Insurers Are Getting Smarter About Cyber Insurance

Examples of Cyber Insurance Coverage - What does your cyber insurance cover?

2016 shaping up to be a year of greater maturity in how insurance companies underwrite their cyber insurance policies.

Cybersecurity experts expect 2016 to be the year that insurance companies gain a greater level of maturity with how they underwrite cyber-insurance customers and assess them throughout the life of a policy. 

As that happens, customers could experience some pain as insurance companies get wise to the red flags of poor information security practices. But overall, this maturation could mean good things for cyber-insurance customers and the infosec world as a whole.

The most recent example of this maturation came last week two of the biggest global companies with a history in traditional disaster modeling and risk assessment for the insurance industry at large, RMS and AIR Worldwide, announced they'll be moving into the cyber risk management market next month. Together with the Center for Risk Studies at Cambridge University, RMS and AIR worked with eight large insurers and reinsurers, including Lloyd's of London, to publish a Cyber Exposure Data Schema meant to create open standards for how the industry shares data about cyber risk, estimates losses, and to establish common language and categories that cut across the industry.

This move by more traditional players in the insurance market has been precipitated by a number of those in the cybersecurity space who have already started offering up products for insurers looking for better ways to assess and quantify their insureds' cyber risk posture. These services will continue to keep cropping up in spades as the insurance industry tries to balance the increasing demand for cyber insurance with the challenges of underwriting in a dynamic field new to most insurers.

According to PWC, the cyber insurance market is set to triple in the next few years and will reach $7.5 billion by 2020. Its industry watchers have already warned insurers that they've got to get smarter about how they assess risks and write their policies to fulfill this demand.

"If insurers continue to simply rely on tight blanket policy restrictions and conservative pricing strategies to cushion the uncertainty, they are at serious risk of missing this rare market opportunity to secure high margins in a soft market," says Paul Delbridge, insurance partner with PwC. "If the industry takes too long to innovate, there is a real risk that a disruptor will move in and corner the market with aggressive pricing and more favorable terms.”

As things stand, the methods of the third-parties and insurance companies currently quantifying cyber-risk are "all over the map," says Mark Weatherford, chief security strategist for vArmour and the former deputy under secretary of cybersecurity  for the DHS. Some consultants do it through an interview-based process and others through internal scanning, and still others like Risk Based Security and BitSight Technologies use externally visible network behavior to pinpoint companies exhibiting risky symptoms.

It'll likely be a long time, if ever, that the industry will decide on one set method. But this new open standard is a harbinger for a higher degree of rigor and scholarship that insurance companies will bring to bear as cyber insurance moves out of its Wild West days of shooting policies from the hip. As that happens, says Weatherford, there's going to be a period of adjustment for the information security community.

The more the insurance companies gain experience and tools in assessing the true risk posture of clients, the more likely policies will grow expensive for risky clients and claims will be rejected for those who fail to meet policy requirements. That may be an uncomfortable situation during this transition, but there are a lot of benefits in the long run, Weatherford says.
First of all, many insurers who have stayed out of the cyber insurance market due to their inability to accurately underwrite are going to be able to offer more policies to a wider range of firms. And secondly, added pressure from insurers is going to spur many organizations into getting their infosec acts together, Weatherford predicts. 

As companies are assessed before policies are written, the process may uncover issues they may have been unaware of and could spark management to invest in necessary security changes in order to meet minimum policy requirements.

Weatherford predicts that the insurance market will likely move toward a more dynamic, real-time means of keeping tabs on insureds' risk postures--similar to how Progressive adjusts its policies using a data dongle in its customers' cars to monitor driving habits.

"That's a wonderful thing for us in the security because, because now it's going to force companies to say 'If we want affordable cyber insurance, we're going have to invest in security, and we're going to have to be prepared to act fairly quickly when an event like Heartbleed happens," he says.
Dark Reading: http://ubm.io/1SNllWc

« As the Snowden Leaks Began… There Was "fear and panic" in The US Government. There Still Is.
US Spies Want A Laser Gun Bomb Detector »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Security Industry Association (SIA)

Security Industry Association (SIA)

The SIA's mission is to be a catalyst for success​ within the global security industry through information, insight and influence.

Authenware

Authenware

AuthenWare delivers the highest level of identity security based on behavioral biometrics.

Fastpath Solutions

Fastpath Solutions

Fastpath deliver software solutions that enable you to take control of your security, compliance and risk management initiatives.

TechVets

TechVets

TechVets is a non-for-profit helping UK veterans and service leavers retrain into Cyber Security and Technology jobs.

DCX Technology

DCX Technology

Recognized as a leader in security services, DXC Technology help clients prevent potential attack pathways, reduce cyber risk and improve threat detection and incident response.

BetaDen

BetaDen

BetaDen provides a revolutionary platform for businesses to develop next-generation technology, such as the internet of things and industry 4.0.

Scout Ventures

Scout Ventures

Scout Ventures is an early stage venture capital firm that is making the world a better, safer place by cultivating standout frontier technologies.

Software Diversified Services (SDS)

Software Diversified Services (SDS)

SDS provides the highest quality mainframe software and award-winning, expert service with an emphasis on security, encryption, monitoring, and data compression.

Conference on Applied Machine Learning in Information Security (CAMLIS)

Conference on Applied Machine Learning in Information Security (CAMLIS)

CAMLIS is a venue for discussing applied research on machine learning, deep learning and data science in information security.

Cyber Ireland

Cyber Ireland

Cyber Ireland brings together Industry, Academia and Government to represent the needs of the Cyber Security Ecosystem in Ireland.

FourthRev

FourthRev

FourthRev is an education-technology start-up with a mission to solve the skills crisis of the Fourth Industrial Revolution.

TriCIS

TriCIS

TriCIS design and engineer highly secure integrated solutions that meet the highest government and military security standards, providing information assurance to organisations across the globe.

Institute for Applied Network Security (IANS)

Institute for Applied Network Security (IANS)

For the security practitioner caught between rapidly evolving threats and demanding executives, IANS Research is a clear-headed resource for decision making and articulating risk.

Robust Intelligence

Robust Intelligence

Robust Intelligence enables enterprises to secure their AI transformation with an automated solution to protect against security and safety threats.

Merkle Science

Merkle Science

Merkle Science provides next generation risk mitigation, compliance and forensics for crypto-native businesses, DeFi participants, financial institutions & government agencies.

Amiosec

Amiosec

Amiosec is a British cyber innovation business specialising in delivering simple-to-use solutions to the complex problems of the modern world.