How to make sure your cyber insurance pays out

The growing frequency and severity of cyberattacks over the past decade has seen businesses around the world lose billions of dollars a year and, as a consequence, has created a thriving new market for cyber insurance.Yet despite being in the business of calculating and pricing risk, insurers have found the tsunami of cyberthreats difficult to handle. Thanks to a proliferation of cybercriminal gangs and discoveries of new systematic vulnerabilities such as Log4j, the cost of cyber insurance has soared. In the UK, the price of premiums rose 102 percent in Q1 and a further 68 percent in Q2 in 2022 alone.These price hikes mean that, for many businesses, blanket policies to cover all assets are becoming prohibitively expensive, driving new discussions around how to approach cyber insurance.Most of the conversation has focused on how to get a sufficient level of coverage without paying over-the-top premiums. However, an equally important discussion is whether businesses are properly equipped to get the compensation they deserve after a breach has occurred.What was taken? Dunno…Imagine an insurance claims assessor turning up at the scene of a crime after a burglary has taken place. The safe has been ransacked and there’s ample evidence of theft but when it’s time to interview the victim, they have no idea what was stolen. Some jewelry perhaps? A couple of laptops maybe? The victim has no idea. Indeed, he doesn’t even know if that safe was the only one he had. Maybe there were more safes elsewhere in the house that have been raided – he hasn’t a clue.It sounds like a ludicrous scenario, but in the cyber insurance world, it’s one that’s sadly all too plausible. Data is widely acknowledged as one of the most valuable resources that organisations possess, yet most have little to no visibility into where all their sensitive data is stored, who is accessing it, when, and for what purpose. This makes submitting a cyber insurance claim substantially more difficult, since companies can struggle to understand key facts like what information was taken, when, and by whom?So while cyber insurers often judge customers on criteria such as their advanced firewalls, antivirus software, or malware detection and mitigation capabilities, the most important factor when it’s time to claim is the control a business has over its data.The who, what, when, whereNobody wants to have to be the victim of an attack and have to make a cyber insurance claim. Unfortunately, with the number of data breaches and compromised records each year continuing to skyrocket, businesses cannot afford to pretend they are immune to attack.Cyber insurance could be needed at any time, so businesses not only need strong preventative measures in place, but also a clear plan for what to do in the aftermath of a breach so that a claim can be made and swiftly resolved.Commissioning digital forensics post-breach can dramatically inflate the costs, so sensible businesses should ensure they have several key capabilities already in place. These not only help to reduce the chances of a cyberattack being successful, but also make forensics significantly easier if the worst should happen:Data discovery: Does the business have a full overview of all of their data assets, regardless of whether it’s stored in an on-prem database, a cloud storage service, or any other type of third-party platform? Modern businesses have vast amounts of data and are constantly generating more. It’s impossible to track all data assets manually, so businesses need to automate the data discovery process and provide security teams with proper visibility. |Data classification: Of the data that was taken, how much of it was sensitive? Did it belong to customers or partners, was it valuable intellectual property, or financial records? All of these should be classified as ‘highly sensitive’ and could be extremely damaging if stolen or ransomed.Database Activity Monitoring (DAM): Thirdly, organisations should make sure they can identify when and how, and how much data was taken using DAM tools. ‘Files were accessed on May 12th from an account based in Singapore’ is far more precise and helpful than ‘some data may have been illegitimately accessed between March and August, but we’re not sure if it was exfiltrated or manipulated in any way’. Going back to the safe analogy, even if you know where your safe is and that there was money in it, if you don’t know how much was taken, it still presents a major problem when filing an insurance claim.Each of these are essential to determining the timelines and severity of a data breach, which is critical for dealing with both regulators and insurers. If a breach occurs and the victim company is unaware of how many records they have, the regulator can fine them based on the total number under a worst-case scenario, yet insurers are far more likely to have issue minimal payouts (or even zero payout) if there is a lack of specifics.As such, these capabilities are fundamental in ensuring more accurate claims are filed, minimising the regulatory consequences, and expediting the compensation process.It all comes back to dataGood data security is an essential part of any cybersecurity strategy and is vital in preventing or mitigating the damage from breaches. Yet, as the last few years have taught us, it’s impossible to defend against every attack. No matter how strong an organisation’s defences are, if hackers are dedicated enough, they will find a way through.Therefore, prudent companies need a cybersecurity strategy that covers not only how to minimise the chances of a breach, but also what to do in the wake of one. A key part of this is making sure that the financial losses are quickly and comprehensively compensated by insurers – otherwise companies may find the consequences of a breach to be even worse than they expected.

How to make sure your cyber insurance pays out

How to make sure your cyber insurance pays out

Related content

Microsoft Takes Down Phishing-as-a-Service Domains

Five Named and Charged in SMS Phishing Effort

Businesses Commonly Attacked Outside of Working Hours

Microlise Reports October Cyber-Attack

U.S. Library of Congress Emails Hacked

Infostealer Malware Expected to Increase in Use in 2025

Attack Group Linked to Hamas and Hits on Israeli Targets

Upcoming Events

How to make sure your cyber insurance pays out

How to make sure your cyber insurance pays out

Related content

Microsoft Takes Down Phishing-as-a-Service Domains

Five Named and Charged in SMS Phishing Effort

Businesses Commonly Attacked Outside of Working Hours

Microlise Reports October Cyber-Attack

U.S. Library of Congress Emails Hacked

Infostealer Malware Expected to Increase in Use in 2025

Attack Group Linked to Hamas and Hits on Israeli Targets

Upcoming Events

Confirm cancellation

Sign up benefits