'A ticking time bomb': limitations in cyber cover for known vulnerabilities and end-of-life hardware

Monitoring your systems and addressing vulnerabilities may be essential to preserving insurance coverage 8 min read

Insurers heavily scrutinise organisations' ability to prevent, anticipate and withstand cyber-attacks when deciding whether or not to offer cyber insurance. In line with this trend, insurers increasingly refuse or limit cover for incidents where known vulnerabilities in organisations' systems are exploited.

'Known-vulnerability clauses' in cyber insurance policies require vigilance in maintaining appropriate security arrangements and in closing areas of weakness to preserve insurance cover.

This Insight explains:

• what known vulnerabilities are;
• the approach commonly adopted by insurers in relation to known vulnerabilities; and
• what you can do to mitigate the risk of triggering these conditions in your cyber policy wording.

This is the fourth instalment in our Cyber Insurance Handbook Series. See our first, second and third instalments.

What are 'known vulnerabilities' and how do they arise?

In general terms, a vulnerability is a flaw or weakness in a piece of software or hardware infrastructure that can be exploited to undermine the confidentiality, integrity or availability of affected components. If we break this down further:

•  a zero day vulnerability is a flaw or weakness in software or hardware that has not yet been discovered by the developers or made public, and for which a patch has not been developed. The name comes from the fact that the company has had 'zero days' to respond and push out a patch to protect users; and 
• a known vulnerability is a vulnerability that has been publicly reported.

Organisations should be alert to known vulnerabilities, particularly when using:

• open source software – code designed to be publicly accessible, which anyone can see, modify and distribute;
• end-of-life/end-of-support software/hardware – software or hardware no longer supported by the vendor or receiving periodic security updates; or
• internet facing/accessible software – software solutions made available via the internet (and not only accessible through a secured corporate network).

When vulnerabilities are discovered, the software or hardware provider or vendor will typically develop and release a 'patch' or firmware update to fix or help mitigate the issue. Before this occurs, however, threat actors can seek to exploit the vulnerability to obtain unauthorised access to systems.

The Common Vulnerabilities and Exposures (CVE) List is the market-leading register of known vulnerabilities curated by the US National Cybersecurity Federally Funded Research and Development Centre.¹ The CVE List is often referenced within the cybersecurity community, and referred to in cyber insurance policy wordings.

What are the risks of known vulnerabilities?

The risks of failing to patch software or continuing to use end-of-life software or hardware are well known. They were flagged by the Five Eyes in their 2021 Joint Cyber Advisory Report,² and more recently by the European Union.³ Notwithstanding this publicity, the dangers of known vulnerabilities continue to evolve. This includes threat actors seeking to leverage third-party vendors and technology to penetrate their ultimate target, leading to a surge in software supply chain attacks and the compromise of open source libraries and tools. For example:

How have insurers responded to the phenomenon of known vulnerabilities?

Insurers have heightened their risk management expectations

As a precondition to writing or renewing cover or as a determinant in setting premiums, insurers increasingly require evidence of cyber hygiene and risk management. This includes a detailed examination of:

• organisations' cyber strategy, governance arrangements, IT security spend, the volume and type of data held, the security controls applied to protect information assets and reliance on shadow IT;
• third-party arrangements, cyber-awareness culture, testing regimes and details of any prior data breaches;
• the level of executive sponsorship of cyber security and resilience issues; and
• the extent of senior management's preparedness for a cyber-attack, including through real-time inspections of board-level tabletop scenarios.

Without this, some businesses will not be considered for cover.

Insurers are increasingly limiting or excluding certain losses from cover

Many market-standard cyber insurance wordings now limit the cover available for known vulnerabilities. These limitations generally apply to vulnerabilities where, prior to the first-known date of exploitation by a threat actor:

• the relevant software or hardware had been withdrawn or was no longer available, or had reached end-of-life or end-of-support status with the vendor; or
• the vulnerability was listed as a CVE and had a patch or fix available; and
• no action was taken by the policyholder for a certain period of time (commonly 30 days).

Restrictions on cover can take a number of forms, including total exclusions or sub-limits of liability. Some policies take a more nuanced approach, with a sliding scale of tightening sub-limits and increasing co-insurance payments based on the number of days it took for the insured to address the relevant vulnerability (down to as little as 5–10% of the maximum available cover for extended delays).

Importantly, these conditions are not tied to the organisation having actual knowledge of the issue

Known-vulnerability restrictions will apply if the software or hardware was no longer supported, or the vulnerability could be patched, whether or not you were aware of those developments – placing responsibility firmly on the insured.

On the other hand, in policies without known-vulnerabilities exclusions, coverage could be at risk for known matters not disclosed prior to policy renewal. This could occur in circumstances where a known vulnerability exists in an insured's software or hardware, and that fact is known to the insured and it is not disclosed to the insurer prior to entering into the policy.

How could you get caught out?

When dealing with known-vulnerability exclusions in your cyber insurance wording, your business could be caught out in two ways:

1. before the vulnerability is exploited by a threat actor; or
2. in many unfortunate cases – afterwards.

'The race against the clock': you discover, or are notified of, a vulnerability in your systems

The moment a vulnerability is discovered, businesses are open to attack. Fortunately, cyber wordings with known-vulnerabilities conditions generally allow a certain number of days from when a patch or fix becomes available before excluding or limiting cover. As such, a key priority for policyholders is implementing any software and firmware updates quickly.

While it can be hard to prioritise insurance issues in times of crisis, policyholders should also consider their notification and disclosure requirements, even in the absence of a cyber-attack. This is especially the case in the lead up to policy renewal. Policyholders should consider whether they are required to disclose any actual or suspected failures in their security systems, or otherwise, whether to notify proactively – even in the absence of the vulnerability being exploited. This scenario raises complex strategic questions, best addressed on a case-by-case basis.

'Too late': you suffer a data breach exploiting a known vulnerability or end-of-life hardware

If you think a known vulnerability has been exploited, not all may be lost. Not all cyber insurance policies contain known-vulnerability conditions, and complex causation issues can arise as to whether a known vulnerability is what caused the loss.

Further, patching or improving your systems may also be crucial to prevent subsequent attacks affecting the same vulnerability, for which cover may still be available if you act quickly.

What are the top four steps you can take now?