Written by RPS Wholesalers
If there's any term that strikes fear in the hearts of risk managers and many brokers alike, it's cyber. Not only is the landscape of cyber risk evolving and changing by the day, but comprehensive coverage against cyberattacks, ransomware, and other threats has gone from a nice-to-have add-on to a foundational part of enterprise risk management.
These threats are everywhere, and they're growing.
According to Accenture, the volume of cyber intrusion activity globally jumped 125%in the first half of 2021, compared with the same period in 2020. The largest malware category observed by volume was ransomware, at 38%. Ironically, the industry targeted most often by ransomware operators was insurance at 23%, followed by consumer goods and services (17%) and telecommunications (16%).
Sophos' State of Ransomware 2021 report notes that the average cost of remediating a ransomware attack — which includes business downtime, lost orders and operational costs — more than doubled in a year. It grew from $761,106 in 2020 to $1.85 million in 2021.
Would your clients' cyber coverage be able to handle that? Are you sure?
The Growing Cost of Cyber Attacks
The result of the increase in ransomware attacks is that insurers are now taking a second look at what they include for cyber coverage in their policies. Many are increasing their prices while simultaneously decreasing coverage. Numerous insurers are declining to take new clients or are capping coverage amounts at about half of what they used to be for some clients.
In the first quarter of 2021, U.S. cyber insurance premiums rose an average of 18%, according to data from the Council of Insurance Agents & Brokers. The pandemic has driven up insurance premiums across multiple categories, but the increase is most seen in cyber insurance due to the significant rise of ransomware attacks.
Ransom payments only started being included in cyber insurance policies in 2015, with little to no risk associated with them. Now just six years later, ransomware attacks are the main attraction. Ransomware attacks were responsible for the growth in U.S. cyber insurance claims in 2020. This year, they account for 75% of all cyber claims.
How to Get Higher Cyber Insurance Limits
Ransomware has had a significant impact on cyber insurance pricing, capacity, and underwriting. But despite all of this, the reality is that most companies need some form of cyber insurance to defend against these multiple risks.
Deloitte conducted informal research among leading cyber insurance providers and found that policyholders can face a 200% increase in premiums for the same coverage or possibly even be denied coverage until strict conditions are met following a cyber incident.
You can take steps to make your clients more attractive as insureds — before they fall victim — and achieve higher coverage limits. Here are some best practices to follow:
Install multi-factor authentication (MFA): MFA is among the must-haves for cyber coverage because it's one of the most effective cyber security measures you can take to prevent attacks. According to RPS's US. Cyber Market Outlook, nearly all cyber insurance providers added MFA as an underwriting requirement in 2021. Yet research suggests that 70% of organizations6 still rely on a password-centric authentication approach. Having MFA keeps attackers out of your accounts and denies access to secure information. It also gives a heads-up to IT when there are unauthorized login attempts so that they can go on the defensive.
Maintain an incident response plan: Over 55% of organizations want to improve time to containment and incident response automation, but more than 45% state inadequate detection and response resources. It's important to regularly review your incident response plan and make updates and changes aligned with the latest external threats and any new internal developments at your company or with its vendors. Conduct intermittent incident response drills and adjust your plan accordingly. It's better to learn about issues during testing than during the real thing.
Hold ongoing employee education and training: Human error is a major contributing factor to cyber attacks. After the NotPetya cyber strike, Mondelez instituted new security awareness initiatives to promote cyber hygiene best practices in its offices and production plants. The program uses video-based lessons on topics such as phishing, data leaks, Microsoft Office security and Zoom bombing. The Mondelez IT team follows up with phishing simulations and assessment questions to see if the lessons are retained. Advise your clients to set up employee cyber training to help combat human error and prevent future attacks.
Cyber threats have been around for years, but as the COVID-19 pandemic continues to have a ripple effect on the trend toward increased remote work and digital-centric operations, bad actors are increasingly able to disrupt massive multinational organizations. The stakes are higher, the risks are spiraling, and the associated costs aren't going away anytime soon. To best combat this threat, it's on corporations and their insurance brokers to do everything they can to ensure that they're covered in the case of a ransomware attack or other cyber intrusion. Because often, clients never know they're at risk until it's too late.
Sources:
https://www.rpsins.com/learn/2022/aug/how-to-get-higher-cyber-limits-when-you-need-them-the-most/?utm_source=emailblast&utm_medium=email&utm_id=RPS_2022_Cyber_Lead_Gen_Email_5&j=58523&sfmc_sub=7541718&l=14_HTML&u=651011&mid=110006091&jb=52
