Individuals are inundated daily with advertisements for protective policies related to their vehicles, health care, travel reservations, pets and even their cyber risks. For companies, the limited-time offers from insurance carriers can begin to feel endless. While wading through the mountains of marketing materials, particularly for complex issues such as data breaches, they may wonder, “Do we really need to invest in a policy without an immediate or tangible risk?”
When it comes to cyber insurance, the short answer is yes.
Businesses may mistakenly believe they’re safe from potential cybercrimes due to various factors, such as limited physical footprints, customer bases or geographic locations, but there’s no sugarcoating it; every company that uses technology to operate faces some cyber risk. With the rising threat of breaches and attacks on entities of all sizes, organizations can no longer afford to view cyber insurance as a negotiable budgetary item. Instead, they should consider these policies a necessary operating expense.
Consider a mid-size manufacturer as a prime example. If a breach occurs, the company may have to pause operations, leaving it unable to produce parts. As a result, its clients don’t have the components needed to make their own products. Rather than waiting days or weeks for the issue to be resolved, the customer may pivot to another provider. The initial manufacturer may never get that business back. Prospective clients may hesitate or choose not to work with them. This could lead to a ripple effect of revenue losses, layoffs or even a permanent plant closure.
Enter cyber insurance. As the Federal Trade Commission states and the above example illustrates, “recovering from a cyberattack can be costly,” not only to businesses’ finances but also to their reputations. Cyber insurance lessens the impact. While not foolproof, these policies help cover or offset the costs commonly associated with cybercrimes, such as lost income or repairs to damaged systems. In addition, they help businesses be more resilient in the face of cyber incidents, mitigating the adverse effects on customers, employees and the public.
Companies often fall into the trap of thinking they can self-insure, but this can leave them spinning their wheels. At the height of a crisis, they may need help reaching someone who can field questions or offer detailed guidance on necessary next steps. Cyber insurance bridges the gap by providing companies with an on-call apparatus for incident response. For businesses of all sizes, but especially small and mid-size ones, these policies offer much-needed technical expertise and support businesses might not have access to otherwise.
Insurance carriers often deploy breach coaches to mobilize the forces needed to help resolve incidents swiftly and effectively when breaches or attacks occur. This on-call team assesses the situation and connects impacted policyholders with the appropriate resources. This may entail services such as helping businesses navigate the legal response, coordinating public affairs outreach or offering technical forensic support. For entities with internal cybersecurity teams or third-party firms, these professionals can serve as liaisons or technical translators, coordinating directly with breach coaches to ensure effective implementation.
Cyber insurance, while beneficial, is not foolproof. Companies need to recognize that these policies are responsive, not protective. They are designed to minimize losses rather than provide a get-out-of-jail-free card. As Forbes notes, obtaining cyber insurance should be seen as an “approach for maturing security program practices within [an] organization.” When filling out application forms, carriers will ask entities about their existing cybersecurity practices, but these are generally basic, one-size-fits-all measures. Companies should follow smart cyber hygiene by determining their possible areas of risk and sourcing or selecting various controls, outlined in the voluntary National Institute of Standards and Technology Cybersecurity Framework, to fully address and reduce their vulnerabilities.
Businesses are advised to work with a licensed insurance agent and a trusted information technology and cybersecurity firm to determine what type of coverage they may need. These professionals will help ensure entities are adequately prepared for potential cybercrimes and the wide-ranging impacts that may fall under the purview of different policies. For example, an agent may also advise a manufacturer to consider purchasing a crime policy if they are concerned that future phishing attacks could affect their accounts payable department.
Again, it’s critical to note that cyber insurance won’t protect companies against breaches or attacks, but these policies are another component of a strategic toolkit businesses can — and should — use to enhance their overall cybersecurity posture. With proper coverage selection and implementation, entities can become more resilient against future cybercrimes.
Christopher Wright is co-founder and partner at Sullivan Wright Technologies, an Arkansas-based firm that provides tailored cybersecurity, IT and security compliance services. For more information, visit SWTechPartners.com.
READ ALSO: Compliance Versus Risk Management: What’s the Better Cybersecurity Approach?
