Cyber liability insurance: Modern security apparatus for modern security threats

Cyber liability insurance: Leveraging an old concept for modern challenges

Despite modern security challenges, there are modern solutions emerging to help customers navigate security risks, reduce risk for enterprises, generate better security hygiene, and perhaps even foster stronger standard bodies. One solution is taking an old concept, insurance, and modifying it for the data age.

Insurance is a concept that has existed since the Babylonians built the hanging gardens, and likely in some form before that. Insurance generally exists in a love-hate relationship with those that are covered. However, it is often deemed essential (or made essential through law) to cover the many what-ifs of life.

We discussed in the prior section several ongoing security challenges related to liability and business risks that are causing customers to reconsider pursuing digital transformation. However, what if customers’ digital footprints were insured? What if damages from a breach were paid through an insurance company, or if an expert recovery team was funded through a policy that would be dispatched as soon as there was an incident? And what if such a policy included damage control and positive marketing services following a breach? This would make customers much more comfortable by mitigating part of the risk associated with taking the technological leap toward digital transformation.

This is not an “aha” moment. Cyber liability insurance already exists on the market. It is defined by the International Risk Management Institute Inc. as:

 A type of insurance designed to cover consumers of technology services or products. More specifically, the policies are intended to cover a variety of both liability and property losses that may result when a business engages in various electronic activities, such as selling on the Internet or collecting data within its internal electronic network.

Most notably, but not exclusively, cyber and privacy policies cover a business’ liability for a data breach in which the firm’s customers’ personal information, such as Social Security or credit card numbers, is exposed or stolen by a hacker or other criminal who has gained access to the firm’s electronic network. The policies cover a variety of expenses associated with data breaches, including: notification costs, credit monitoring, costs to defend claims by state regulators, fines and penalties, and loss resulting from identity theft.

Companies such as Nationwide and Hiscox, among a long list of others, provide it. However, it is hardly brought up in the digital transformation discussion, and TBR believes it has important market impacts as well as drives opportunities for current security vendors. In terms of the market, TBR believes the more mature cyber liability insurance becomes, the faster organizations will adopt digital transformation. It would be beneficial if cyber liability insurance were part of the conversation when a vendor leads a digital transformation implementation, just as car insurance must be a consideration when buying a new car.