Cyber insurance

Cyber insurance (also known as cyber liability insurance or cyber security insurance) is designed to protect businesses against the financial loss resulting from a range of cyber threats and exposures, including cybercrime, data breaches and system interruption.

Cyber insurance is important because as businesses increasingly use technology to operate, the digital assets they hold - like important business data, corporate information and client records - are becoming more valuable and more vulnerable.

Cyber insurance primarily protects businesses against business interruption losses caused by cyber events, cybercrime, and privacy breaches.

Business interruption losses are most often caused by ransomware and targeted extortion attacks. These attacks are not only frequent but can be incredibly expensive. In recent years, the sophistication of these attacks has made it more difficult to recover files, which can lead to extended system downtime, loss of profits, and reputational harm.

Types of cybercrime that are covered under a cyber insurance policy range from Distributed Denial of Service (DDoS) attacks to corporate identity theft. Funds transfer fraud, however, is the most common type of cybercrime our claims team sees. This scam involves fraudsters stealing login credentials, accessing company systems, and rerouting wire transfer payments into fraudulent accounts.

Privacy breaches are also addressed under cyber insurance policies. If sensitive data is lost or stolen, businesses will need to notify affected individuals and regulators depending on their jurisdiction, in some cases provide follow up services like credit monitoring.

In short, it depends. The price of cyber insurance varies according to business size and industry.

Certain industries are targeted more by cybercriminals due to the amount and type of data they hold, or simply because taking out their systems would render them inoperative. Those in the healthcare industry, for example, have a larger exposure due to the volume of records they hold. 

While it might vary depending on the business, cyber insurance has proven to be a very cost-effective way to transfer cyber risk. Sitting alongside good cybersecurity practices, cyber insurance can mean the difference between a quick recovery following a cyber event and a catastrophic or business-endangering loss.

Any business that uses technology in order to operate – whether they store data online, make or receive wire transfer payments, or use software in their day-to-day operations – has a need for cyber insurance. 

It's fair to say that these days, this includes almost every business in every industry. 

Cyber insurance has a long reputation as a privacy liability product for businesses that hold sensitive data – but privacy exposure isn’t the only risk facing businesses today.

In fact, cybercriminals are increasingly targeting traditional industries that hold almost no sensitive data at all, whether through ransomware attacks that halt operations or business email compromise scams that result in wiring payments to fraudulent accounts.

Our cyber insurance policy contains a range of first party coverages – for losses that the policyholder experiences themselves – as well as third party coverages – for losses that a third party experiences but which the policyholder might be responsible for.

With nearly all cyber insurance claims stemming from financial losses experienced by the business directly – such as ransomware and funds transfer fraud – three of the main sections of our policy are for first party coverages.

These include:

• Incident response, which picks up the costs associated with responding to a cyber incident such as forensic investigations and legal advice
• System damage and business interruption, which helps keep businesses up and running by covering the costs of data being restored and reimbursing loss of profits caused by the downtime
• Cybercrime, which covers the financial losses associated with a range of digital crimes like social engineering, extortion, cryptojacking and more.

Network security and privacy liability, our major third party insuring clause, covers things like the transmission of harmful malware to a third party’s systems or failing to prevent an individual’s data from being breached.