What is your cyber insurance really worth?
Apr 17th, 2021 by Jesper Kråkhede
With all the ransomware this spring, many managers have asked me about cyber insurance. Is it worth it?
My honest answer is: Read the policy before you decide, because the problem is often that it demands a lot and covers little.
To get insured you have to fill in a long questionnaire about your security. Do you have a second factor on remote access? Do you have offline backups? Is everything patched? Do you have an incident response plan? That is good in itself, it forces you to look at your security. But if the answers turn out to be wrong after an incident, the insurer may refuse to pay.
Then look at what is actually covered. Many policies have limits that are low compared to the real cost of a large incident. Some exclude certain types of attacks, for example those attributed to a nation state. And the premiums are going up fast as the insurers lose money on ransomware.
So for management: Cyber insurance can be a useful part of your risk management, especially to get access to incident response help quickly. But it doesn´t replace security, and it will not cover the full cost of a bad incident.
The best way to lower your premium is the same as the best way to avoid needing it.
Insurance pays for the damage. Security prevents it.