Tag Archive for: Cyber Insurance

Cyber Insurance Isn’t Enough Anymore

The cyber insurance world has changed dramatically.

Premiums have risen significantly, and insurers are placing more limits on covered items. Industries like healthcare, retail, and government, where exposure is high, have been hit hard. Many organizations have seen huge rate increases for substantially less coverage than in the past. Others have seen their policies canceled or been unable to renew.

In many cases, insurers are offering half the coverage amounts at a higher cost. For example, some insurers that had previously issued $5 million liability policies have now reduced amounts to $1 million to $3 million while raising rates. Even with reduced coverage, some policy rates have risen by as much as 300%.

At the same time, insurers are leaving the field. Big payoffs in small risk pools can devastate profitability for insurers. Many insurers are reaching the break-even point where a single covered loss can wipe out years of profits. In fact, several major insurance companies have stopped issuing new cybersecurity insurance policies altogether.

This is in part to incidents like the recent Merck legal victory forcing a $1.4B payout due to the NotPetya’s malware attack. According to Fitch Ratings, more than 8,100 cyber insurance claims were paid out in 2021, the third straight year that claims increased by at least 100%. Payments from claims jumped 200% annually in 2019, 2020, and 2021 as well.

Claims are also being denied at higher rates. With such large amounts at stake, insurers are looking more closely at an organization’s policies and requiring proof that the organization is taking the right steps to protect itself. Companies need to be thinking about better ways to manage more of the cyber risks themselves. Cyber insurance isn’t enough anymore.

Dealing with Ransomware

At the heart of all of this drama is ransomware. The State of Ransomware 2022 report from Sophos includes some sobering statistics.

Ransomware attacks nearly doubled in 2021 vs. 2020, and ransom payments are higher as cybercriminals are demanding more money. In 2020, only 4% of organizations paid more than $1 million in ransoms. In 2021, that number jumped to 11%. The average ransomware paid by organizations in significant ransomware attacks grew by 500% last year to $812,360.

More companies are paying the ransom as well. Nearly half (46%) of companies hit by ransomware chose to pay despite FBI warnings not to do so. The FBI says paying ransoms encourages threat actors to target even more victims.

Even with cyber insurance, it can take months to fully recover from a ransomware attack and cause significant damage to a company’s reputation. Eighty-six percent (86%) of companies in the Sophos study said they lost business and revenue because of an attack. While 98% of cyber insurance claims were paid out, only four out of ten companies saw all of their costs paid.

There’s some evidence that cybercriminals are actively targeting organizations that have cyber insurance specifically because companies are more likely to pay. This has led to higher ransom demands, contributing to the cyber insurance crisis. At the same time, there’s been a significant increase in how cybercriminals are exacting payments.

Ransomware attackers are now often requiring two payments. The first is for providing the decryption key to unlock encrypted data. A demand for a separate payment is made to avoid releasing the data itself publicly. Threat actors are also hitting the same organizations more than once. When they know they’ll get paid, they often increase efforts to attack a company a second or third time until they lock down their security.

Protecting Yourself from Ransomware Attacks

Organizations must deploy strict guidelines and protocols for security and follow them to protect themselves. Even one small slip-up in following procedures can result in millions or even billions of dollars in losses and denied claims.

People, Processes, Tech, and Monitoring

The root cause of most breaches and ransomware attacks is a breakdown in processes, allowing an attack vector to be exploited. This breakdown often occurs because there is a lack of controls or adherence to these controls by the people using the network.

Whether organizations decide to pay the price for cyber insurance or not, they need to take proactive steps to ensure they have the right policies in place, have robust processes for managing control, and train their team members on how to protect organizational assets.

Organizations also need a skilled cybersecurity workforce to deploy and maintain protection along with the right tech tools.

Even with all of this in place, strong cybersecurity demands continuous monitoring and testing. Networks are rarely stable. New devices and endpoints are added constantly. New software, cloud services, and third-party solutions are deployed. With such fluidity, it’s important to continually identify potential security gaps and take proactive measures to harden your systems.

Identifying Potential Vulnerabilities

One of the first steps is understanding your entire network environment and potential vulnerabilities. For example, RedSeal’s cloud cybersecurity solution can create a real-time visualization of your network and continuously monitor your production environment and traffic. This provides a clear understanding of how data flows through your network to create a cyber risk model.

Users get a Digital Resilience Score which can be used to demonstrate their network’s security posture to cyber insurance providers.

This also helps organizations identify risk factors and compromised devices. Also, RedSeal provides a way to trace access throughout an entire network showing where an attacker can go once inside a network. This helps identify places where better segmentation is required to prevent unauthorized lateral movement.

In case an attack occurs, RedSeal accelerates incident responses by providing a more complete road map for containment.

Cyber Insurance Is Not Enough to Protect Your Bottom Line

With escalating activity and larger demands, cyber insurance is only likely to get more expensive and harder to get. Companies will also have to offer more proof about their security practices to be successful in filing claims or risk having claims denied.

For more information about how we can help you protect your network and mitigate the risks of successful cyber-attacks, contact RedSeal today.

How Can Firms Avoid A Claims Showdown With Their Cyber Insurer?

Finance Derivative | May 8, 2019

By RedSeal CTO Dr. Mike Lloyd

How can you tell that cyber insurance is a hot topic today? When lawyers find the amounts of money involved worth fighting over. Major cases are emerging of serious disputes between multi-nationals and the companies they’ve taken out policies with to help mitigate their risk exposure. On the one hand, this is partly to be expected of such a nascent sector. Yet it may also be a sign of a deeper problem: a lack of visibility into which security controls and policies actually reduce risk and therefore need to be mandated as part of a policy.

The next shift in cyber insurance that brokers need to track in 2019

Insurance Business America  | January 16, 2019

Ground-shaking earthquakes might topple buildings and displace communities, but they also bear some resemblance to the scale of cyber incidents witnessed in the past year that crippled networks and exposed consumer data, according to one cyber expert.

Big Companies Have An Achilles Heel

Cybersecurity Intelligence| September 10, 2018

“From a cybersecurity perspective, when you’re an insurance company and you’re writing a policy for somebody, how do you charge them for it? We measure the risk and give them the metrics to charge for that policy,” said Steve Timmerman, VP of marketing and business development at RedSeal, which offers enterprise software that builds a model of a company’s network, identifies vulnerabilities, and provides a digital resiliency score that allows insurers to write a cyber premium based on that score.

Revealed: The cyber Achilles heel for large companies

Corporate Risk and Compliance | August 28, 2018

While a new survey from analytics firm FICO has found that the number of US companies with full-coverage cybersecurity insurance has skyrocketed from last year, 24% still reported that they did not have any cyber insurance. For those that remain uninsured, and the insurance companies with an eye on targeting these firms, a cybersecurity analytics platform has come up with a more effective way to price policies.

“From a cybersecurity perspective, when you’re an insurance company and you’re writing a policy for somebody, how do you charge them for it? We measure the risk and give them the metrics to charge for that policy,” said Steve Timmerman, VP of marketing and business development at RedSeal, which offers enterprise software that builds a model of a company’s network, identifies vulnerabilities, and provides a digital resiliency score that allows insurers to write a cyber premium based on that score.

Warren Buffett’s Take On Cyber Insurance

Warren Buffett recently made clear how risk-averse his business is when it comes to cyber insurance. Addressing his annual shareholder meeting, he summarized the state of play like this: “I think anybody that tells you now they think they know in some actuarial way either what [the] general experience is like in the future, or what the worst case can be, is kidding themselves”.

These are wise words, from a famously far-sighted individual. However, the question is: What are we going to do about this? Certainly, at RedSeal, we do not think this is acceptable. Businesses rely on insurance providers for several critical things. It starts with the basic concept of insurance: you hand your premiums over to an insurer so that you’ll get some protection against the financial downsides of hard-to-predict and catastrophic events. But the relationships between insurers and those who buy insurance has a symbiotic, mutually beneficial aspect to it as well (as Warren Buffett knows). The two groups aren’t adversaries (despite the frictions that result when it’s time to pay up); they have the same long-term interest in reducing the cost and number of catastrophic events. Think of the way our car safety has improved over the last few decades. Some of that improvement was driven by government regulation, but more of it is a result of insurers offering price breaks for things like raised, central brake lights, or ABS, or alarm systems. Insurers investigate accidents in detail, and have learned which car features cause or prevent accidents. When they price that knowledge into their products, they motivate car buyers, who in turn motivate car makers. You might think car makers should just know what makes cars safer, but they don’t really know how people will behave behind the wheel or how much safety people are willing to buy. The process works well over the long haul because of insurance companies’ critical role in gathering data, quantifying cost/benefit, and pricing that into policies that people can understand.

So how do we make this work for cyber insurance? Today, the market for cyber insurance is growing rapidly. Companies want the product, insurers are selling large numbers of policies, and there is still more demand than insurers can comfortably supply. The main thing holding insurers back is the ability to correlate good or bad security behavior against real incident rates. We’re close – the security industry knows a lot about good security, in much the same way that car makers know how to make a car safer, but they aren’t sure about the cost/benefit for any given action. This means we’re spring loaded – there’s market demand, there’s a lot of knowledge about security, but the last critical ingredient is the ability for actuaries at insurance companies to compute the hard-quantified payoffs (change in “Annualized Loss Expectancy” would be the technical term).

This is why RedSeal is working with XL Catlin on innovative ways to measure the cyber practices of companies buying insurance. It’s an exciting time – something we don’t get to say often about the insurance business!

XL Catlin and RedSeal Launch Cyber Insurance Industry’s First Dynamic Measure of Resilience to Gauge Risk, Improve Cybersecurity and Insurance Terms

Advisen | May 14, 2018 

XL Catlin (xlcatlin.com) and RedSeal (redseal.net) announced a new, dynamic approach to cyber insurance, which uses an objective measurement of a network’s resilience to help underwriters more thoroughly evaluate their clients’ risks over time, helps clients continue to improve their cybersecurity and potentially improve their insurance terms.

Cyber-Insurance Can Reshape the Way Organisations Do Security for the Better

Information Age| May 8, 2018 

With Dr. Mike Lloyd, RedSeal CTO

With experts now agreed it’s not a case of “if” but “when” your organisation suffers a major breach or outage, the expanding cyber-insurance industry offers a vital way to protect against losses.

Breaking the Log Jam – Data for Informed Cyber-Insurance

SC Magazine UK| May 2, 2018 

Feat. Dr. Mike Lloyd, RedSeal CTO

The problem of cyber-insurance is lack of data for understanding risk: but third party technologies can measure and quantify the defensive state and breach risk of each organisation by using standardised, repeatable yardsticks.

Cyber-security is approaching an inflection point, where several major forces are combining to produce a much-needed breakthrough.  The reason why: cyber-insurance.

XL Catlin and RedSeal team up for cyber risk resilience tool

Insurance Business UK | April 2, 2018

XL Catlin and cybersecurity specialist RedSeal have teamed up to create a tool to measure a network’s resilience against cyber risks.

According to a statement by the firms, the tool will help underwriters assess their client’s cyber exposures and help them improve their cybersecurity and benefit from better insurance terms.