Organizations nowadays face new challenges, with cyber insurers increasing rates in the face of a rise in expensive hacks. Insurers substantially raised premiums for cyber coverage during 2021 owing to a row of high-profile cyberattacks. As per recent reports, a cyberattack takes place every 11 seconds today — and by 2031 this ratio may worsen, hitting one cyberattack every 2 seconds.
Companies are leaning towards cyber insurance in the fear of significant fallout from a cyberattack. To be on the safer side, companies can perform an exhaustive self-assessment to identify vulnerabilities and take the necessary steps to safeguard the organization.
Ransomware and Evolving Attack Methods
As per reports, ransomware attacks grew 64% year-on-year between August 2020 and July 2021. And attackers are trying innovative methods including ransomware-as-a-service and triple-extortion ransomware techniques. The demand for cyber insurance is skyrocketing, mainly driven by claims and a rising number of companies experiencing cyber losses or having a vendor in their supply chain facing an issue.
New compliance requirements further aggravate the surge. The demand for cyber insurance has dramatically reset the pricing for insurance premiums across the board.
Insurance Market Changes
Direct-written premiums gathered by the largest U.S. insurance carriers in 2021 surged by 92% year-over-year, as per information submitted by the National Association of Insurance Commissioners. Some insurers charge as high as 300% at renewal.
The insurers are lowering coverage limits on sectors that have been worst hit by cybercrime. These sectors comprise education, government, healthcare, and manufacturing. According to recent reports, insurers who didn't mind issuing $5 million cyber liability policies in 2020 have scaled back to limits of $1 million to $3 million in 2021 — even on renewals. This move prompted organizations to seek additional insurers to reach desired cyber liability coverage limits.
Impact on Organizational Strategy
Higher costs have coincided with surging demand as a result of regular and severe cyberattacks. For example, no other element had as much of an impact on cyber insurance premiums for the second quarter of 2021 as ransomware. The reality is that several attackers are aware that big companies can afford to pay high ransoms — since they won't do it alone; they would rely on their cyber insurance policy to pay some of the ransom.
From the companies' perspective, they should ensure that they are investing in cybersecurity controls. Whether it is the utilization of multi-factor authentication, endpoint detection and response, privileged access management, patch management, or vulnerability management — companies should be well-prepared for risk mitigation, resilience, and insurability.
What Insurers Are Looking For
Companies should work meticulously to anticipate underwriters' questions about what they are doing to safeguard themselves from ransomware attacks. Underwriters are now scrutinizing:
- Multi-factor authentication (MFA) deployment across all critical systems
- Endpoint detection and response (EDR) implementation
- Privileged access management (PAM) controls
- Regular patch management and vulnerability scanning processes
- Tested and documented incident response plans
- Employee cybersecurity awareness training frequency and quality
- Backup frequency, testing, and offline/air-gapped storage
- Network segmentation to limit blast radius of any breach
The Future of Cyber Insurance
This is a crucial moment for the future of the insurance sector. The cyber environment is fragile, with threat volatility and recent losses. Given the current scenario, the insurance industry must get more involved in the cyber sector which is still in its nascent stage.
Companies can involve in a bit of planning and also early purchases of small amounts with surges over time. This would help in scaling the market that develops with the needs of the companies it supports. A combination of best practices in cybersecurity can be practiced to keep companies' cyber insurance rate surges reasonable — creating a virtuous cycle where better security leads to better coverage at better prices.