Cyber insurance coverage: Here’s what you need to know
Cyber security is a must
The shift to computer systems and digital platforms has revolutionized business, bringing the world into a new era of work. But this same reliance on everything digital is leaving businesses exposed to cyber threats—something that cyber security is vital in combating.
Today’s cyber threats come in all shapes and sizes, with cybercriminals always evolving their techniques to increase their chances of success. But businesses can’t afford to get hit. 60% of small businesses impacted by a cyber attack go out of business within six months, with the list of potential risks including operational disruption, lost data, legal proceedings and reputational harm, not to mention direct financial loss from the ransom payment if the business decides to pay it.
The rise of cyber threats
Since cyber incidents can be so disruptive—and expensive—cybercriminals are launching more cyber attacks than ever before. Nearly three-quarters of US small businesses reported a cyber attack in the last 12 months, as the target for cybercriminals to exploit grows bigger and more profitable every year.
It’s high-profile cyber attacks that tend to make headlines. In August 2013, hackers exploited a zero-day vulnerability and stole millions of sensitive medical records. While recently in Australia, a cyber attack brought a major port operator to a standstill. But these cases are just the tip of the iceberg. Far more cyber attacks happen than are reported in the news, so cyber risk management is essential for any business—in which cyber insurance plays a key role.
What is cyber insurance?
Cyber liability insurance vs. cyber security insurance
Cyber insurance, cyber liability insurance and cyber security insurance all refer to the same thing: an insurance product designed to cover a range of cyber incidents, including ransomware attacks, data breaches and social engineering.
How it helps
The cost of dealing with a cyber attack can be a huge burden for any business working alone. Taking out a broad cyber policy means businesses can share the risk with an insurer. They can receive cover for financial loss throughout the lifecycle of an incident, all important in helping them to get back on their feet.
The best cyber policies also offer expert incident response and business recovery services, something that many businesses working alone simply lack the budget for. CFC has built the largest team of cyber security experts in the industry, with a mission to stop cyber incidents from happening, respond effectively when they do and get businesses back up and running quickly—all available to our policyholders at no extra charge.
Types of cyber insurance coverage
Cover under a cyber insurance policy can fall into two broad categories: first-party cover and third-party cover.
First-party cyber cover
This covers the financial losses that the insured incurs themselves as a result of a cyber event, often one that impacts their own network.
Typical first-party cyber losses includes:
- Incident response: real-time support and advice in relation to the cyber event, legal advice in relation to any legal obligations the business may have, the cost of carrying out forensic investigations to remove malware and determine the root cause of the incident and what has been accessed, the cost of notifying affected individuals that data has been breached, and so on.
- System damage and business interruption: restoring the business’s computer systems and data to the position they were in prior to the cyber event, plus any income loss as a result of system downtime.
- Cybercrime: loss of electronic funds, either through the hacker stealing directly from the business’s online bank account or through employees being tricked into sending funds to fraudulent accounts by social engineering scams, as well as the cost of reimbursing ransom payments in response to a cyber extortion event.
Any business that relies on their computer systems to carry out business operations, stores business critical or sensitive data or transfers money by electronic means is likely to have a first-party cyber exposure.
Third-party cyber cover
This covers a business for liability actions brought against them due to a network security or privacy event, such as the failure to prevent the theft of personal data. Typical third-party cyber insurance covers:
- Damages: damages that the insured business is legally obliged to pay to third parties.
- Costs and expenses: legal fees incurred to defend the insured business against the liability action (often extending to claimants' costs and expenses if the insured is obliged to pay them).
- Regulatory fines and penalties: fines and penalties levied by regulators and other bodies.
Any business that works with sensitive client data or is responsible for protecting a client’s systems would benefit from this type of cover, including technology companies, financial institutions, healthcare providers and retailers.
Common inclusions
Data damage
IBM reports the global average cost of a data breach to be $4.45 million, with lost or stolen data a significant issue for any business to overcome.
Imagine sensitive data is stolen from your business—whether it belongs to employees, customers or patients. You may face a regulatory fine, with the GDPR and DPA 2018 setting a maximum fine of £17.5 million or 4% of annual global turnover, whichever is higher. Reputational harm is another significant cost. People are less likely to hand over their data to a business associated with a breach, instead choosing to go with a competitor. And that’s before considering if losing data will impact your ability to operate and trade.
Good cyber policies safeguard against all the above. CFC covers regulatory costs and fines levied directly as a result of a cyber incident, and provides access to expert PR support if reputations are at risk. Our cyber wording is carefully crafted to include the recreation of data, rather than just the recovery of lost data. That means if data isn’t recoverable—for example, when a hacker has deleted back-ups—we’ll cover the cost of hiring expertise to recreate that data from scratch.
Business interruption
The primary goal of any cyber attack is to disrupt. Whether on your own systems or a third party’s, an attack that causes system failure and downtime can have a catastrophic effect on your ability to trade, resulting in a business interruption loss.
A haulage company suffered a ransomware attack where cybercriminals encrypted all data files including routes, logistical information, key contacts, stock quantities and payment processing capabilities. The hackers then requested a ransom of £10,000 in exchange for the decryption key.
Due to the cyber attack, the business was down 80,000 sales in the month following, this amounting to nearly £1 million in revenue lost. Fortunately, the business recovered nearly all of the financial loss suffered under its cyber policy with CFC.
Cyber extortion
Cyber extortion usually starts with a human error or oversight—think clicking on a malicious link or losing a laptop—and ends with a ransom. Common forms include phishing, ransomware attacks and social engineering.
When faced with a demand or ransom, it can be difficult to know whether you should pay it. Is the ransom a fair price? Does the cybercriminal really have you cornered, and is it a sanctioned criminal group ? And once you pay, will they really hand over the decryption key? All the while your business is at a standstill, unable to access its systems and trade with customers.
That’s why having a team of expert cyber responders on hand is so valuable. Our team takes a follow-the-sun approach, working around the clock to get to the root cause of incidents and discover whether the ransom needs to be paid. If it does, then CFC’s cyber policy will cover the cost regardless.
What most cyber insurers don’t cover
Minimum level of security
At the time of a cyber attack, often insurers require the business to have a warranty or minimum level of cyber security in place in order to trigger the policy. This results in a lot of declined claims, even though the business has taken out cyber insurance.
But at CFC we still cover the vast majority of cyber claims, giving our policyholders valuable peace of mind that we’re here to help if the worst happens.
Property damage
Just as property policies were designed to cover brick and mortar, and go as far as to specifically exclude cyber events, many cyber policies don’t cover physical assets.
CFC is a little different, however. If a cyber incident renders hardware unusable, we’ll cover the replacement costs where it is more efficient and cost effective than installing new firmware or software onto a device.
A comprehensive policy
With over two decades’ experience in cyber, CFC is one of the most established providers in market. Not just here if the worst happens, our proactive service is designed to get businesses ahead of cyber risk, and our broad coverage offers invaluable instant peace of mind.
Together, let’s navigate the ever-changing seas of cyber risk, safely and confidently.
Any questions?
Find out more in our cyber insurance guide. Reach out to us with any questions at cybermarketing@cfc.com.
