The rampage in ransomware now poses a predominant threat to businesses of all sizes
Cyber insurance pricing has increased by an average of 32% year-on-year as at June 2021, according to a new report published by international insurance broker Howden yesterday (5 July 2021).
The report, Cyber Insurance: A Hard Reset, looked at three key factors that are driving the cyber insurance market today: ransomware attacks, higher rates and shifting regulation – the broker described these as “the three Rs”.
The study highlighted that ransomware is now the predominant cyber threat confronting businesses of all sizes, with the number of these attacks increasing by 170% worldwide in quarter four of 2020 compared to quarter one in 2019, according to industry data contributed by internet security company SonicWall.
The average cost of ransomware remediation globally has also increased in 2021, rising to $185m (£133m) from $700,000 (£506,320.50) in 2020.
The reason for the growth in frequency and severity of ransomware attacks is because of low cost ransomware kits, or ransomware-as-a-service (RaaS), combined with a new attack method that involves both data encryption and the publication of stolen data – this is known as double extortion.
As a result of the spike in cyber insurance pricing, Howden stated that insurers are now demanding more from businesses’ cyber resilience and are only willing to deploy capacity if they are satisfied by the strength of companies’ risk management frameworks.
Shay Simkin, global head of cyber at Howden, said: “Cyber risk has undergone multiple episodes of change and development in its relatively short history, but nothing quite so impactful and fundamental as the events over the last year.
“Covid-19 and all of its attendant effects on technology adoption and cyber security, combined with independent or connected changes to the loss environment, has added a big dose of complexity into an already complicated risk landscape.”
Preparing for a cyber attack
The predicted rate of expansion in the global cyber market over the next few years sits at a compound annual growth rate (CAGR) of 23%, which in turn will see gross written premium (GWP) approach $20bn (£14m) by 2025.
Simkin added: “The cyber insurance market is currently driven by a demand and supply imbalance, which shows no sign of relenting any time soon.
“Claims are up, capacity is down and underwriting profitability is, at best, under pressure.
“The impact on insurance buyers is stark - the importance of being prepared for a cyber attack has never been clearer.
“With insurers now demanding markedly higher cyber security standards before deploying capacity, businesses need analytical solutions designed specifically for them, combined with focused, expert intermediation to help them secure the coverage that meets their needs.”
Key takeaways:
- Planning is crucial and investment in cyber security, as well as incident response, is money well spent.
- Developing a tested, comprehensive response plan and having a robust cyber insurance programme in place can help contain the impact of a cyber attack and control external risks around customer and shareholder perceptions – this requires close collaboration across organisations, including board level stakeholders and key information technology and security leaders.
- Speed is of the essence following a cyber attack - having these protocols in place will expedite companies’ responses to any potential attack, in addition to helping limit the damage and costs.
According to data in the report contributed by computer hardware company International Business Machines Corporation (IBM), breached companies with a tested incident response team paid almost 40% less on average in 2020 than those without.
The vitality for preparedness is also reflected in the proprietary research conducted by Howden and pictured below – figure eight shows how superior mitigation and response measures can support shareholder value and minimise reputational risks in the event of an attack, while figure nine demonstrates how unprepared companies typically suffer disproportionate impacts that can lead to regulatory activity or litigation.
No comments yet