Cyber Insurance Will Reshape Cybersecurity

Cybersecurity is broken. It’s a bold statement, but given the increasing frequency of cyber breaches, along with the presence of more varied and evolving threats, there is growing uncertainty about the ability of the cybersecurity industry to protect its customers. There is virtually no company that isn’t a potential target. From mom-and-pop storefronts to Fortune 500 companies, no business is immune to cyber risk. Even with the best possible cybersecurity posture, there is always a threat of a breach.

There are several factors driving the rise in cyber threats. They break down into a few core categories: more areas of exposure, difficulty in law enforcement and more creative hackers.

• Increased exposure. There is a lot of code out there—code that can be exploited for cyber attacks. The sheer volume grows constantly as software companies write more lines of code for each solution. Further, there are more and more software offerings being implemented by all sizes of companies. In short, more software solutions with more lines of code for each. This presents many more opportunities for exploitation. Legacy code presents its own problem, as older code is hard to check adequately.

• Hackers—hard to identify, harder to catch. Hackers don’t necessarily “phish where they live.” They often prefer to hack across borders, making it difficult to coordinate law enforcement efforts. Sophisticated hackers often work in groups, making traceability and accountability nearly impossible.

• Hacking innovation. Since cybersecurity technologies adapt to threats after the fact, hackers improve their hacking techniques to be successful. Due to the cycle of hack-solution-new hack, cybersecurity providers primarily react to new attacks; they can’t predict them. Growing hacking opportunities, a lack of accountability and large financial rewards give hackers plenty of incentive to keep innovating their methods while more and more hackers join their ranks.

How It Affects the Market

There are two outcomes cropping out of this new era of cyber threats that affect businesses. One is the inability of cybersecurity providers to guarantee the effectiveness of a cyber solution, or combination of products, to thwart a breach. Second, it is impossible to accurately quantify the cost/benefit of a cyber strategy since the likelihood and potential severity of cyber breaches is unknown.

Yet businesses need some form of cyber protection. How, then, can they determine an appropriate cyber budget and allocation plan, given the inherent uncertainties they face?

The solution: cyber insurance.

The insurance industry is best poised to solve the cybersecurity problem. There are three reasons: motivation, data and leverage.

• Motivation

Cyber insurance carriers have the same end goal as the insured: not to get breached. The insured doesn’t want to experience a breach, and the carrier doesn’t want to pay out. The risk exposure for insurers is amplified, as risk understanding is less developed compared to more mature lines of insurance such as life, homeowners and auto.

When cyber attacks are thwarted, it’s a “win-win” for both parties.

• Data

Carriers have a lot of it, and they are only going to accumulate more. Large-scale breaches and widespread viruses make headlines, driving businesses of all sizes to demand cyber coverage. As the cyber insurance market grows, carriers will amass more data.

More than just volume, insurers are in the unique position of collecting proprietary information not accessible to other companies. Specifically, insurance providers collect four categories of data that can be analyzed for the purpose of minimizing cyber threats.

1. Actual losses. Using accumulated claims data, carriers can identify the type and severity of breaches, and associate them with actual losses. Claims reports and breach investigations allow carriers to better understand the root causes of how an attack occurred and how to minimize future similar attacks.
2. Technology solutions and practices. Insurers know what technology products clients use by company and solution. Additionally, an increasing number of carriers are using technical solutions to assess the risk level of their insureds. This allows for deep analysis of which practices and solutions actually minimize losses, which don’t, and in which cases.
3. Company demographics. Cyber carriers know industry, company size, revenue and much more about their client base.
4. Company details. Carriers are in a unique position where they can require an applicant to provide additional qualitative and quantitative data to better understand the insured’s risk, including the type of data they store, their organizational processes and even governance. Some examples are number of credit card records housed, assessment of their incidence response plans to the type of regulations they follow. As carriers learn what information best drives ROI, they can adapt their questions to best serve their predictive models.

These datasets help develop risk models that can better predict the likelihood of an attack, potential damage and the preventative steps necessary to minimize threats.

• Leverage

Leveraging the above, cyber insurance can reshape cybersecurity. Once insurance carriers can understand and model cyber risk, they can drive adoption of best practices via financial incentives to the insureds. In time, cybersecurity vendors will be measured on their ability to minimize cyber breaches, incentivizing them to improve their offering.

There is nothing new here. Since the beginning of insurance, the industry has always sought ways to reduce risk, including incentivizing clients to take preventative measures.

America’s first insurance company, The Philadelphia Contributionship (still in business today), was founded in 1752 by none other than Benjamin Franklin, offering fire insurance in the city of Philadelphia. Before accepting a potential client, Franklin’s company would send a team of surveyors to inspect the property to assess risk of fire and set rates accordingly. As fire insurance evolved, several drivers helped reduce premiums and lower losses, including industry regulation, improved building standards, the creation of paid fire departments and financial incentives given to the customer based on taking recommended preventive actions.

Take a more recent example: modern homeowners insurance. All other factors being equal, a homeowner who installs an alarm system and smoke detectors will see a lower premium than one who doesn’t.

Similarly, if cyber policyholders show they’ve adapted suggested actions, they will not only enjoy a maximized cyber posture but also savings on premiums. These actions will create demand for cyber products that adhere to insurance standards.

Cyber insurance carriers, armed with the best understanding and motivations, will spur businesses to take actions that allow for better cyber planning and budgeting, improved ability to withstand attacks, more accurate premiums on policies, and ultimately a stronger cybersecurity ecosystem. Cybersecurity may be broken—but cyber insurance can help fix it.

This article was originally published by Carrier Management, Wells media Group’s publication for P/C Insurance C-suite executives.

Topics Cyber Carriers