What does Cyber Insurance Cover?
Almost all cyber insurance policies cover three basic cyber incidents that could happen to a business. The first thing most policies cover is data breaches. Data breaches generally mean any attack that contains the theft of personal information. The second basic incident that most policies cover is cyber attacks that happen on third-party vendors that hold your information. The third is attacks on that breach your network no matter the motivation, whether the motivation was terrorism or economic. In addition, most policies will cover cyber attacks whether they originate from inside or outside the US.
Many policies will contain other types of protections. Many will contain aid once a business is breached. Insurance policies will cover legal fees, the cost to contact customers about the breach, and even lost income due to the breach. As can be seen, insurance policies usually cover a wide array of expenses to help companies recuperate after a cyber attack.
How Much does Cyber Insurance Cost?
According to AdvisorSmith in the US in 2021 it cost $1,589 per year for cyber insurance per $1,000,000 in coverage and with a $10,000 deductible. Between 2020 and 2021 insurance premiums have risen from an average of $1,485 to $1,589 or by an average of 7%. The price rise is most likely due to the large increase in ransomware attacks. One interesting thing to note is how much insurance policies vary from state to state. For example, in 2020 in Minnesota insurance costs on average $1,708 or 15% higher than the national average. On the contrary, in Michigan, the average was $1,339, or 10% below the national average. One last interesting thing to note was the jump in insurance costs in the state of Arizona between 2019 and 2020. Rates went up 39% from $1,139 to $1,581 a year. This just seems to be Arizona catching up to the national average.
Many factors can also raise the cost of cyber insurance. One obvious way to make insurance more expensive is to have a history of cyber attacks against the company. Some other factors for prices include how much information the company stores, what type of information the company stores, and what type of defenses the company deploys. The type of information a company store is the biggest factor outside the amount of data stored. For example, something like credit card information would be considered medium risk while personal information like date of birth and health information would be high risk.
How Seriously do Companies Take Cyber Threats?
The good news is companies are beginning to take cyber threats a lot more seriously. This commitment to security can be seen in the rise of insurance rates due to supply and demand. While in most sectors between 80% and 90% of businesses have cyber insurance only 60% to 70% of businesses have ransomware protection in their policies. The number of businesses with ransomware protection is stunningly low considering the damage these attacks can do. According to TechTarget, the average cost of a ransomware attack increased from $760,000 to 1,850,000 between 2020 and 2021. This comes out to a 140% increase. With this alarming rate of ransomware attacks showing no signs of slowing down insurance will get a lot more expensive for everyone.
Conclusion
As attacks get more costly for businesses and insurance companies perhaps more investment will be put into preventative measures. Once these reactive measures become too expensive for companies to handle the hope is many will start to pay more attention to security. While these cyber attacks are bad for society at large perhaps one day it will become too costly for companies to lose user information, and investment will be put into preventive security. In conclusion, as insurance prices rise the security standards of businesses will hopefully increase as well.
-Nathan Skomo
Sources
https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance
https://advisorsmith.com/business-insurance/cyber-liability-insurance/cost/
RIT Cyber Security Policy and Law Class Blog 