Why 27% of U.S. Firms Have No Plans to Buy Cyber Insurance

May 31, 2017

A full 50 percent of U.S. firms do not have cyber risk insurance and 27 percent of U.S. executives say their firms have no plans to take out cyber insurance, even though 61 percent of them expect cyber breaches to increase in the next year.

Even among those that have insurance, only 16 percent said they have cybersecurity insurance that covers all risks.

The U.S. lags behind the UK and Canada, where about 40 percent have no cyber coverage.

Mistrust about insurance pricing is one reason some firms aren’t buying.

These findings come from a survey conducted by research firm Ovum for Silicon Valley analytics firm FICO. The researchers conducted telephone interviews with 350 c-suite executives and senior security officers from financial services, telecommunications, healthcare, retail, e-commerce and media service providers. The respondents represented various size companies: 30 percent had 500 to 1,000 employees; 28 percent had 1,001 up to 4,999; 17 percent had 5,000 up to 9,999, and 25 percent had more than 10,000.

In the U.S., the healthcare industry is particularly behind on fully protecting itself with cyber insurance, according to the survey. None of the healthcare firms represented in the survey have insurance that covers all risk, while 74 percent have none at all.

“With so many firms concerned about a rise in the likelihood of cyber breaches in the next year, it’s troubling to see that half of them don’t have any cybersecurity insurance protection,” said Bob Shiflet, who oversees fraud and financial crime solutions at FICO. “There are steps the insurance industry can take to make guidelines clearer and explain premium adjustments, but companies need to be willing to dedicate the resources required to protect themselves from the breaches they themselves see as likely, if not inevitable.”

The authors identify the cost and lack of clarity about insurance pricing as an obstacle to increased sales. Only 25 percent of survey respondents believe that premiums provide a genuine reflection of the risk profile of their organization. Only 23 percent believe that the insurance industry is clear and transparent in its approaches to pricing.

U.S. executives identified several ways the risk assessment process that insurers use could be improved. Twenty-nine percent say that insurers should provide clear guidelines about how premiums are chosen, 28 percent would like clearer communications as to why premium adjustments happen and 23 percent would like insurers to introduce an industry standard for benchmarking cyber risk.

Other reports have looked at why some companies are not buying cyber coverage.

A cyber readiness survey released in February by specialist insurer Hiscox suggested that momentum is building behind cyber insurance. In its survey, overall 55 percent of U.S. firms said they had taken out cyber insurance. Hiscox analysts said its higher take-up figures may partly reflect confusion over what exactly constitutes cyber coverage with some companies believing they are protected under their existing policies.

In the Hiscox survey, among the firms that had not bought cyber cover – 26 percent of the survey sample – and do not plan to do so, two in five (41 percent) of them said “a cyber insurance policy is not relevant for me.” More than one in six (17 percent) of those that have no plans to take out cyber insurance agreed with the statement: “Cyber insurance policies are so complicated – I don’t understand what cyber insurance would cover me for.”

A report published by Deloitte consultants suggested buyers often don’t understand cyber risks or insurance options and also cited a lack of standardization of cyber policies.

“Similar cyber insurance products offered by different providers often include alternative features, which makes it difficult for buyers to compare policies by value and price,” according to the report. Concerned about potential coverage gaps, businesses want to avoid buying coverage they don’t fully understand with language that may be subject to interpretation, the report said.

The Deloitte report recommended steps the industry could take to overcome buying obstacles including standardizing policy language, developing a “risk-informed model” rather than a definitive predictive model for cyber risks, employing more targeted underwriting by industry or exposure, and offering more holistic cyber risk management programs.

Yet another report, this one by the nonprofit RAND Corp., hints at another reason not all companies see cyber insurance or further investment in cybersecurity as as a good investment. The typical cost of a breach is about $200,000 and most cyber events cost companies less than 0.4 percent of their annual revenues, the study found. The $200,000 cost is roughly equivalent to a typical company’s annual information security budget.

“Relative to all the other risks companies face, the cyber risks often aren’t as big a deal as we think,” said Sasha Romanosky, author of the study and a policy researcher at RAND. “It may be bad for you if you are the victim, but it doesn’t change the behavior or strategy of a company. Like you and me, companies are self-interested and operate in ways that minimize their costs. You can’t begrudge them for working that way.”

The RAND study ‘s cost estimate is a lot less than the estimate in a May 2014 report by the Ponemon Institute at the University of Michigan. The Ponemon report put a $3.5 million pricetag on an individual data breach. Ponemon surveyed 314 companies in 10 countries. The RAND study, which is published in the Journal of Cybersecurity, is based on a private dataset of 12,000 cyber incidents compiled by Advisen.

Related:

Popular Today