It’s Time to Invest in Cyber Insurance: Here’s Why

In today’s interconnected world, where digital systems underpin virtually every aspect of business, the threat landscape has expanded exponentially. Cyber incidents and threats have become more sophisticated and continue to evolve, targeting sensitive information and disrupting operations.  

That is where the value of cyber insurance comes in. Cyber insurance has emerged as a crucial safety net for businesses, offering financial protection and priority access to cyber incident response experts in times of crisis. But what exactly is cyber insurance, and why has it become a non-negotiable in the business world we know today? 

In this article we will highlight the vital role that cyber insurance has on enhancing business resilience, what cyber insurance can cover, and why it has become an indispensable tool against cyber threats.  

Understanding Cyber Insurance: The Basics  

Cyber insurance, also known as cyber liability insurance or cybersecurity insurance, are policies designed to help businesses reduce the risks associated with cyber events. These incidents can range from data breaches to malware attacks, causing reputational damage and significant financial, productivity, and intellectual property losses. 

Securing cyber insurance coverage for your businesses is similar to having insurance against physical risks and natural disasters. Cyber insurance protects organisations from the cost of cyber threats affecting vital IT infrastructure, information governance, and information policy – areas that are typically excluded from commercial liability policies and traditional insurance products.  

Cyber insurance is crucial for all companies, but it should not be seen as a substitute for robust cyber risk management practices. Instead, businesses should view cyber insurance as a tool to mitigate potential damages from cyberattacks and other cyber incidents and disruptions. It is essential that an organisation’s cyber insurance policy aligns and enhances the security measures and technologies that are already in place. 

Why Cyber Insurance matters 

No matter the size, any organisation that stores customer information electronically or relies on technology is susceptible to cyber risks. A cyber incident is far more likely to bring a business to its knees than, for example, issues relating to physical assets – many recognise the need to have these insured, but the same urgency often is not applied to cyber insurance. 

Conventional business insurance products such as general liability and errors and omissions policies usually do not provide coverage for businesses’ own losses resulting from cyber incidents. This leaves companies vulnerable to bearing the full financial burden of ransomware attacks, business email compromise scams, and other cybercrimes and events.  

Cyber insurance policies were developed to fill this coverage gap. By covering expenses such as ransom payments and malware remediation, these policies enable businesses to mitigate losses, expedite recovery, and enhance their overall cyber resilience.  

Cybercrime incidents are also occurring more frequently than ever before and continue to transform in sophistication over time. Duncan Morrison, Aon New Zealand’s Cyber Practice Leader, said ransomware events around the globe have increased by more than 1200% since 2019. 

“In 2020, when the Covid-19 pandemic started, a lot of people started working from home at the same time. So, ransomware events became even more prevalent as you had a whole bunch of people working remotely in environments that weren’t overly secure.”

Duncan Morrison, Aon New Zealand’s Cyber Practice Leader

Policies may also cover damages associated with incidents that had no malicious intent. This was demonstrated recently when CrowdStrike’s botched security update caused the largest global IT outage in history. As the cybersecurity company is only obligated to refund businesses the cost of accessing their services, many affected organisations had to rely on cyber insurers for assistance. 

However, investing in cyber insurance is more than just financial protection for businesses. It provides access to specialised cyber incident response teams composed of cybersecurity experts, legal advisors, forensic investigators, and public relations professionals. These teams play a critical role managing and mitigating the impacts of a cyber event from all angles. Cyber insurers have a vested interest in getting your business back up and running quickly while minimising the impact of a cyber event. Their immediate access to incident response experts is an invaluable, and often overlooked, benefit of cyber insurance. 

What does Cyber Insurance cover?  

Cyber insurance coverage is highly customisable, depending on the specific needs of the business, the data it handles, and its industry. Many cyber insurance policies offer coverage for first-party and third-party coverage. First-party coverage commonly covers direct losses incurred by the business itself, such as expenses related to data recovery and system restoration. In contrast, third-party coverage addresses damages suffered by external parties, such as customers affected by data breaches. 

When it comes to specific losses, cyber insurance policies typically cover:  

• Business Interruptions: Compensation for lost revenue when cyberattacks disrupt computer systems 

• Threat Response and Remediation: Funding for incident response, system repairs, forensic investigations, and related services necessary after a cyber event 

• Legal Expenses: Coverage for litigation costs stemming from cyberattacks, such as lawsuits filed by affected customers, and some policies may provide legal representation 

• Data Breach Recovery: Financial support for notifying customers and offering services like credit monitoring when personally identifiable information (PII) or sensitive data such as credit card numbers are compromised 

• Regulatory Actions: Coverage for costs associated with regulatory investigations and audits triggered by cyber incidents, including potential fines 

• Reputation Management: Assistance with expenses related to restoring a company’s brand and reputation after a cyberattack, such as hiring public relations firms 

• Ransom Payments: Support to cover the cost of meeting extortion demands, although some government agencies caution against paying ransoms – doing so can incentivise further cybercriminal activity. 

While cyber insurance policies provide extensive coverage, there are some incidents for which they may not offer compensation, such as: 

• Poor Security Processes: Cyberattacks resulting from inadequate configuration management or missing security protocols which hadn’t been disclosed to the insurer

• Betterment: Proportional costs associated with improving IT security in response to a cyber event.

• Technology System Improvements: Costs associated with enhancing technology systems, such as strengthening applications and networks. 

Cyber Insurance and Managed Service Providers (MSPs) 

Managed Service Providers and experienced IT partners like Virtuoso, and Software as a Service (SaaS) providers, can offer valuable cybersecurity services that complement cyber insurance coverage, including but not limited to: 

• Managed Detection and Response (MDR): Threat detection services, continuous monitoring of networks and endpoints 

• Security Assessments and Audits: Regular IT infrastructure evaluations to identify vulnerabilities, and recommendations for improvements  

• Patch Management: Timely installation of software updates and patches to tackle known vulnerabilities 

• Employee Training and Awareness: Education and training programmes to enhance employee awareness of cybersecurity risks. 

• Backup and Disaster Recovery: Implementation and management of data backup solutions. 

• Device Management: Monitor, manage, and secure devices connected to a corporate network, including virtual machines, physical computers, mobile, and IoT devices. 

• Incident Response: Immediate assistance and/or remediation during minor cyber incidents 

On the other hand, MSPs may not cover:  

• Cyber Insurance Coverage: Financial protection against losses from cyber incidents, business interruption costs and regulatory fines.

• Legal Representation: While MSPs may offer technical support and the implementation of proactive controls, they typically do not provide legal representation for lawsuits or regulatory actions.

• Comprehensive Insurance Policies: MSPs focus on proactive cybersecurity measures and incident response, whereas cyber insurance policies provide broader financial protection and compensation.

• Forensic services and investigative incident response: Cyber incidents may require specialist forensic services that typically fall outside the remit of an MSP engagement. The focus in these scenarios is often to retain and review forensic evidence. Such companies are usually engaged by the insurance company directly.

Cyber Insurance: The Challenges  

Cyber insurance is essential in the fight against cyber threats, but it also presents challenges that businesses must navigate. These can include high premiums, especially for organisations that are perceived as high-risk, and limited coverage due to policy limitations.  

Meeting insurance requirements is another challenge; insurers often deny coverage or raise premiums if businesses have not implemented enough cybersecurity measures, such as multi-factor authentication (MFA), endpoint detection and response (EDR), and end user training and testing. Conducting regular training sessions for end users on potential threats and best practices is imperative – a significant proportion of cyber events can be attributed to human error.  

“We know that of these security breaches and issues, 30-40% of them are due to phishing incidents and human error, and that’s only going to increase further.”

Duncan Morrison, Aon New Zealand’s Cyber Practice Leader

“We know that of these security breaches and issues, 30-40% of them are due to phishing incidents and human error, and that’s only going to increase further,” Duncan said. 

Navigating these challenges requires businesses to carefully assess their cybersecurity posture, understand policy terms thoroughly, and work closely with insurers and knowledgeable IT partners like Virtuoso to ensure requirements are met for comprehensive coverage.  

Embracing The Future of Cyber Insurance with Virtuoso 

No company is immune to the impacts of cyber incidents. That is why cyber insurance is no longer just a luxury; it is a necessity in overcoming the demands of today’s digital landscape.  

As cyber risks evolve, insurance providers are continuously adjusting to emerging threats and improving their policies. Looking ahead, businesses must ensure they are well-equipped to confront the dynamic challenges of cybersecurity. 

Get in touch today to discuss how Virtuoso can help minimise your cyber risks and potentially reduce your cyber insurance premiums through the right security tools and controls.