Ep. 5: Insurance & Claims

Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

The cyber insurance market is booming, with written premiums expected to reach $20 billion USD by 2025, globally, up from under $5 billion USD in 2016.

A significant driver of this growth is the well-documented success of ransomware attacks, which have evolved from opportunistic and transactional attacks to the threat landscape we see today.

With every new headline, businesses are continuously reminded that cyber insurance has a role to play in managing risk by potentially offsetting the rising costs of ransom and extortion payments, system recovery, investigation, customer notifications and credit protection, public communications services, and other legal expenses.

However, the cyber insurance market is still relatively new, so many providers have limited understanding of how much risk exposure organizations have to cyberattacks. Lacking well understood actuarial data and resulting risk quotients for cyber risks and the ever-changing costs resulting from cyberattacks, underwriters struggle to understand the financial risk associated with a specific policy, and policy fees, coverage and requirements vary greatly.

At the same time, ransomware gangs continue to refine their operations. While the headlines are dominated by attacks against large enterprises and critical infrastructure, there are worrying signs that threat actors are expanding their reach.

Small and medium businesses are the biggest targets

In the latest episode of our Managing Cyber Risk podcast series, Mark Sangster and Hillarie McClure spoke to Catherine Lyle, Head of Claims at Coalition Inc. Insurance, about the latest trends in cyber insurance claims and coverage, why your cyber insurer’s value goes well beyond providing coverage, and practical advice on when and how organizations should engage an insurer in the event of a breach.

According to Mark, one of the most concerning trends is that ransomware gangs are using supply chain attacks to gain access to thousands of small and medium businesses (SMBs). Citing recent examples including Solar Winds and Kaseya—essential tools for many organizations—Mark points out that businesses “can’t eliminate this risk through non-participation”.

Similarly, threat actors may target Managed Service Providers (MSPs) that provide the IT skills and tooling that tens of thousands of SMBs rely on.

Catherine Lyle agreed, “Ransomware is the immediate monetization of a crime.”

After all, it allows criminals to immediately profit and drive those proceeds right back into finding and attacking more victims.

In addition to ransomware, Catherine noted that another trend she sees as significant right now is “funds transfer fraud”. Her company works one-on-one with insurers that have experienced a security event.

Through that work, her investigators have noticed that cyberattackers are often spending much more time within the victim’s environment—allowing them to better understand communication patterns and power structures, both of which are leveraged to make social engineering effective.

From Catherine’s perspective, senior leaders within small and medium businesses are beginning to recognize that they need to seriously consider the risk (and the associated costs) of a potentially devastating cyber attack.

Taking advantage of pre-claim services

These same leaders are also recognizing that their cyber insurance provider can provide valuable, proactive assistance and expertise to help prevent attacks, limit their scope and accelerate recovery—in addition to covering damages.

By working with an insurance provider, SMBs can ensure they have a “happy path” to follow in the event of an incident.

Additionally, it’s imperative that organizations think about the ripple effects of a cyber attack before it occurs. It’s often not so much about making the right or wrong decisions, but rather about being prepared, understanding and managing the unavoidable tradeoffs that come with Incident Response (IR).

Mark and Catherine both stress the importance not only of preparing, but of thinking beyond the ones and zeroes—beyond the technology. As Catherine pointed out, if an adversary is successful in deploying a ransomware attack against your company, do you know how your business would react?

Although technology is an important element, you must have a plan set in place to address how to work with law enforcement, handle public relations, notify clients, comply with regulations, decide whether or not to pursue a prosecution, and so on.

Every business can benefit from relying on cyber incident experts, but very few businesses have this expertise in-house. That’s where trusted partners come in: to explain very clearly what to expect, the timelines that exist, etc. on what might well be the worst day of work you’ve ever had.

Our recent report, The Current State of Incident Response Services in 2021, hinted at the influence cyber insurers have in risk management. For example:

• Cyber insurance providers were tied with executives/boards as having the most influence over IR purchase decisions

• Cyber insurance provider requirements were the second-most cited driving factor in changing IR retainer providers

• Of those organizations represented in our survey, half with insurance are subject to provisions that require them to choose from a selected list of IR providers—with MDR/MSS providers being the preferred category

Knowing your coverage

As the industry matures, cyber insurance policies are continuing to change: cyber insurers have not only begun to offer more restrictive policy terms and coverage limits, but also increased premiums for midsize and large companies by upwards of 20%.

Our survey revealed a wide range in coverage:

• Roughly 60% of respondents with cyber insurance indicated that their insurer covers costs of lost business; likewise, a similar number reported that they are covered for detection and escalation costs

• Fewer than half (45.7%) are covered for notification costs and only 29.3% are covered for ex-post response costs

• Perhaps crucially, only 14.1% of those with insurance are covered for regulatory fines, penalties and class-action lawsuits—which are all realistic consequences of data breaches and are made more likely by the rise in double-extortion ransomware tactics

Being prepared

Unfortunately, all signs point to an increasing number of cyber attacks against businesses of all sizes. And as cybercriminals find new and more efficient ways to reach the long tail of small and medium businesses—most of which lack in-house expertise—having strong partners in place for MDR, IR, and insurance will become essential.

After all, cybersecurity is not an IT problem to solve—it's a business risk to manage.

To learn more about cyber insurance, listen to the fifth episode of the Managing Cyber Risk podcast series, Insurance and Claims, below.