In the wake of recent ransomware attacks like Lapsus$ and Cl0p/MOVEit, a surprising new player is stepping up to improve cybersecurity: cyber insurers. These experts not only handle claims after an attack, but also set coverage requirements and use data-driven risk assessments to hold organizations accountable for their cyber hygiene. So, how can chief information security officers (CISOs) prepare to work with these influential partners?
Getting to Know Your Cyber Insurer
The cyber-threat landscape has become increasingly complex, with ransomware attacks on the rise. As a result, cyber insurance premiums have surged by 50% in the past year, putting pressure on risk management budgets. CISOs now face the challenge of proving to their cyber insurers that their organizations are adequately prepared to handle cyber risks. To do this, CISOs must fully understand the role and priorities of cyber insurance companies.
Insurance companies rely on accurately assessing risk, and cybersecurity is no exception. Actuarial science drives a global market of $7 trillion in insurance premiums each year. With the rise of scalable cybercrime, organizations have suffered significant financial losses. Recognizing the need for change, most organizations are reevaluating their cybersecurity strategies, and cyber insurers play a crucial role in determining the necessary adjustments.
2022 was a challenging year for the cyber insurance market, with premiums skyrocketing due to frequent ransomware attacks. This makes it more important than ever for organizations to align with their cyber insurers. As the market rebounds, insurance companies are refining their models and gaining a better understanding of cyber risks.
Prioritizing Security Measures
Underwriters are now using more detailed self-assessment questionnaires to evaluate an organization’s security posture. These questionnaires cover various aspects, from multifactor authentication to group policy rules for Active Directory administrators. While most organizations have some security measures in place, few can check all the boxes. Therefore, investments in tools or personnel may be necessary to meet the requirements. Failing to invest could result in denial of coverage or higher premiums.
However, investing in these requirements can make it easier to qualify for cyber insurance and potentially reduce premiums upon renewal. By working with brokers and underwriters, CISOs can develop different cybersecurity investment scenarios. This allows them to present clear metrics and correlate their risk register with insurance premiums, demonstrating the value of cyber investments to CFOs and the board.
Conducting Audits for Cyber Insurance
The current state of cyber insurance presents actionable opportunities for security decision-makers.
First, accurate self-assessments are crucial during the auditing and claims processes. Self-assessment surveys now ask challenging questions that cover a wide range of fields. It is essential to provide accurate information, as insurers are willing to decline coverage or take legal action against organizations that make false claims.
Secondly, CISOs must prove that they have the capabilities they claim on these forms. This requires creating and maintaining detailed records, building reporting systems, documenting business and security processes, and generating tamper-proof data for cyber forensics. The difference now is that CISOs need to make this cybersecurity posture visible to insurers.
Lastly, organizations are competing with each other for coverage, and CISOs must demonstrate that their organization’s cyber maturity surpasses others. This is especially important in vulnerable sectors like healthcare, financial services, and federal contracting. Compliance with regulations, control over the software supply chain, and proactive cyber event plans can give organizations a competitive edge. CISOs should leverage their strengths while remaining transparent about vulnerabilities.
As the cyber insurance market stabilizes and becomes more competitive, the rules are becoming standardized and transparent. It is crucial to understand which cyber risk factors influence pricing the most and identify areas for improvement in cyber defense. Ultimately, the goal is to enhance protection against cybercrime, ransomware, and breaches by adhering to best practices. By partnering with insurers and auditors, CISOs can make informed security investments and strengthen their organizations’ cyber resilience.