Backing up the backups: cyber insurance in a hardening market

Key trends in the cyber insurance market and how your business should respond 6 min read

This is the first instalment of our Cyber Insurance Handbook Series. 

The proliferation of cyber extortion and ransomware, together with the threat of state-sponsored, state-sanctioned and spill-over cyberattacks, has intensified an already heightened global cyber threat environment. Increased regulatory scrutiny and enforcement action, including in Australia, is also contributing to the steadily rising cost of cyber risk management and cyber incident response.

These developments have put additional pressure on insurers in an already hardening cyber insurance market, with insurers continuing to narrow the scope of available cover.¹

How much does a cyber incident cost?

IBM's recently released annual 'Cost of a Data Breach' report conducted by the Ponemon Institute found that the global average cost of a data breach in 2022 totalled US$4.35 million (in the US, it is even higher at US$9.44 million). For a ransomware attack, the global average cost is US $4.54 million, excluding the cost of any ransom.²

Cyber incidents cost many organisations orders of magnitude more than that. For example, T-Mobile will pay US$350 million to settle class action claims arising from a cyberattack, and has committed to an incremental spend of US$150 million for data security and related technology in the next two years.³

In Australia, self-reported losses from cybercrime totalled more than $33 billion in the 2020-21 financial year.⁴ Measurable costs are often only the 'tip of the iceberg' of total losses and reputational damage, which can persist long after the initial compromise.

The rising costs of cyber incidents mean it is becoming more common for companies in Australia to consider cyber insurance as an important (but not exclusive) aspect of their risk management 'toolkit'.

Take-up rates are increasing, with Marsh reporting a 23% increase in organisations purchasing cyber insurance last year. However, overall rates are still low compared to more traditional forms of commercial property and liability insurance.⁵ This gap is most acute for small to medium-sized enterprises, which are less likely to take out insurance or may only be able to procure a relatively low level of coverage. Currently in Australia, only about 20% of SMEs and 35–70% of larger businesses have standalone cyber insurance.⁶

How is the insurance market responding to heightened cyber risk?

The market for coverage against cyberattack losses is now a significant class in its own right.⁷

However, as Lloyd's of London has recently observed—in a word of caution to the market—cyber risks have the potential to expose insurers to systemic risks that they (and their reinsurers) may struggle to meet. This distinguishes cyber cover from the usual categories of insurance where, putting the COVID-19 pandemic to one side, losses can generally be relied upon to occur in one location at a time. By contrast, the potential losses associated with the possibility of a global cyber incident have the potential to greatly exceed what the insurance market is able to absorb.

The cyber insurance market continues to 'harden' in response to these risks. Specifically, insurers are taking the following steps to mitigate this exposure:

• Increasingly limiting, clarifying or excluding certain losses from cover – Having previously tightened cover on ransomware incidents, insurers are now focusing on war exclusions.
• Being prepared to walk away – Insurers are prepared to see their policy book decline (even at the expense of market share) if it means safeguarding their position, and are broadly agnostic to policyholders failing to renew in light of increasing premiums and restrictions.
• Raising premiums – Brokers continue to report an ongoing trend of steep, year-on-year price increases. Marsh reports that the cost of taking out cyber cover has doubled on average each year for the past three years.⁸
• Heightening risk management expectations – As a precondition to writing or renewing cover, or as a key determinant in setting companies' policy premiums, insurers are increasingly requiring evidence of cyber hygiene and risk management culture. This includes:
  • examining, in detail, information about organisations' cyber strategy, governance arrangements, IT security spend, the volume and type of data held, the security controls applied to protect information assets and reliance on shadow IT;
  • investigating third party arrangements, cyber-awareness culture, testing regimes, details of any prior data breaches, how prepared organisations are to respond to a cyber event and whether they have run any war-gaming exercises to stress test their arrangements; and
  • focusing on executive level sponsorship of cyber security and resilience, including by making regular tabletop scenarios that include senior management participation a condition of coverage.

Without this, some businesses will not even be considered for cover.⁹

This trend is evident across all industry sectors in Australia. It means all organisations (including professional and financial services, healthcare, manufacturing, government, logistics and SMEs) should take note of the below steps.

What should you do to ensure insurance is an effective component of your cyber risk management?