Insurance is crucial in helping businesses deal with ransomware-related losses, such as privacy/data breaches, business interruption, data and system recovery, forensics, and legal support.
Cyber insurance can assemble the proper team of specialists, such as legal counsel and computer forensic analysts, to evaluate the incident and suggest an appropriate course of action after an attack.
Given the potential for higher recovery and remediation costs than ransom payments, cyber coverage might become even more valuable to the insured. These expenses could result from the need to manage any reputational fallout and third-party liabilities from a data breach, as well as any downtime and the need to restore lost or corrupted data or information.
In addition to assisting the insured in coping with an attack, insurance can promote risk avoidance and good cyber hygiene. Insurance can provide organizations with incentives to adopt crucial cybersecurity best practices through premium discounts, co-insurance, retention agreements, and coverage limits (for example, investing in state-of-the-art backup systems, endpoint and anti-virus protection, implementing the latest software patches, and security awareness training for all employees). All of these should work to lower rather than raise the likelihood of encountering ransomware attacks.
Insurers are providing more and more pre- and post-incident services to assist policyholders in thwarting, minimizing, and responding to cyberattacks. These services support ransomware victims in addition to the traditional loss indemnification function of cyber insurance by covering expenses for data restoration or decryption and paying businesses for revenue lost due to business interruption or system failure.
Pre-incident guidance
When a company applies for cyber insurance, the underwriting procedure frequently reveals gaps in its cybersecurity posture and offers advice for bolstering its cyber resilience. Some carriers can continuously observe information about the networks of their policyholders and applicants (directly or through partnerships with cybersecurity experts), alerting the insured to any potential security flaws. Those problems can be resolved in many instances, allowing businesses to prevent or lessen an attack.
Several insurers also provide goods and services to help policyholders prevent and/or prepare for a ransomware event, such as employee training and testing, vulnerability scans, incident preparedness drills, and consultations with attorneys and loss prevention/security experts. These related services are becoming more and more necessary for cyber insurance solutions. According to a recent survey, 62% of CEOs think network security tools, such as firewalls, should always be provided as part of cyber insurance.
Post-incident support
External experts who are frequently hired to respond to a ransomware attack, such as legal counsel, forensic investigators, and ransomware negotiators, typically charge fees covered by cyber insurance policies. Although insurers have established connections with these specialists and can connect a policyholder with the appropriate vendor right away, which is crucial in a crisis, the vendor will forge a relationship with the policyholder and become that person’s client, not the insurer.
Insurance can positively impact cyber hygiene standards and best practices by raising awareness of the risk of being a victim of ransomware and other cybercrime, exchanging knowledge on risk management, and encouraging investment in risk prevention and mitigation. Simply put, it can increase society’s overall cyber resilience to ensure that the full network benefits of digitalization can be realized and are not compromised by the corresponding rise in cyber hazards.
