What to keep in mind before diving into the murky waters of cyber insurance

Where there's risk, there's insurance. In a field like cybersecurity that's overflowing with threats, the risk is enormous, which is why cyber insurance is something for which every organization will have to opt. But insurance can be tricky to choose because while it looks like the policy you select covers all the risks you can think of, the fine print can sometimes be surprising when you do try to claim damages.

This post will educate you on some of the important specifics to look for when choosing cyber insurance.

Understanding the cyber insurance market

Anyone who has tried to claim a payout from an insurance policy knows just how complicated things can get. Insurance policies are legally binding contracts that can contain tricky wording where omissions of terms could lead to them being declared nullified. But before you look at insurance providers as the big baddies, there are a couple of things you need to keep in mind.

• There is a shortage of policies that providers are able to offer compared to the kind of coverage organizations want.
• The number of damage claims has increased exponentially as attack surfaces and threat variants have increased.

As a result of the difficulties with policy supply and demand, Forrester predicts a few trends we might see in cyber insurance:

• Both brokers and analysts working in cyber insurance will enjoy more prominence as they'll be perfectly positioned to help insurance seekers understand the specifics of what is covered in the policy and what might be tricky to claim.
• Cybersecurity service providers might also create a package deal that offers the client both cybersecurity services and the insurance to cover them in the event of a breach.
• Certain customer segments may have to provide proof of partnerships with security service providers and might face other requirements, such as changes to the attestation language.

What to look for when choosing cyber insurance

Different insurance providers offer a range of policies that vary in what they cover. Here are four things you should be looking for in a policy.

1. You'll obviously be opting for first-party coverage (damages due to cyberattacks or data breaches, which also includes the recovery of data and business interruptions), but also make sure you're covered for third-party damage. This covers partners or, more importantly, customers who might be affected due to an attack on your business. This can partially offset the reputation damage a cyberattack can cause and help with customer and partner retention.

2. For any cybersecurity strategy to be implemented, you must first evaluate the risks in your organization. The crucial question in this is what assets can your business not operate without? Create separate lists for assets that you've invested in because they simplify the work process and for ones that are truly crucial and can disrupt business operations. This way, you can compare them to the specifics of your insurance policy to see if these crucial business vulnerabilities are secured.

3. It's important to calculate the damage costs your insurance can waive off compared to the premiums you're paying. Also keep in mind that premiums are a recurring expense, so you need to see if they are costing you more than what you might pay in damages.

4. Insurance providers don't always have the same definitions of terminologies. So don't make assumptions about the wording in your policy. It is also wise to read it thoroughly and ask specific questions about what kinds of attacks and security conditions are covered.

While keeping an eye on those specifics, also be aware of the following common scenarios that could nullify insurance claims.

• Attacks that occurred before the policy was purchased.
• Attacks that result from insider threats.
• Attacks that occurred due to misconfigurations of devices or poorly configured security solutions.
• Attacks that occurred due to a failure to patch a known vulnerability.
• Attacks that occurred because the security solutions were not improved as part of cost cutting.

Ultimately, choosing a cyber insurance policy that reduces the costs of damages in the event of an attack is a decision that should bring together different stakeholders who can offer both technical and business perspectives.