Virus infections and cyber attacks are becoming increasingly dangerous and costly. As a result, cyber insurance companies carefully assess their clients, requiring a higher standard of security technology and policy compliance for qualification, and modify their prices accordingly.
Canada is the third most expensive country by the average total cost of a data breach, as the average cost of a data breach here was $6.75 million per incident in 2021. And the response from cyber insurance providers is very likely to match the increasing costs so they can become profitable again — just in the first half of 2021, the loss ratio for cyber liability was nearly 113%.
The market needs cash to cover the loss, and providers have already lowered coverage limits while increasing premiums. Moreover, cyber insurance providers now require robust cybersecurity systems for an organisation to qualify for insurance to reduce the risk even further.
Every company that uses the internet should consider purchasing cyber insurance, but navigating cyber insurance qualifications can quickly turn what should be a straightforward process into a complicated rush to meet requirements.
We've been watching this trend for over a year and have identified four common themes to be considered when making your organisation cyber insurance-ready as insurers clampdown.
Most cyber insurance providers use comprehensive compliance checklists to inventory an organisation’s technology environment.
What cyber insurers usually evaluate:
Non-compliance with the requirements attracts higher premiums, coinsurance, and even your organisation’s eligibility for coverage, depending on its software and systems vulnerability.
The number of ransomware attacks surges forward, and the average ransomware payment for Canadian firms gets closer to $500,000. Therefore, organisations can expect premiums to grow accordingly. Rate adjustments can go anywhere between 100% and even 300% for companies and organisations with low compliance scores — in the US, some public organisations saw a premium increase of over 330%.
Besides the compliance score, other factors that can further influence cyber insurance premiums are:
The type of policy you opt for and how much protection you want will also influence the value of the premium.
Organisations will pay more for cyber insurance, but it doesn’t mean they get more value for money. Many cyber insurance providers have lowered their coverage to ensure they remain profitable. This measure, too, is a way to counter the continuously growing value of average ransomware payments and other costs associated with data breaches and cyberattacks.
Moreover, many cyber insurers will tie coverage to the compliance score to protect themselves. Therefore, if your provider considers your cyber risk high, you can expect a lower coverage value.
Depending on how much protection you want, cyber insurance can cover:
Cyber insurance will rarely cover paid ransom after a ransomware attack, and more and more cyber insurance providers might rethink ransom coverage.
Cyber insurance carriers establish a value on the amount of any damages that the policyholder will pay — similar to a deductible. This way, insurers reduce their risk and could even lower insurance costs in some cases, but it might also mean you should expect to pay more if you fall victim to a cyberattack.
Further, most companies can’t afford to hold reserve cash required to accommodate a security breach or a deductible, so a series of considerations should be made before opting for such a policy.
Considering that cyber insurance providers qualify organisations before agreeing to sell them a cyber insurance policy, the limitations described above become the ideal situation. On the opposite side, you can find yourself in the impossibility of getting insurance, which puts you and sometimes your business partners at high risk.
The frequency of cyberattacks is growing, and without insurance, your company might not be able to cover expenses caused by data breaches and cybercrimes.
Here’s why:
The goal is to secure a low-cost cyber insurance policy, so you'll need to make your company "insurable" by convincing insurers that you're aware of the risks and are working to mitigate them.
Before contracting an insurance provider, you must identify and solve your weaknesses to lessen fees and deductibles.
You can't repair a problem unless you understand how serious it is and how it affects your business. To guarantee that your organisation follows cybersecurity standards, begin with a pre-audit of your technological environment and security policies.
You can also start creating a security roadmap with this audit. While security technology might be costly, it's critical to address high-risk vulnerabilities and budget for future expenses to reduce exposure and secure your business.
Ready to make your organisation cyber insurance ready? Start with our Insurance Readiness Checklist!