SHARIF GARDNER at The SANS Institute outlines how organisations need to evaluate the benefits of cyber-insurance.

Recent years have been among the most turbulent and prolific periods in cyber-attack history. Cyber-criminals are using creativity and levelling up with attacks that are more audacious and devastating for businesses. In 2020, the rudest of awakenings came with the stratospheric rise of big game ransomware hunting, leading to widespread pay-outs ranging anywhere between £1M-£40M(US$1.245.930.00-US$49,816.280.00million) on the ransom demands alone.

Staggering losses of this scale have not only fuelled business interruption, but they’ve also unsettled everybody from businesses to investors and regulators, and in turn, created big questions around the pathway forward. It’s against this backdrop that the noise around cyber-insurance has ramped up, creating a lot of difficult business conversations and decision-making at a time when uncertainty and cost pressures keep mounting.

Cost is undoubtedly businesses’ number one challenge, but cyber-crime is on an upward trajectory that, other than climate change and extreme weather events, is the most prevalent concern for global economies. Can businesses really afford to go without it altogether?

As the threats surge, transferring risks to an insurer seems like a no-brainer, but in the UK – despite the steady growth – the market remains relatively small and policy adoption lags behind leaders like the US. And with at least a third of UK businesses experiencing an attack every single week, it’s a troubling state of play that’s raising urgent questions about how sufficiently prepared UK businesses are to defend against – and recover from – cyber-security attacks.

So what are the barriers to purchase for UK firms and how can we tackle them to make the case for products that tangibly drive down the risks?

Gamechangers: understanding the intangible

In the world of insurance, customer decisions on coverage are seen as choices in the conditions of risk and uncertainty and ultimately in weighing up the probability of future risk. In the non-life asset space, insurance has predominately been the business of insuring and managing tangible asset risks, but the rise of the intangible – for example, software built on CX – has created tech giants with market capitalisations that are towering over the tangible. It’s been a game changer that creates a whole new dimension of difficulty in decision-making.

The reality is that the world today is built on software and tech hardware and the future can only mean that tech becomes further enmeshed in our day-to-day lives. Every developer that writes code and builds software is a human being, and quite simply, human beings make mistakes – even if the rise of ChatGPT and other AI improves their ability to do this.

Tech infrastructure is also inherently built with complex risks so if you combine those challenges with an emboldened adversary and surging threat of cyber-crime, there forms a rather perfect cloud of difficulty which leaves businesses uneasy.

The uncertainty issue: fines and penalties

Big firms want absolute certainty when it comes to their insurance policies, but that isn’t always easy to come by. Businesses are now holding eyewatering volumes of customer data, creating huge obligations to secure it and build strong cyber-workforce cultures to keep customer trust and avoid the sting of a penalty that is difficult to quantify upfront.

Cyber-insurance might seem like an obvious safety net here, but for UK businesses, the fear of coverage limits and exclusions introduces uncertainty as to whether aspects like GDPR fines are insurable by law.

In Europe, cyber-insurance providers tend to only pay out on aspects like fines and penalties where insurable by law. Conversely, in the US, where we’ve seen cyber-insurance adoption soar, there appears to be greater confidence and peace of mind that insurers will pay out on penalties for data protection breaches and violations, including HIPAA and PCI DSS.

It’s a challenge that we haven’t yet overcome in the UK that’s having a real knock-on impact on business confidence in cyber-insurance to reduce their risk in a world of ongoing digitalisation and infinite data.

The uncertainty issue: lack of clarity in a young market

The fact remains that businesses expect absolute protection from the associated fallout costs of cyber-attacks on everything from their IT infrastructure to their governance – costs which aren’t usually covered by standard business insurance policies.

But, sadly, some recent market developments have done little more than fuel business anxiety that insurance exemptions will leave them high and dry with holes in coverage.

Lloyd’s of London’s 2022 announcement that its policies will no longer cover losses resulting from certain nation-state cyber-attacks – at a time when insurers lost high profile cases defending against such attacks – threw open ambiguity. Critics pointed to the difficulty in determining if an attack is indeed state backed, prompting fears of huge litigation challenges.

It’s major developments like these are factoring heavily into decision making when it comes to cyber-protection – especially amongst the UK’s largest companies. However, despite all the uncertainty cyber-insurance –although still in its infancy as a product- is due to become the largest class of business underwritten out of Lloyd’s which only points to its significance.

Cost vs value

Questions keep abounding about whether to put hard-earned risk management budget into cyber-protection or cyber-insurance. And in a world where state-sponsored attacks are now the norm, there’s a real risk of businesses dismissing the value altogether and taking the burden onto the balance sheet themselves.

There are many difficulties here to resolve and conversations will undoubtedly keep bubbling up that will evolve the industry, but for the time being, there’s a huge onus on insurers to bring clarity to the matter and help businesses to understand the true value of policies in practical terms – of which there is considerable value.

Cost remains a particularly sore subject for businesses now as they battle a myriad of seemingly infinite spending priorities. In this tough market, questions on affordability have arisen, with premiums rocketing as insurers seek to manage their own exposure against systemic risk and what was a particularly prolific period of ransomware. High premium costs are fuelling hesitation about investing and renewing.

But there is a good reason for optimism, as the nature of the ‘hard market’ – known for its upswing in the insurance cycle, when premiums increase and coverage restricts – is beginning to wane which means premiums can stabilise, coverage expands and the power shifts more towards the consumer.

This turning point has begun – in part as a result of big companies voting with their feet – and now prices are stabilising, and in some areas dropping. This, in turn, could do much to reset business focus on the value of cyber-insurance and boost accessibility for businesses of all sizes. In other words, it’s a good time for businesses to speak with their broker.

Asserting value

It’s a new and complex area but it’s key to assert the value of cyber-insurance. It’s worth remembering that once insurers have underwritten a risk, the claims team exists for the purpose of paying claims, and -as always- in insurance, the fortunes of the many pay for the misfortunes of the few. It’s simply how the model works.

Businesses also need to keep the bigger picture front of mind when it comes to exclusions. Big ticket items like perceived coverage holes make it easy to remember exclusions and forget all the value of insurance: the incident response services and associated costs; businesses interruption cover; legal costs; supply chain failure. All of this is covered and will be paid out.

This is how cyber-insurance works and these aspects are critical and can’t be discounted when making an informed decision on overall value.

• Gardner is Director at The SANS Institute.