CyberSecurity: Businesses Insuring Against Breaches and Hacks

As reports grow of the number of businesses being hacked and the losses of customer and company proprietary information increase, the interest that businesses have in protecting themselves with cyberinsurance is increasing.

Cyberinsurance policies can cover things like the loss or corruption of business data, identity theft, defamation via social media, legal defense costs, data breaches, business interruption, and network damage.

But the insurance industry is still at a loss for how to deal with this new type of insurance.  It’s difficult to predict which companies that are vulnerable to cyberattack and how well a given company would be able to withstand an attack.  The business of cyberinsurance is still evolving as more data is collected.  To date, the pricing of most types of insurance is determined based on historical data, data which is driven by parameters like climate or age, but computer data loss is often human-driven and much less predictable for when it will happen and the scale of the loss.

Sarah Stephens, European head of cyber and commercial errors and omissions insurance at Aon Risk Solutions, said that “while there is a greater emphasis on cyber attack prevention for financial services institutions, we see that attacks cannot always be avoided, so part of a good strategy is to round out that prevention with some risk transfer through appropriate insurance cover.”

Smaller businesses are most at risk.  “The problem with small businesses is they don’t even have the support staff to take care of a problem. So when they’re attacked, it’s far worse for them than for the big company. It’s also more of a danger because their margins are so small.”

Marsh & McLennan estimates that $1 billion of cyberinsurance premiums will be collected this year in the United States and that that number will double in the coming year.  A Ponemon Institute study found that as many as 31 percent of businesses have invested in some amount of cyberinsurance and, among those without it, 57 percent said they would purchase it in the near future.

Andreas Schlayer, responsible for cyber risk insurance at Munich Re, said that “companies have become aware that the risk of being hacked is unavoidable.  People are now more aware that hackers can attack and do great damage to central infrastructure, for example in the energy sector.”