When cyber insurance first became available in the 1990s, there wasn’t much need for it — or at least, so people thought. The internet as we know it today was still in its infancy, and most organizations didn’t see the point of cyber insurance. The original policies were to cover liability around software and media concerns.

As we moved into the 21st century, the internet became entrenched in everyday business operations and blurred the boundaries between personal and corporate. As a result, the need for cyber insurance took on greater urgency. Data breaches, DDoS attacks, ransomware — virtually any cyber incident that compromised sensitive data or put an organization at risk for lost business made investing in cyber insurance policies look more appealing. But how has the rise of cyber insurance impacted cybersecurity as a whole?

Are You Eligible for Cyber Insurance?

Normally you purchase insurance to protect yourself, your property or your business interests in case something bad happens. Car insurance, for example, is a requirement to own and operate a vehicle, but you don’t have to really do much more than purchase it to obtain coverage. A life insurance policy might require a physical, but for most people, that’s not an issue. Some policies, like flood insurance, do have contingencies before the purchase can be made, but those are predetermined — such as living in an area prone to flooding.

Cyber insurance is different. You can’t just call an agent and request cyber insurance to cover your losses if your network is breached. Being eligible for cyber insurance requires your cybersecurity program to meet certain standards. In addition, you must maintain those standards to continue coverage.

Attackers Change Tactics

These standards alone have been the push that some organizations needed to improve their overall cybersecurity posture. That in itself has impacted cybersecurity overall. But over time, as defense against attacks became more complicated, too many organizations have become lazy. Premiums are increasing, but at the same time, insurance providers are becoming more selective in what they will pay.

“While ransomware continues to be a dominant risk, we are seeing tactics change, including the rise of other forms of extortion as well as funds transfer fraud,” Jason Rebholz, chief information security officer at Corvus Insurance, said in a prepared statement.

Cybersecurity has become more fluid, Rebholz added, and attackers are shifting their methods. This makes it harder for organizations to put the best protections in place, which impacts cyber insurance in turn.

How Cyber Insurance Improves Your Security Systems

Cyber insurance was still relatively new in the early days of the Obama Administration. However, that didn’t stop members of the Department of Homeland Security from touting its value. One point that jumps out is cyber insurance’s advantage over governmental regulation as a means to improve your cybersecurity program.

“Governmental regulation results in an emphasis on meeting basic minimum standards, whereas insurance results in companies striving to adopt — and improve upon — best practices,” a government white paper declared.

“Fear of legal sanctions can force companies to maintain a set of minimum standards, as cyber insurance does, but unlike cyber insurance, it does not provide any incentive to do better,” the white paper also stated, adding that the widespread adoption of cyber insurance will produce better security.

Examine Your Risk Levels

So the idea of using cyber insurance to improve your security posture has been out there for a long time. With almost two decades of hindsight, we can see that cyber insurance hasn’t replaced the need for government regulations. However, it did put the process into place.

Again, you can’t simply decide to purchase cyber insurance and sign a check to an agent. It is a process that will examine your organization’s risk levels and tolerance, looking in-depth at areas that include:

  • Your business industry. Industries like finance and banking will have different security issues to cover than healthcare or retail, for example.
  • The type of information your company stores and transmits.
  • Your formal cybersecurity program, controls and tools.
  • Auditing procedures.
  • Backup and data loss protection policies.
  • Compliance regulations and how well you meet them.
  • Security history, including data breaches and other cyber incidents, and the corporate response.

Because premium dollars can add up, organizations will be selective in the areas they decide to cover. Again, this benefits overall cybersecurity efforts because it forces organizations to be better aware of everything within their network. This especially applies to where they store sensitive data, how they use it and where they are most vulnerable to threats. A lack of visibility into systems has always been one of the biggest threats to data and networks. Cyber insurance forces organizations to have a better idea of their risk posture and the steps needed to improve.

Rethinking the Approach to Ransomware

Many organizations relied on cyber insurance to cover the costs of a ransomware attack, primarily reimbursing the ransom. That’s changed. According to the National Association of Insurance Commissioners (NAIC), the premiums for ransomware policies have increased substantially over the past few years, as have the number of claims for ransom and extortion. The FBI has advised against paying the ransom since that doesn’t guarantee the data will be released, and that has played into some cyber insurance companies’ decision to rethink their ransomware coverage.

With the increase in premium costs and the decrease in the number of insurance policies available, ransomware has taken on a new level of liability for organizations. This means companies need to revamp their internal approach to how their internal cybersecurity policies and programs address ransomware attacks. Policies may explicitly state if the company will pay a ransom and the investment in data loss prevention (DLP) and recovery tools.

Cyber insurance has been a godsend to many organizations that would have otherwise struggled to survive after a serious cyber incident. But no one wants to deal with insurance claims in the first place. Instead, cyber insurance has changed the way organizations should build and structure their cybersecurity programs. The more prepared you are to be approved for an insurance claim, the better prepared you are to avoid a cyber disaster overall.

More from Risk Management

Is Open-Source Security a Ticking Cyber Time Bomb?

4 min read - Software depends on layers of code, and much of that code comes from open-source libraries. According to an Octoverse 2022 report, open-source code is used in 97% of applications. Not only do developers embrace open source, but so do nine in 10 companies. “Open-source software is the foundation of 99% of the world’s software,” Martin Woodward, VP of developer relations at GitHub, told VentureBeat.As the foundation of just about every piece of software, every application or device runs on code that…

4 min read

How to Manage Cyber Risk During Mergers and Acquisitions

4 min read - By attracting attention from threat actors, merger and acquisition (M&A) events are a significant source of cyber crime risk. So much so that, according to a 2020 IBM Institute of Business Value study, more than one in three executives said they experienced data breaches that can be attributed to M&A activity during integration.Security ratings, provided by security rating services (SRS), can deliver an overview of risk to stakeholders. But attack surface management (ASM) tools give security teams actionable insight on…

4 min read

A Software Bill of Materials Helps Secure Your Supply Chain

6 min read - The software supply chain involves developing, maintaining and distributing software to end users. To enhance the functionality of the software being developed, developers frequently depend upon open-source components and libraries. These can be sourced from external vendors like Docker images or open-source projects and in-house providers. But while third-party vendors are often critical to software functionality, they can also increase risk. A compromised software supply chain could lead to the distribution of malicious software, unauthorized access to sensitive data and…

6 min read

How Application Allowlisting Combats Ransomware Attacks

5 min read - Ransomware attacks are on the rise in both volume and sophistication. Triple extortion (a ransomware attack on one business leading to extortion threats on its business partners) is raising the cost of attacks. Ransomware-as-a-Service puts the means to attack in the hands of smaller criminal entities, making the tactic a commodity and not just the tool of masterminds. It’s no surprise that ransomware attacks are now substantially more expensive to recover from than other types of data breaches. Keeping attackers…

5 min read