Criminal Hacktivity: Why You Need Cyber-Insurance

Advisors should be talking with their clients about cyber-risk coverage, said Parisi, because they’re “protecting assets—protecting the balance sheet, the flow of revenue.” They need to get clients to “look at where their risk points are and where they are susceptible.”

That’s not to say that companies with coverage can just sit back and relax. Parisi said many companies assume that “we spent all this money on technology; we’re fine.” Marsh pointed out that in some jurisdictions, it is against public policy “to allow companies to be indemnified for losses arising from their improper, intentional or fraudulent behavior.” In such cases, even policies that carry “express grants of coverage for punitive damages, privacy fines and penalties” may have to rely on “enhanced cyberprotection” provided by an alternate insurer. Still, a pragmatic company will take action to beef up its security measures.

Firms also need to be prepared for when their defense against cybercrime doesn’t work, Parisi said. He pointed to one of the simplest and relatively low-tech methods of getting past a company’s defenses, security guards and software: a key ring complete with keys and thumb drive dropped in a company parking lot for a well-meaning employee to pick up and take inside, there to plug the thumb drive into his computer in an attempt to learn the owner’s identity and thus return his keys. “Human foible” has thus given the bad guys entrée to the company’s computer system.

Even insurance companies are a bit behind the curve because they don’t have the depth of underwriting for cyber-risk that they do for, say, earthquakes or hurricanes. According to Parisi, a lack of statistically significant actuarial data is one barrier to accurately pricing cyber-risk coverage. However, as claims come in, the data will emerge. Prices on policies for retailers have already increased with such headline grabbers as Nieman Marcus acknowledging that its customer databases were hacked.

Parisi cited a saying in the industry: “There are three types of companies: companies that had a cyber issue, companies that are going to and companies that are in the middle of one and haven’t figured it out yet.” With those odds, it would seem that cyber-risk coverage is insurance whose time has come.