Cyber Insurance policies tightening. Payouts declining. Time to renew your defensive strategy

As reported in IT News, insurers around the world are reducing the amount they are prepared to pay out on new cyber insurance policies.  This follows on from a rising trend of successful ransomware attacks during the pandemic and the increase in working from home that many businesses have seen.  Affected business have essentially outsourced their risk to the underwriters of their policies in return for their premium.  The unintended effect has been to allow policyholders to maintain a lower defensive state than might otherwise have been the case.

A Cyber insurance policy is paid out to the policy owner when an attack or breach is executed by an external party or a malicious insider.  It can cover damage caused or, in some cases, a ransom paid to get back files.  

But unlike many kinds of insurance, the perpetrator of a system attack might also be the eventual beneficiary.

Panel beaters don’t go around smashing cars, expecting to get the follow-up work.  And builders don’t go around torching buildings so they can get the insurance payout and grow their businesses.

But malicious actors go looking for trouble, knowing there is a kind of insurance built to make their efforts easier to bear for their primary victim and thus, increase the likelihood of receiving a reward.  And there is increasing evidence that they are targeting their efforts towards those that are cyber-insured, expecting to be more successful at charging a high payout figure in return for their efforts.

But of course, the insurance industry is fluid.  And insurers are responding to market conditions.

The net result is: premiums going up, payouts going down, business not covered for the full impact of a successful attack.  Insurance companies have adjusted what they are prepared to stomach in terms of risk and have reduced their exposure across the board, according to IT News.

According to Reuters, some are even asking some clients to foot half the bill in a payout situation, to share the financial pain with their clients and force them to tighten their defensive posture, according to a technology insurer quoted by Reuters. 

So, in a situation where the risk of a painful consequence for a successful attack is increasing for policy seekers, what is the natural next step?

Harden your defences

With the pain of a successful attack increasing, it makes sense to reduce its likelihood.  You can do that by first reviewing your security posture and second, closing identified gaps.

Computer One can help with the first part.  An IT security review.  It’s a comprehensive review of your network, endpoints, cloud, mobile and policy attack surfaces.  We review your current defences against all common attack vectors: email, applications, direct physical attack, procedural exposure and more.  We will identify security gaps and interpret the likelihood of compromise and what’s at risk in relation to each vulnerability, to help prioritise your response.

Once identified, we can help you close the gaps.

Some of the tools we use to harden your security profile are:

Continuous Vulnerability Scanning.  Continuous checking of newly discovered vulnerabilities in thousands of applications against your particular software set.

Fortinet products.  A leader in the space, Fortinet is a well-established security vendor with a comprehensive suite of security hardware and virtual devices.

Crowdstrike.  Lightweight and “network aware” the CrowdStrike family of products detect very sneaky threats operating at low levels on your systems.

Application Whitelisting. Still number one in the Australian Cyber Security Centre’s Essential Eight mitigations strategies, Application whitelisting prevents unauthorised software from running on your network.

The Microsoft 365 suite.  Microsoft is a serious security contender, with security tools that sit at multiple levels of your organisation part of its Business Premium suite and above.  They look for threats in your inbox, they prevent unauthorised network access, guard against loss of control over files, and manage the information accessible on remote devices.  We are confident advocates for Microsoft’s contribution to the overall security profile of your organisation.

Of course, there are many more tools in our kit bag.  The way to know which is most relevant is to engage in the security review.

The Final Word: Lowering insurance payouts and attempting to share the pain of compromise is a natural step for the world’s risk managers.  You have the option of paying a higher premium for lesser insurance, or redirecting some of your spend towards a security investigation and steps to reduce the risk of compromise. 

Each action reduces the risk of pain, but making yourself a smaller target is far more preferable to dealing with the consequence of a breached network and the loss of reputation that may accompany it.