What is cyber insurance?

Cyber insurance is a policy that provides financial protection against losses due to cyberattacks, data breaches, and other cyber-related incidents.

Like other types of insurance, cyber policies outline the claims the insurer is legally obligated to pay the policyholder.

An important part of a comprehensive data security and management strategy, cyber insurance complements hardware and software data protection capabilities such as encryption and role-based access, phishing controls, AI and ML-powered anomaly detection, security policies, and more.

Cyber insurance is a helpful tool for organizations to protect themselves from cyber threats. Cyber insurance covers and helps organizations protect themselves from cyber threats. It has become increasingly popular since the 1990s. This is because companies are facing more regulations and risks in keeping customer data and confidential information safe.

Why is cyber insurance important?

In a world where cyberattacks such as ransomware grow in sophistication and frequency, cyber insurance can offer boards of directors and executive leadership peace of mind as a tool to help accelerate recovery. Specifically, cyber insurance can protect against financial loss, damage to reputation, and legal liabilities. It’s a way to transfer some financial risk to an insurance company and, in turn, reduce the riskiness of digital business.

The negative impact of a successful ransomware attack on a brand’s revenue, reputation, and employee productivity can be considerable—even catastrophic. According to Cybersecurity Ventures, the cost associated with cyberattacks was projected to reach $8 trillion in 2023. The firm predicts those costs will rise 15% annually over the next three years, reaching $10.5 trillion by 2025.

Recent research commissioned by Cohesity found that most businesses lack the necessary cyber resilience strategies or data security capabilities to address today’s escalating cyber threats and maintain business continuity. Because their cyber gaps are exposed, the likelihood is higher that they will be the target of a successful attack, making it more challenging to be eligible for cyber insurance.

What are the requirements for cyber insurance coverage?

Ransomware prevalence means insurance companies are increasingly paying cyber insurance policy claims. As a result, insurers are tightening guidelines, insisting organizations meet specific requirements to qualify for coverage. Despite vendor and policy differences, all insurers seek assurances that organizations have sufficiently addressed vulnerabilities by hiring security personnel and implementing proven policies, technologies, and training to combat bad actors.

Insurers typically inquire about or review the applicant’s data security measures—for example, data backup procedures and password policies— history of data breaches, and types of data collected and stored. Note that some insurance companies will only insure enterprises generating a certain level of revenue, located in specific geographies, and/or conducting certain types of business. It’s not uncommon for organizations to fall short regarding having robust internal security controls and operating a reliable backup and recovery solution to satisfy stringent requirements.

That’s why teams are looking at data security and data management solutions such as Cohesity that can help their organizations meet the criteria insurance companies require before issuing a cyber insurance policy.

What does cyber insurance cover?

Cyber insurance covers a business’s cyber liability for the loss of sensitive customer, employee, or partner information—for example, financial details, protected health information (PHI, or personally identifiable information (PII)—in the case of a data breach. Typically, such policies include coverage for both direct or first-party losses and third-party losses. The former may be for lost revenue or data recovery expenses, and the latter for hiring investigators to perform forensics or legal representation for lawsuits. Cyber insurance policies might also cover costs associated with lost income, brand damage management, and credit monitoring services for customers impacted by a data breach.

What does cyber insurance not cover?

Because intrusions can impact organizations in many ways, insurance companies do not cover all scenarios and expenses. Cyber insurance generally doesn’t cover the costs associated with preventable issues or ones caused by human error or negligence, such as weak security processes and insider attacks.

Some cyber insurance policies will pay out extortion-related ransomware attack claims. However, others won’t compensate an organization that gives funds to an attacker, even if the ransom or Some cyber insurance policies will pay out extortion-related ransomware attack claims. However, others won’t compensate an organization that gives funds to an attacker, even if the ransom or payment was made innocently, such as because a sophisticated social engineering scheme fooled an employee. Moreover, cyber insurance policies do not cover the actual or potential loss of future revenue and profits associated with ongoing damages from a successful breach. For instance, an organization might struggle to compete or even do business after a breach that leads to the loss of core intellectual property (IP). However, many cyber insurance policies won’t cover this financial damage. Cyber insurance policies increasingly feature exclusion clauses related to cyber war or nation-state-sponsored cyberattacks. For example, an insurer would not have to provide coverage if a state-sponsored group launched an attack to steal IP related to advanced weapons.

Who needs cyber insurance?

Organizations of all sizes across industries are potential targets for—and vulnerable to— cyberattacks. Retailers, financial institutions, healthcare providers, government agencies, and educational institutions are among the most targeted by ransomware because of the data they process and keep.

Cyber insurance coverage is especially important for organizations that:

• Store or process large volumes of sensitive customer, employee, or partner information
• Manage financial transactions
• Collect health information
• Power daily operations with digital technology

Is cyber insurance worth it?

Considering the rising frequency and severity of ransomware and other cyber incidents, a cyber insurance policy is not only worthwhile, it’s a must-have item in a comprehensive cybersecurity strategy. Well before an incident occurs, a cyber insurance policy can provide peace of mind by minimizing risk to the organization’s reputation and financial viability. If an attack occurs, a cyber insurance policy can soften the blow by minimizing financial damage.

Cohesity and cyber insurance

Cohesity data security solutions help organizations address key backup and recovery requirements on the applications they submit for cyber insurance. Specifically, Cohesity DataHawk empowers organizations to protect and recover from ransomware with threat protection, cyber vaulting, and ML-powered data classification.

Among the boxes Cohesity customers submitting cyber insurance policy applications can check are the following:

• Backups are kept in a separate area isolated from the production network.
• Backups are kept in a dedicated cloud backup service.
• Backups are encrypted.
• Backups are immutable.
• Backups are secured with different access credentials from other administrator credentials.
• Backups utilize MFA for both internal and external access.
• Backup integrity is tested before restoration to ensure they’re free of malware.

A range of organizations have qualified for cyber insurance policies or lowered their premiums with the help of Cohesity, including:

• Citizen Potawatomi Nation, a federally recognized tribe in Oklahoma, relies on Cohesity for ransomware protection.
• Clayton County Public Schools in Atlanta met cybersecurity insurance requirements using FortKnox, a Cohesity SaaS data isolation and recovery solution.
• Kassenärztliche Vereinigung Hessen (KVH) in the German state of Hesse significantly lowered its premiums for ransomware insurance using Cohesity immutable backups and ClamAV.

Learn more at Cohesity data security solutions.