Legacy Digest

What is Cyber Insurance and Why Do You Need It?

If you own a business, you have probably wondered whether you need to look into obtaining cyber insurance to help protect yourself against the many threats faced by bad actors. Recent news stories have detailed large losses to big businesses from a variety of cyber threats, and we have all seen an increase in phishing emails and other attempted attacks on our businesses.

So how do you protect against the damage caused by cyber attacks? It can seem overwhelming at first, but at Legacy Partners, our goal is to help businessowners understand their insurance so they know what risks they face and how insurance can help protect against those risks. One of the most important and overlooked coverages available today is Cyber Insurance. Here’s a detailed look at this type of insurance coverage and why it’s so important for businesses to have it.

Understanding Cyber Insurance

What Is Cyber Insurance?

Almost every business has some exposure to the internet and thus exposure to potential cyber attack. Your business systems, including your email, website, servers, and even individual computers can be compromised by bad actors seeking to profit in a number of different potential ways. Cyber insurance is a unique product carriers created to help businesses secure against the risk posed by the wide variety of cyber attacks that are regularly experienced by businesses.

What Types Of Exposures Can Cyber Insurance Cover?

Cyber Insurance can be extremely difficult to understand just because the number of different types of cyber exposures is so high. Cyber criminals do a wide variety of things, and you should look at your cyber policy to make sure that the biggest exposures are covered.

For most businesses, the biggest potential exposures are:

• Social Engineering Fraud: Social Engineering Fraud is one of the most common types of cyber attacks. Bad actors often compromise a company through a phishing scheme, learn about the organization, and then trick your business into sending money somewhere it shouldn’t be sent. Often this is done by impersonating an executive, a vendor, or a bank, and sending you fake invoices or revised payment instructions. The hackers get your employees to redirect funds from your account so that the fraudsters receive the payment instead of the intended recipient.
• Wire Transfer Fraud: Hackers can compromise your systems and then directly take control over your money by authenticating themselves as a member of your company, and then directly sending the funds out themselves. These attacks are simple, but often times a significant sum can be wired out of a company before they even realize it is gone.
• Ransomware and Cyber Extortion: Another very common type of attack involves taking over your organization’s data, locking you out of your systems, and then demanding you pay a large ransom. If you do pay the ransom, they may say that they will release the data back to you, or threaten to release the data to the public if you don’t pay, creating even more headaches for your company.
• Data Breach: Government regulations often require a complex series of steps when a hacker is able to breach your network and gain access to customer data. The costs for the required forensic investigations, additional legal counsel, and victim notification and remediation, not to mention the associated liability, can quickly add up to a huge amount of money.

Isn’t This Covered By A General Liability Policy?

If you already have a general liability policy in place, you may think that you are covered for the risk of loss from cyber exposure, but the reality is that most general liability policies specifically exclude any exposure to a cyber risk. We can help you check the specific language of your policy to be certain, but for most people this coverage will need to be acquired separately outside of a general liability policy.

Some insurance carriers do include a small amount of cyber liability coverage as an extension to their standard commercial package policies, but if you dig into the details, the coverage here is very limited. Typically, this might be around $50,000 maximum of coverage.

It probably only covers third-party costs, and not your own expenses. And worse, it likely excludes some of the biggest potential risks like ransomware and computer and funds transferred fraud. If you don’t have the right coverage, you could be left facing the extreme consequences of a cyber attack on your own.

How Much Cyber Insurance Do You Need?

Risk Factors Of Your Business Help Dictate What Coverages May Be Sufficient

There is no one-sized fits all answer to the question of how much cyber insurance your organization might need, and an independent consultation with one of our experts at Legacy Partners is crucial to help answer this question. Ultimately, the analysis comes down to looking at the risk factors your business faces.

• Technology and security practices: Hackers have easy access to tools that can defeat old, outdated, and vulnerable technology, so you should review your company technology and security practices to make sure you meet industry best practices like frequent patching of software and phishing training for your employees.
• Historical Breaches and Available Credentials: Hackers don’t need to re-invent the wheel, so they may also target a business if they discover breached employee credentials. For this reason, businesses are encouraged to require multi-factor authentication (MFA), impose rules against password sharing, and require regular password changes, to help secure accounts.
• Information Held By Your Company: To some extent, the exposure you face depends on what is in your data. If you have large amounts of sensitive data like credit card data, or even personally identifiable information (PII) or personal health information (PHI) this can create significant exposure.

If you’re uncertain about the strength of your network security, cyber insurance companies can often provide you with reports showing issues from their scanning software, such as known intrusions, credentials available on the dark web, or open ports that could be exploited by bad actors. This can help you shore up your network from future problems.

Best security practices will help you limit the risk of a cyber attack, and they will also help limit the cost of cyber insurance, but ultimately you should carefully evaluate the extent of your exposure if your network is breached and determine how much insurance to carry based on that level of exposure.

The Most Common Objections To Cyber Insurance And Why They Are Wrong

I’m Too Small To Be A Target

We often hear from business owners that believe they are to small of an operation to be a target for cyber criminals. In fact, the opposite is true. While most of what you hear about in the news may be attacks against large companies, most cyber attacks are actually against small businesses, not large ones. This is because small businesses tend to have weaker cyber security controls, and they are often easier to infiltrate.

My Cyber Security Company Protects Me From Cyber Threats

Some businesses already spend large amounts of money on cyber security assistance from third-parties or even in-house teams, and mistakenly believe this replaces the need for insurance. While cyber security tools are great, the tools are not foolproof. Likewise, because of the human element, there’s really no company that’s invincible to cyber attack no matter how much you spend on cyber security controls.

I Don’t Use Any Technology OR Our Data Is Stored With Another Company

Even if you don’t have a website, and don’t maintain any electronic customer data, you may be vulnerable to cyber crime. Email is often exploited with cyber attacks that can lead to direct funds transfer fraud out of your accounts. And even if you store all your data with a third party, you could still be liable for a breach of their system, so you should still consider insuring against that risk.

Cyber Insurance Costs Too Much

Small businesses looking to save money often think that the cost of a cyber insurance policy is not worth it. However, in light of the potential consequences, this objection is difficult to sustain. Recent research places the average cost of a data breach to small businesses between $120,000 and $1,200,000 depending on the type of business and the extent of the breach. The reality is that you may not be able afford not to carry it, because the out-of-pocket cost of a loss could bankrupt your company.

Conclusion

Cyber insurance coverage is extremely important for almost every business in today’s world. Threats from bad actors seem to be increasing daily with no signs of slowing down. While technology upgrades and monitoring services can be beneficial to prevent attacks, there is no foolproof technology, and cyber insurance is still an important tool to make sure that you are protected if something goes wrong.

For personalized advice and comprehensive coverage options, contact Legacy Partners Insurance. As an independent agency serving all Michiganders and companies across the country, our licensed professionals are ready to assist you with all your insurance needs. Call us today to ensure your business is properly protected.