Cybersecurity Insurance

Cybersecurity insurance protects businesses from liabilities caused by a cyber-attack. Cybersecurity insurance company charges a monthly or quarterly fee from the company. The insurance policy covers financial losses, data recovery costs, and identity theft damages. In addition, it outlines a company's responsibility for a data breach involving private customer data.

Cybersecurity insurance does not cover third-party data loss. Businesses collect massive amounts of data—client lists, customer information, supplier details, quotations, and confidential information. If a business is attacked, customers lose their privacy. In such a scenario, customers lose trust, and the business could face severe consequences, including bankruptcy.

• Cybersecurity insurance is a contract in which the insurance provider covers financial losses caused by cyber-attack, data privacy, and identity thefts.
• The demand for cyber insurance is growing at a brisk pace. By 2027, cyber insurance is expected to reach $28.25 billion.
• Cyber insurance also covers top-level managers under leadership liability. The insurance company covers the fines if a top-level manager is a victim of a cybersecurity event and gets sued.
• The cost of cyber insurance witnessed multiple revisions. In 2019, cyber insurance cost around $1500 per annum for coverage of $1 million.

Cybersecurity insurance is a contract; businesses insure themselves from cyberattacks, security breaches, and loss of privacy. As a result, contemporarily, cyber insurance is becoming indispensable not only for multinational organizations but also for small businesses.

Cybersecurity has been a concern for two decades now. Businesses realized hacking could cause financial losses; they could become victims of cyber extortion and data loss. Cybersecurity safeguards computer systems, communication networks, and sensitive information from digital attacks.

Threats could be internal or external. Due to rapid technological innovation, hackers keep improvising; they develop new attacks daily. Cybersecurity has to keep up with the changes, and that is challenging.

Businesses collect massive amounts of data—client lists, customer information, supplier details, quotations, and confidential information. Cyber insurance was introduced because businesses consider data as important as employees.

The cyber insurance industry is growing briskly—worth $9.29 billion in 2021. Cyber insurance is no longer an option. Cyber insurance is strongly recommended for every business—even small businesses. If a firm is attacked, the attacker can also access customer details. In such a scenario, customers will lose trust, and the business risks insolvency.

Cybersecurity insurance requirements are as follows.

• All office computers must have antivirus software. The software should be updated frequently.
• The company's network must be protected using a firewall.
• The firm must create a data backup regularly (preferably daily). The backups should be stored in a cloud server.
• The username and passwords given to employees must follow a secure process, especially for approving rights and permissions.
• The admin account and other important accounts should be protected using multi-factor authentication.

If the minimum prerequisites are met, the insurance company performs a detailed analysis and suggests suitable packages.

Cyber insurance costs have been revised multiple times in the last few years. For example, in 2019, insurance cost around $1500 per annum for coverage of $1 million.

Cyber insurance costs depend on the following factors:

• Industry type
• Company size
• Amount of data
• Annual revenue
• Level of coverage
• Deductible

The business location also plays an important role. For example, within the US, cyber insurance pricing varies from state to state. In Georgia, it costs around $1450, whereas in New York, it costs around $1,616.

Now, let us discuss cybersecurity insurance coverage. Cyber insurance covers the following elements:

#1 - Ransomware

This component applies to scenarios where a company becomes a victim of cyber extortion. Usually, hackers use malware and prevent employees from accessing data and system options. In such instances, the insurance company compensates for the damages (depending on the predetermined terms). However, the Federal Bureau Of Investigation recommends not paying the ransom—there is no guarantee that the hacker will keep their word.

#2 - Social Engineering Attacks

In this attack, hackers trick users into transferring funds (wire transfer) to an anonymous bank account. Usually, these attacks involve fraudulent emails. Hackers target large corporations.

#3 - Loss of Business And Forensic Investigation

When third-party vendors or partners target businesses, they have to spend on forensic investigation. The insurance provider bears both investigation costs and damages.

#4 - Damaged Reputation

Every business relies on customer data. Customers trust brands with their credentials. In the case of a data breach, the brand’s reputation gets tarnished. The risk is directly proportional to brand awareness—the larger the firm, the bigger the risk. In such scenarios, cyber insurance covers damages caused by the loss of reputation. But quantifying reputation loss in absolutes is tricky.

#5 - Corporate Identity Theft

This attack involves impersonation; the hacker creates a fake website or social media page using the name of a recognized brand. Hackers use such fake identities for tax accounts and other fraudulent exploitation.

#6 - Leadership Liability

Cyber insurance also covers top-level managers under leadership liability. This occurs when a top-level manager is a victim of a cybersecurity event.

For example, a hacker or third party uses the manager’s credentials to siphon funds or commit an infraction. Whether the manager was an accomplice or a victim, they are liable for the damages either way. But the insurance company covers the manager’s liability.

Now, let us look at cybersecurity insurance examples.

Example #1

Monica launched a dating app in Canada. She marketed the new platform aggressively. She spent a significant amount on a promotional mix.

Gradually, the site gained brand awareness. Users started downloading the app; every user created a new account. A user could create a new account for free, but the site required many personal details. The platform’s algorithm matched profiles based on similar interests and sent user recommendations.

Monica knew the importance of data security. She bought a policy from cybersecurity insurance Canada. Despite all the precautions, Monica’s app got attacked. The hacker took control of all the data and started selling the algorithm to interested parties. She alerted the authorities immediately. The insurance provider covered all the damages.

Example #2

In 2011, Sony's PlayStation Network was hacked. Seventy-seven million users risked a data breach—their PlayStation account credentials were possibly leaked. Sony encountered a loss of  $170 million. Sony’s insurance policy covered only a part of the damages. Sony’s insurance coverage was limited. Sony applied for cyber security insurance, but signatures were pending (for several documents). The court declared that Sony's insurance policy included damage to physical property only. Therefore, Sony had to incur the full cost of the cyber-attack.

• The insurance covers physical and digital assets. It limits a firm’s liability in case of intrusion or hacking.
• It protects companies from data breaches and covers social engineering attacks.
• In extortion, the insurance covers the cost of forensic and legal support. Some policies even cover the ransom paid to the hacker.

This article has been a guide to what is Cybersecurity Insurance. Here, we explain it in detail with its coverage, requirements, cost, examples, and benefits. You can learn more about it from the following articles -

• Third-Party Insurance
• Microinsurance
• Professional Liability Insurance