Facing Uncertainty in Cyber Insurance Policies

Abstract

Cyber insurance has gained less ground in Europe than in the U.S., but with emerging laws and regulations, the prospect of considerable fines for security breaches is pushing many organisations into this market. A qualitative interview study in Norway reveals the main uncertainty factors for organisations that have little experience with the cyber insurance consideration process, and how they perceive the products, process and expected support in case of a cyber incident. These uncertainty factors can be reduced by being aware of typical coverage gaps, exclusions and loss types that are commonly found in cyber insurance products.

SoK: Cyber Insurance – Technical Challenges and a System Security Roadmap

“…The existence of asymmetric information also impacts negatively the customer side as insurance firms may raise premium prices due to incomplete knowledge and risk overestimation, leading to an expensive, niche, and not-appealing product [45], [46]. High premiums are also the result of insufficient criteria to reduce them: even if a company holds security certifications and profusely invests in self-protection, the effectiveness of these actions against the wide variety of cyber attacks is not clear, making, in turn, difficult to assess to what extent they are useful to reduce the overall risk [45].…”

“…Indeed, many cyber-insurance policies already bring supplemental value through the inclusion of risk mitigation, tracking and loss-prevention tools [76]. Clients, in particular small organizations that lack experience, can benefit from this continuous interaction to better ponder their measures towards higher-priority situations [46]. The post-binding phase also helps to prevent the well-known issue of moral hazard [18], [43], [77], [78] -a form of post-underwriting opportunism by the policyholder, who undertakes incautious actions knowing that, in case of incidents, there exists a counterpart who will bear the brunt and will not be able to verify the presence of negligent and fraudulent actions.…”

Enterprise IT service downtime cost and risk transfer in a supply chain

“…It thus represents the case where fixed restart costs overshadow variable outage costs. Meland et al (2017) cite data showing that response costs are on average three times as great as loss of business income. Though these categories are not exactly equivalent to fixed vs. variable costs, such data indicate that fixed, durationindependent, costs cannot be ignored.…”

The Data that Drives Cyber Insurance: A Study into the Underwriting and Claims Processes

“…Beyond those more technical aspects, there are also difficulties in understanding the decisions driving the insurance underwriting and claims processes, including those relating to security control recommendations [29,36,38,41]. Furthermore, we must not overlook the reality of a lack of awareness about cyber insurance, social insurance stigmas, and general negative perceptions [4,12,13,25,31]. Such negative perceptions can inhibit the uptake of cyber insurance policies, and are boosted by the rejection of large cyber claims by insurance companies, which has already started to occur [39].…”