Cyber Insurance – The New Norm: A CISO’s Perspective

Just about every business today needs cyber-insurance. More and more small businesses are doing online transactions and it will only increase as we move forward.
A company with fewer amounts of data is more likely to be hacked than a firm with Big Data, because smaller firms are less likely to have robust defenses against hackers. Hackers are very opportunistic; if they can get 100 credit cards from the local restaurant, they will make the effort without hesitation.
Due to recent high profile breaches wreaking havoc on many enterprises, cyber insurance will be gaining velocity and popularity. The Board and the C-Suite will have an appetite for reducing risk, in part, by offloading it to insurance providers. Government agencies and insurance companies are already at work establishing guidelines to support the growth of the cyber insurance market.
Solutions providers will also accelerate the increased adoption of cyber insurance policies. They will tout the promise of reduced premiums for enterprises that adopt their solutions to demonstrate proof of having critical security controls in place.
Moving forward, cyber insurance companies will have two sets of customers: new clients and existing clients who are buying additional coverage. Premiums will depend on the size of the company, the industry in which it operates, the amount of data being insured and the security controls and solutions being utilized.
Cyber insurance policies, which cover the cost of conducting an investigation into a breach, will evolve to also cover the cost of brand management, loss of revenue and customers, and credit monitoring for those affected by a breach.
However, as an industry, we need to quantify cyber risk more accurately as actuarial data is often scarce. An ideal form of cyber risk management requires a balance between IT security measures and the transfer of risk via insurance solutions for cyber-risk.
Insurers’ core competency lies in pricing and underwriting risk, while cybersecurity experts specialize in using technology to deal with cyber vulnerabilities. Insurers must partner with cyber security experts to create a holistic cyber risk management plan for the businesses and organizations.
Cyber insurance companies must offer customized solutions that cover a broad range of cyber-risks because the risks faced by organizations are unique to the industry in which they operate.
The degree of cyber exposure, the scale of the organization, the type of data collected, and most importantly the organizations’ ability to handle risks are key determinants of cyber insurance policy terms and pricing.
Cyber Insurance is like health insurance; there is no need to research if it’s worth having or not. Not having cyber-insurance could prove costly. Much like health insurance offers a safety net for families, cyber insurance will help a CISO rest easier and focus on the business at hand.