What is cyber insurance and what does it cover?

27 Oct What is cyber insurance and what does it cover?

Cyber insurance is a type of insurance that covers digital risks like cyber-attacks, cybercrime, and data breaches. All of them have the potential to hurt your business through loss of trading time, loss of revenue and reputational damage.

That’s the simple version at least. But to understand what cyber insurance is and does, you first have to understand the threat. And that’s not always easy in view of the complex and constantly shifting landscape that cybercrime occupies.

What it’s important to know, however, is that digital risks and cybercrime aren’t going away anytime soon. With our collective reliance on tech, they’re only increasing and there’s no magic ‘delete’ button we can press to make them disappear.

That makes it vital to understand what the cyber threat is and what it means for your business. Also, what you can do to prepare your business for a cyber incident and help it survive the aftermath. Because the fallout can be devastating.

What is the cyber risk and why do I need cyber insurance?

Any sort of digital crisis has the potential to unleash chaos, whether that be a hacker infiltrating your systems or a staff member falling for a fake email. Money or data can go AWOL, and your network can be crippled, bringing business to a halt.

Cybercrime is a global problem. But closer to home, the government says nearly four in ten UK businesses (39%) reported breaches or cyber-attacks in 2020. That’s down a bit on 46% the previous year but can likely be put down to reduced trading volumes during lockdown.

The average cost of each of those security breaches was £8,460 says the government’s report – although for significant events the cost was of course much higher. And there were businesses of all sizes in the mix from start-ups to SMEs and larger companies.

The point is, no matter what your type of business, we’re pretty much all dependent on tech these days – from email to websites to VPNs (virtual private networks). In fact, with hybrid working now the norm and so many people connecting to remote networks from elsewhere, we’re more reliant on it than ever.

And that makes us sitting ducks for cybercriminals. It also means any kind of digital outage presents a real problem. Because if the tech doesn’t work, nor do we.

What are the biggest cyber threats to my business?

Human error is at the root of most cyber scares. Analysis by cybersecurity awareness and data analysis firm Cybsafe found that mistakes by individuals were behind 90% of data breaches reported to the UK regulator in 2019.

At the top of the cybercrime league table comes social engineering. It translates as people being innocently manipulated into revealing valuable information or doing something they don’t realise will be harmful. The result is hackers get access to data, information, networks and even money.

Phishing is the most common type of social engineering. Phishing emails appear to be legit and to come from a trusted source. But they’re a guise for persuading individuals to reveal sensitive information cybercriminals can use for fraud. Or to trick them into clicking on malicious links.

A more sophisticated type of phishing, called spearphishing, targets individuals. This type of attack might take the form of a fake email apparently from a regular supplier, asking an employee to pay an invoice using new account details. Cue money going straight into the hands of cybercriminals. Read our blogpost that goes into more detail about 5 types of phishing attacks

What other kinds of cyber-attack do I need to know about?

Ransomware is one of the big boys of the cyber-attack world and packs a hefty punch. Cybercriminals exploit IT security weaknesses or use social engineering techniques to infect a company’s network with malicious software.

Once the ransomware is in the system, it works quickly to encrypt data and lock it down. A message usually appears, telling hapless users that if they ever want to see their data again, they’ll have to pay a ransom – often in cryptocurrency.

Some pay up, some don’t. Some see their data again, others don’t – even those who’ve paid the ransom. Cybercriminals aren’t really known for their honourable intentions. And such is the scale of the problem, the US has recently made paying cyber-attack ransoms illegal.

Cybercriminals employ other damaging types of malware too. Much of it ends up on computers after users unwittingly click on bad links. Although, frighteningly, what are known as ‘drive-by attacks’ can happen if you’re simply unlucky enough to visit an infected website. No clicking required.

Malware can also come in the shape of keyloggers or spyware, which allow cybercriminals to record the keystrokes users make – including password entries. Plus, there are worms and viruses, and a whole lot of other sneaky tricks cybercriminals use to exploit other peoples’ computers.

End game

The end result of any kind of cyber-attack is broadly the same. A network is compromised (maybe for days), and your business loses money – either because there’s a ransom to be paid, or systems and websites are down and trade grinds to a halt. Customers, meanwhile, go elsewhere.

A cyber-attack may also mean a data breach and the loss of sensitive data like customers’ personal or payment details. And that can put you in trouble not only with your customers, but with the regulator, which in the UK is the Information Commissioner’s Officer (ICO).

The ICO says 37% of UK companies reported a data breach in the past 12 months. And that can be very costly for businesses. Not only in terms of fines, which can be up to £17.5 million or 4% of turnover, whichever is greatest. But also, in terms of damage to your reputation.

As a measure of how seriously the ICO regards data breaches, the number of fines it issued surged 1580% in the year 2020/21.

What does cyber insurance cover and how can it help?

Given the clear and present danger cybercrime poses, it seems the best course of action is to do like the Boy Scouts do and be prepared. Because relying on the bloke down the road ‘who knows a bit about computers’ when your network’s crippled by malware won’t really cut it.

Where cyber insurance has the advantage is that it provides you with a whole team of experts. That means technical experts to stop an attack, mend systems and retrieve data. Legal experts to deal with the regulator and any claims against you for loss of personal data. And crisis PR experts to manage your reputation.

Plus, it does it all quickly. Most cyber insurance companies have a 24/7 response line you can ring for immediate help. That’s important, because the longer an incident goes on, the greater the damage – on several fronts. It makes getting back on your feet again as soon as possible vital.

Cyber insurance covers your financial losses. It takes care of any dip in revenue while your business can’t trade as normal because of a cyber-attack. It also pays your legal costs and any compensation you owe if you’re sued for losing people’s personal data.

And even if a financial loss comes as the direct result of human error, like a member of staff falling for a phishing email, cyber insurance can cover that too.

Some cyber insurance even tries to head off those human errors before they happen. Your employees are potentially your biggest risk when it comes to cybercrime. So, training them in good cyber security habits can make a big difference. Some policies come with access to online training programmes that do just that.

Survival of the fittest

Cybercrime may sound like a futuristic concept, but it’s very much the here and now. And as the opportunities for it grow in line with our ever-heavier reliance on tech, the problems it causes are only going to multiply.

Let’s face it, when would-be hackers can go on the dark web and buy ready-made malware packages for just a few quid, it doesn’t bode well.

The fact is, cybercriminals are smart. They’ve got the know-how in their fingertips and they’re constantly probing for vulnerabilities in our security set-ups. Put that together with the fact your average tech-user isn’t quite so cyber-savvy, and you have a recipe for a pretty uneven fight.

Where cyber insurance can help is by putting the battle on a more even footing. It may not always be able to prevent a cyber-attack, but it can give your business the tools it needs to deal with one quickly and survive. And survival of the fittest, after all, is what being in business is all about.

Read more about cyber insurance or ring get a quote from our friends over at PolicyBee and talk to an expert.