Cybersecurity Insurance: Is it Worth the Cost?
According to the most recent annual Cost of Cyber Crime Study by the Ponemon Institute, the average cost of detecting and recovering from cyber crime for organizations in the United States is $5.4 million. Median costs have risen by almost 50 percent since the inaugural study in 2010. The finding masks the enormous variation of data breach costs which can range from several hundred thousand to several hundred million dollars, depending on the severity of the breach. A growing number of insurance companies are offering cyber protection to enable organizations to manage such costs. This includes traditional carriers in centers such as London, New York, Zurich and elsewhere, as well as new entrants targeting the cybersecurity insurance market. Carriers in the latter category should be carefully veted since some new entrants have been known to offer fraudulent policies in order to exploit the growth in demand for cyber insurance.
Cybersecurity insurance has been commercially available since the late 1970s but was limited to banking and other financial services until 1999-2001. It became more widespread after Y2K and 9/11. Premiums also increased after these events and carriers began to exclude cyber risks from general policies. More recently, the dramatic rise in the threat and incidence of data breaches has propelled cybersecurity into a boardroom issue and led to a growing interest in cyber policies from organizations looking to limit their exposure.
A 2011 study performed by PriceWaterhouseCoopers revealed that approximately 46% of companies possess insurance policies to protect against the theft or misuse of electronic data, consumer records, etc. However, this is contradicted by the findings of 2012 survey by Chubb Group of Insurance Companies which revealed that 65 percent of public companies forego cyber insurance. The confusion may be due to a general lack of awareness among survey responders of the exact nature of insurance coverage. Many responders appear to be under the impression that cyber risks are covered by general insurance policies even though this is no longer the norm.
The cybersecurity insurance industry is highly diverse with carriers employing a plurality of approaches. Some offer standardized insurance products with typically low coverage limits. Others provide customized policies tailored for the specific needs of each client. Furthermore, the industry is evolving rapidly to keep pace with evolving threats and trends in cybersecurity.
Policy premiums are driven primarily by industry factors. E-commerce companies performing online transactions while storing sensitive information such as credit card data are generally considered high risk and are therefore subject to higher premiums. Health institutions hosting data such as social security numbers and medical records are also deemed high risk.
Premiums typically range between $10,000 to $40,000 per $1 million and provide up to $50 million in coverage. However, most standard policies only provide coverage for specific third-party costs to cover losses incurred by a company’s customers or partners. This includes risks related to unauthorized access and the disclosure of private information, as well as so-called conduit injuries that cause harm to third party systems.
Polices that provide coverage for first-party areas such as crisis management, business interruption, intellectual property theft, extortion and e-vandalism carry far higher premiums and are therefore relatively rare. This limits the appeal of cybersecurity insurance and ensures organizations need to self-insure for such risks for the foreseeable future. The situation is unlikely to improve until actuarial data is more widely available and shared between carriers for cybersecurity risks. This may require the establishment of a federal reinsurance agency and legislative standards for cybersecurity.
Carriers are unlikely to offer full cover for all first and third party costs arising from security breaches. This is due to the moral hazard associated with such coverage. Organizations that completely transfer cyber risk have no incentive to invest in preventative and monitoring controls to manage security risks. However, most carriers have exclusions for breaches caused by negligence. Other exclusions include coverage for fines and penalties, often due to regulatory reasons.
Aside from industry considerations, other factors that drive premiums for cybersecurity insurance are risk management cultures and practices in organizations. Carriers often assess cybersecurity policies and procedures before deciding premiums. Organizations that adopt best practices or industry standards for system security are generally offered lower premiums than those that do not. Therefore, insurers work closely with clients during the underwriting process to measure the likelihood and impact of relevant cyber risks. This includes consideration for management controls. Carriers that decide not to assess the cybersecurity practices of prospective clients tend to compensate by including requirements for minimal acceptable standards within policies. These clauses ensure that carriers do not reimburse organizations that failed to follow generally-accepted standards for cybersecurity before a security breach. Cybersecurity standards for SAP systems are embodied in benchmarks that are aligned to security recommendations issued by SAP. This includes the SAP Cybersecurity Framework outlined in the white paper, Protecting SAP Systems from Cyber Attack.
Cybersecurity insurance is most valuable for organizations with mature cyber risk cultures including effective standards and procedures for preventing, detecting and responding to cyber attacks. It enables such organizations to transfer the risk of specific costs arising from security breaches that are more cost-effectively covered by third-party coverage rather than self-insurance. Cybersecurity insurance is not a viable option for companies with weak risk management practices. Even if carriers were willing to insure such high-risk organizations, the premiums are likely to outweigh the cost of self-insurance. Furthermore, the likelihood that organizations would be able to collect upon such policies is low.