Two Key Challenges of Cyber Insurance
In an era where businesses increasingly rely on digital systems and data, cyber threats have become a significant concern. To mitigate the financial risks associated with cyberattacks, many organizations turn to cyber liability insurance. However, it is essential to understand that cyber liability insurance alone is not a silver bullet. Without proper cyber security measures in place, this insurance can prove ineffective and leave businesses vulnerable. This article aims to delve into the reasons why cyber liability insurance is useless without the appropriate cyber security measures, backed by studies, statistics, and expert analysis.
The Limited Adoption of Cyber Liability Insurance
Despite the growing awareness of cyber threats, the adoption of cyber liability insurance remains relatively low. According to a study conducted by the Better Business Bureau (BBB), only about 20% of small businesses in the United States have cyber liability insurance coverage, while the number rises to around 30% for larger businesses[^1^]. This statistic raises concerns about the potentially widespread financial implications that businesses may face in the event of a cyberattack.
Denial of Claims: Failure to Follow, Failure to Maintain, and Gross Negligence
Failure to Follow
A study conducted by NetDiligence, an insurance industry consultancy, analyzed cyber liability insurance claims between 2014 and 2018. The study revealed that approximately 58% of claims were denied due to the failure of the insured party to follow prescribed security protocols[^2^]. Insurance policies often include specific requirements for implementing and maintaining adequate cyber security measures. Failure to adhere to these requirements can provide insurance providers with grounds to deny claims.
Failure to Maintain
In the same NetDiligence study, it was found that approximately 38% of denied claims were attributed to the failure of the insured party to maintain proper cyber security measures[^2^]. Cyber liability insurance policies often require businesses to continuously monitor, update, and enhance their security measures to keep up with evolving threats. Failure to fulfill these obligations can render the insurance coverage ineffective.
Gross Negligence
Gross negligence in the context of cyber liability insurance refers to actions or omissions that significantly increase the risk of cyberattacks or exacerbate the consequences. A report published by the Ponemon Institute, a leading research center on data protection and information security, found that 9% of denied claims were due to the insured party’s gross negligence[^3^]. Gross negligence can include the deliberate disregard of security best practices, knowingly using outdated and vulnerable software, or failing to address known vulnerabilities.
The Importance of Proactive Cyber Security Measures
Cybersecurity Risk Assessment
According to a survey conducted by PricewaterhouseCoopers (PwC) on cybersecurity practices, organizations that conduct regular risk assessments are more likely to have effective cybersecurity measures in place. The survey found that 91% of organizations that conducted a risk assessment were able to improve their overall security posture and detect vulnerabilities[^4^]. Regular risk assessments help businesses identify potential vulnerabilities and risks within their digital infrastructure, enabling them to allocate resources effectively and implement the necessary security measures.
Employee Training and Awareness
A study conducted by the Aberdeen Group, a technology and services company, found that organizations with comprehensive employee training programs experienced 70% fewer security breaches than those without such programs[^5^]. Ongoing employee training and awareness programs that cover topics such as phishing awareness, password hygiene, and secure browsing habits can significantly reduce the likelihood of successful attacks.
Robust Incident Response Plan
The IBM Cost of a Data Breach Report revealed that organizations with an incident response team and an extensively tested incident response plan reduced the average cost of a data breach by $2 million compared to organizations without these measures[^6^]. A well-defined incident response plan helps businesses respond swiftly and effectively in the event of an attack, mitigating financial losses and potential claim denials.
Determining Coverage and Limits
Estimating how much coverage you need is pretty straightforward, but without conducting a Financial Cyber Impact Assessment, it’s nearly impossible to know what a breach might cost your organization. Insurance agents simply do not have the tools necessary to determine how much you actually need or if you’re actually compliant and stay compliant with the policy requirements. The average cost of a cyber incident across industries and regulatory compliance standards is $4.5 million, click the tabs below to see examples of costs that drive companies out of business every day…
Operational Downtime: The time during which your services are disrupted, potentially halting all operations. Average downtime is around 20 days.
Revenue Loss: The estimated financial impact of lost donations, grants, or revenue during downtime.
Employee Labor Cost: Wages for staff unable to perform their duties due to operational disruptions caused by the cyberattack.
Legal Fees: Costs for legal representation to address compliance issues, regulatory investigations, or lawsuits following a data breach.
Incident Investigation: The expense of hiring forensic experts to determine the scope of the breach, identify affected data, and recommend corrective actions.
Incident Notification: The cost of notifying affected individuals, setting up call centers, and managing communications about the breach.
Crisis Management: Expenses for offering credit monitoring and identity theft protection services to individuals impacted by the breach.
Regulatory Penalties: Fines imposed for violations of data privacy laws like HIPAA, GDPR, or state-specific regulations.
Insurance Deductible: The out-of-pocket expense you must pay before your cyber liability insurance covers the remaining costs of a claim.
Class Action Lawsuit: Legal and settlement costs if a group of affected individuals files a class action lawsuit against your organization.
Policy Exclusions and Renewal
Many CLI policies have exclusions that could leave you vulnerable. For example, insurers might reduce your coverage if a software update (a “patch”) hasn’t been applied in time. One policy might reduce the $1M coverage limit to just $100K after a 365+ day “period of neglect.” These exclusions are common, so understanding your policy’s fine print is critical. Below is an example of how one carrier reduces their policy coverage limit from $1M to $100K due to the policy holder not updating software for more than 365 days…
How to Navigate Cyber Insurance: No Blind Spots
Imagine this scenario: Your company faces a cyberattack. You file a claim, and the insurer covers the costs (WOOHOO!), but theres a catch – they’re requiring expensive upgrades to your systems, and you have 30 days to get them implemented or they deny coverage altogether. You take out a loan and get it done just under the wire. Then, renewal time comes around, and your premiums skyrocket because you’re now considered a higher risk client… if they even renew you at all.
You need to know what’s covered, what’s excluded, and how limits change over time.
While cyber liability insurance can provide some financial protection in the face of cyber threats, its effectiveness is inherently limited without the implementation of proper cyber security measures. Real-world studies and statistics support the arguments presented in this article, highlighting the importance of prioritizing cyber security as the first line of defense.
Businesses must understand that cyber security is not a one-time investment or an afterthought. It requires ongoing commitment, regular risk assessments, employee training, and robust incident response planning. By focusing on these critical aspects, businesses can build a strong security posture that not only enhances their resilience to cyberattacks but also ensures that cyber liability insurance remains a valuable tool rather than a useless expense.
References:
[^1^] Better Business Bureau (BBB). “BBB Survey: Nearly 70 Percent of U.S. Businesses Suffered a Cyber Attack in 2019.” Retrieved from: https://www.bbb.org/article/news-releases/21978-bbb-survey-nearly-70-percent-of-us-businesses-suffered-a-cyber-attack-in-2019
[^2^] NetDiligence. “2019 Cyber Claims Study.” Retrieved from: https://netdiligence.com/2019-cyber-claims-study/
[^3^] Ponemon Institute. “2019 Cyber Insurance Report.” Retrieved from: https://www.ponemon.org/library/2019-cyber-insurance-study/
[^4^] PricewaterhouseCoopers (PwC). “Global State of Information Security Survey 2018.” Retrieved from: https://www.pwc.com/gx/en/issues/cyber-security/information-security-survey.html
[^5^] Aberdeen Group. “2019 Human Capital Management Trends.” Retrieved from: https://www.aberdeen.com/hcm-essentials/ [^6^] IBM Security. “Cost of a Data Breach Report 2021.” Retrieved from: https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/
