Cyber Insurance

IS CYBER INSURANCE WORTH IT?

Cyber insurance is an indispensable investment in your overall IT security. It provides a safety net from insider cybercrime and external cyber threats, especially data breaches and ransomware. In 2021, cyber attacks increased by 50% compared to 2020, while the cost of cybercrime continues to increase, and is expected to reach $10.5 trillion annually by 2025. For this reason, more organisations are signing up for cyber insurance policies to safeguard themselves. The cybersecurity insurance market is forecasted to grow into a $20 billion industry by 2025. Cyber insurance covers digital extortion, privacy breaches, viruses and malware attacks, website hacks, and denial-of-services (DoS) attacks. Therefore, it’s essential to have it as a part of your cybersecurity strategy.

Ransomware is the primary driver of cyber insurance claims, and in the past year, the percentage of organisations that experienced an attack increased by 78%, up from 37% in 2020 to 66% in 2021. As threat actors are becoming more capable of carrying out large-scale attacks, the demand for cybersecurity insurance is also increasing. However, you shouldn’t have to wait for an attack to happen to sign up for cyber insurance. Many companies have already adopted it for precautionary purposes.

WHY IS CYBER INSURANCE IMPORTANT?

Data breach or theft affects individuals and companies and could result in losing customers and revenue. Recovery from a breach incurs additional costs which weigh down businesses. In fact, the global cost of data breaches for companies is $3.86 million on average. Cyber insurance can help your company recover from a data breach and minimise the costs including legal fees, revenue loss, business disruption, equipment damage, and public relations expenses to redeem your reputation. Not only that, but cyber insurance can also help you protect yourself before an attack happens. Most providers demand that companies improve their cybersecurity practices in order to qualify in the first place. Cyber insurance can help you in myriad ways by covering various types of costs.

• Legal fees & attack remediation: a cyber attack can incur hefty costs on an organisation, which an insurance policy would support with. Additionally, your cyber insurance coverage could include hiring computer forensic experts to help you mitigate the attack or recover compromised data
• Data breach recovery: a cyber insurance policy helps businesses pay for the costs needed to recover any data compromised by an attack
• Personal identity recovery: cybersecurity insurance helps organisations restore the personal identities of customers who were affected by a cyber attack
• Customer notifications: cyber insurance helps businesses cover the costs of notifying their customers of a data breach, especially if it includes the loss or theft of personally identifiable information (PII)
• Repair of damaged systems: if your computer systems were damaged during a cyberattack, your cyber insurance policy could cover that cost
• Ransomware demands: cyber insurance coverage often helps pay the demands made by criminals carrying out a ransomware attack

REQUIREMENTS FOR CYBER INSURANCE COVERAGE

The majority of cyber insurance providers conduct a cyber insurance risk assessment to determine your premium, coverage limits, and whether you qualify for cyber insurance. They might also perform regular check-ups and reassessments to ensure that companies aren’t buying their way out of improving their IT security. The best candidates for a cyber insurance policy are those who pose the least risk to the underwriter. Therefore, organisations must fulfill basic IT security requirements to qualify for cyber insurance.

• Equip all PCs with up-to-date antivirus software
• Have multi-factor or 2-factor authentication in place, especially for business emails
• Protect the company’s network with a firewall
• Regularly backup business data on external devices or secure cloud solutions
• Follow a secure provisioning process for user access rights and permissions, by using identity access management (IAM) for instance

Not only does improving your IT security protect you from attacks, but it could also lower your insurance premiums. Given the recent hardening of the insurance market, 97% of companies surveyed in a 2022 Sophos study enhanced their cyber security procedures to improve their insurance position.
Despite that however, educating employees is key to ensuring that these cybersecurity standards are met. After all, a security system is only as strong as its weakest link.

THE DOWNSIDES OF CYBER INSURANCE

Cyber insurance is an added cost, which makes some companies hesitant to sign up for it. This is especially the case for smaller firms on tighter budgets. Additionally, some organisations might gain a false sense of security after insuring themselves. They may neglect to develop their policies and continuously invest in their cybersecurity. However, this is why providers conduct regular security assessments, to guarantee that the insured organisations have robust practices in place.

SHOULD YOU PAY FOR CYBER INSURANCE?

Absolutely! The costs of a breach and compromised customer data are unpredictable, and having a cyber insurance policy in place can mitigate the impact of an attack. In the survey conducted by Sophos, 98% of the organisations that faced a ransomware attack reported that their cyber insurance policy paid out in their most significant attacks. Companies operating in the IT sector or those that handle lots of sensitive data need cyber insurance the most. Having one in place covers legal and recovery costs, which can be more expensive to pay out of your own pocket in the case of an attack. Cyber insurance is a cost you pay now, to protect you from bigger costs later.

STAY AHEAD OF CYBER ATTACKS AT BLACK HAT MEA

While cyber insurance mitigates the financial impacts of a breach, it does not protect you from it. The only thing that would do that, is a robust cybersecurity strategy, which you can learn how to develop at Black Hat MEA. Join 200+ global infosec influencers, 50 Black Hat trainers, and hundreds of ethical hackers and CISOs to learn how to stay ahead of threat actors and implement the latest cybersecurity best practices at your organisation. Black Hat MEA is a partner of Saudi Arabia’s Vision 2030 to help create a digitally savvy nation by training people on the skills needed to protect the Kingdom’s upcoming projects.