Insurance companies are setting more stringent requirements to obtain cyber insurance cover. We spoke to several to review their application questionnaires. Here is a summary of what’s changed and what you need to get cover.
When an insurance company wants to determine a reasonable price for a policy, in most cases they can look at years (or decades) of actuarial data.
The world of cyber risk however is changing so rapidly, insurance companies are being forced to react and respond in real-time.
Why cyber insurers have been paying out on ransomware
The rapid increase in ransomware attacks has driven demand for cyber insurance and ransomware policies.
Insurance companies initially favoured paying out over recovering internally from backups because it seemed like the less costly option.
If the ransom is set at $1m, the insurance company can pay $1m or, it can advise the business to refuse and recover from backups. The recovery may take several days or even weeks. That might mean the business claims $10m from its Business Interruption cover. Paying the $1m ransom seems like the cheaper option.
That makes sense if you look at each case in isolation. If you look at the entire system, however, it becomes clear that paying out on ransomware is a bad idea. It feeds a vicious cycle of more attacks leading to more pay outs… leading to yet more attacks. Insurance companies were starting to pay out far more than they could afford.
Changes to cyber insurance cover
Insurance companies have quickly realised that the situation isn’t sustainable. They responded by:
- Increasing the cost of cyber insurance cover
- Having more stringent assessments on a policy holder’s ability to recover without claiming
- Discouraging paying ransoms