report put a $3.5 million price tag on an individual data breach. Ponemon surveyed 314 companies in 10 countries. The RAND study, which is published in the Journal of Cybersecurity, is based on a private dataset of 12,000 cyber incidents compiled by Advisen.

For more Information and a free Report please contact: Cyber Security Intelligence.com

Insurance Journal

You Might Also Read:

Insurance: How Cyber Risks Are Evolving:

Are Corporate Cyber Defenses Adequate?:

Advice For Cyber Insurance Buyers:

 

 

« Reinventing Cold War Spy Craft
Find Your Digital Risk »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

British Insurance Brokers’ Association (BIBA)

British Insurance Brokers’ Association (BIBA)

BIBA is the UK’s leading general insurance intermediary organisation. Use the ‘Find Insurance‘ section of the BIBA website to find providers of cyber risk insurance in the UK.

Infiltrate

Infiltrate

INFILTRATE is a deep technical conference that focuses entirely on offensive security issues.

KFSensor

KFSensor

KFSensor is an advanced 'honeypot' intrusion and insider threat detection system for Windows networks.

TrustArc

TrustArc

TrustArc provide privacy compliance and risk management with integrated technology, consulting and TRUSTe certification solutions – addressing all phases of privacy program management.

MASS

MASS

MASS provides world-class capabilities in electronic warfare operational support, cyber security, information management, support to military operations and law enforcement.

Fujitsu

Fujitsu

Fujitsu is the leading Japanese global information and communication technology company, offering a full range of products, solutions and services including Managed IT Services and Cyber Security.

NSHC

NSHC

NSHC is a provider of mobile security solutions, cyber security consulting and training, and offensive research.

Sysdig

Sysdig

With Sysdig teams find and prioritize software vulnerabilities, detect and respond to threats, and manage cloud configurations, permissions and compliance.

Synelixis Solutions

Synelixis Solutions

Synelixis Solutions is a high-tech company founded to provide complete telecommunications, networking, security, control and automation solutions.

Tutamantic

Tutamantic

Tutamantic develops software that reduces security risks and weaknesses during the architectural and design stages.

ANSI National Accreditation Board (ANAB)

ANSI National Accreditation Board (ANAB)

ANAB is the largest accreditation body in North America. The directory of members provides details of organisations offering certification services for cybersecurity related standards.

Pixm

Pixm

Pixm’s computer vision based approach offers a truly unique and effective means to protect organizations from web-based phishing attacks.

11:11 Systems

11:11 Systems

11:11 Systems synchronizes every aspect of network services for your business. Build your network with the industry’s most trusted expert skills.

Wib

Wib

Wib is an API security leader. We are the only company providing a solution for the entire API development lifecycle.

HashiCorp

HashiCorp

At HashiCorp, we believe infrastructure enables innovation, and we are helping organizations to operate that infrastructure in the cloud.

aFFirmFirst

aFFirmFirst

aFFirmFirst is a unique software solution offering a simple yet effective way for businesses to protect and control their online images and logo, as well as allowing one-click website verification.