Businesses not confident cyber insurance will cover cyber risk

A new research report by CSI looking into the top concerns of cyber security decision makers has found that only 2 in 10 (19%) are fully confident that their cyber insurance will cover their cyber risk in 2023. 

Less than a third (29%) were fully confident that they were compliant with the new stricter terms that insurance companies are now stipulating.  

The rise of ransomware attacks, and insurance companies paying hundreds of millions in cybersecurity-related claims each year are being blamed for organisations now facing rising cyber insurance rates, tightening of standards, and limiting coverage. With average ransom payments reaching $812,000 during 2021, the true cost of ransomware is in fact much more when the cost of downtime and reputational damage is factored in. 

The risk level only looks to increase, however. CSI's research found that 78% of organisations believe the current cost-of-living crisis will increase the risk of a cyber threat occurring in their organisation. When asked what factors they anticipate will increase due to the economic climate, 43% said fraud and phishing attempts, 45% said new and emerging threats, 39% said greater risk of supply chain partners being breached and 34% said reduced budgets leading to lack of third-party services and tools. 

"Whilst cyber insurance stands as a good option in enabling firms to protect their financial security the tightening of standards means that some companies could find that they are without cover if they are not demonstrating a strong security posture and are attacked," says Nick Westall, CTO, CSI. 

"Therefore, companies should be focused on being proactive and implementing effective security controls to better thwart attacks to begin with," he says. 

"Those who are fully confident in their insurance will place a higher importance on the value of these controls to cover their cyber risk in 2023.'

The study found the technical controls deemed most important to security decision makers are network monitoring and establishing Security Operations Centre (SOC) (84%), Multi Factor Authentication (MFA) and Endpoint detection and response (EDR/XDR) (both 83%) for building cyber resilience.  

CSI recommends the above security controls are used alongside an effective employee education programme. The full list of security controls should also include: 

Immutable backup and disaster recovery
Organisations should regularly perform immutable backups; a file that can't be altered in any way. It should be able to deploy to production servers immediately in case of ransomware attacks or other data loss.  
Endpoint detection and response (EDR)
Install antivirus solutions to protect endpoints against malware, viruses, and other attacks.  
Managed detection and response (MDR)
Using a cybersecurity service that combines technology and human expertise will perform more effective threat hunting, monitoring, and response. The main benefit of MDR is that it helps rapidly identify and limit the impact of threats without the need for additional staffing.  
Security Orchestration, Automation, and Response (SOAR) 
Streamline security operations in three key areas: threat and vulnerability management, incident response, and security operations automation.  
Patch management 
Consistently implement patches and updates.  
Multi Factor Authentication
Verifying a users identity before allowing access.