Cyber insurers cut their premiums, but demand you do more

“Insurers very quickly understood that they weren’t rating the risk itself correctly, and that was seen obviously in their loss ratios,” she said.

“With those claims coming in, we learnt a lot, we understood what the costs associated with an incident look like. And [they] were a lot more than what the premiums were at the time. So we saw a very sharp and quick correction.”

Although premiums are flattening – a recent report from broker Howden says they declined 10 per cent in the year ended July 31 – Ms Butler said the correction had left insurers wary.

Insurers will have a checklist of things they need to see, a bit like the cyber equivalent of having deadlocks on the doors and windows for your home contents insurance.

“If you can’t demonstrate that you have those controls in place, you might be able to get cyber insurance, but it won’t be the coverage that you need. And the premium will be significant.”

Ransomware shift

The biggest threat to businesses is ransomware, which occurs when criminal gangs – often operating in Russia and eastern Europe, but capable of striking worldwide – cut off a company’s access to its data and the criminals make demand to hand it back.

The gangs’ tactics, though, have shifted.

“The latest one is to exfiltrate data out of the systems and hold that to ransom as well,” Ms Butler said.

Cyber insurance operates a bit like travel insurance, in that when an attack happens there will be real-time support to help deal with the fallout. Most policies now bake in access to a crisis response team.

But Ms Butler said Marsh had found many clients are “buying this policy and then putting it in the drawer and forgetting about it, and not knowing how to utilise it until it’s a crisis”.

“We’ll sit down with the security team, the risk team, the legal team, the communications team, and we’ll talk to them about what the policy is, how it responds,” she said.

“So at the time of the crisis that can be used immediately, and the costs associated with that are already agreed upfront with insurers.”

Now that the industry is starting to get a handle on the cyber threat, Ms Butler’s bugbear is that governments and their security and enforcement agencies are under-appreciating what insurers have to offer.

“They don’t really appreciate the level of detail that we have, particularly in relation to the incidents themselves and how they play out – the pain points, what ‘good’ looks like in responding to an incident. And we see it every day, we’re in the trenches,” she said.

“There could be a closer partnership. I feel like we’re the missing piece, and we have such valuable data that we can share. And the collaboration would be to the benefit of everyone.”