In the second part of this two-part series, Acronis takes a deep dive into what is and is not covered by cyber insurance and how the right technology can help mitigate your risk. Wondering what is cyber insurance? Click here to read part one of this series.
Although there is a demand for and a trend toward standardizing cyber insurance terminology and policies, the field is still relatively new and unregulated. Today’s policies tend to be highly customized, and what follows below, is a high-level overview of what is typically covered, excluded, or limited by cyber insurance.
First-party cyber insurance covers your own company’s assets in the case of a cybersecurity failure such as a data breach, malware infection, ransomware or other extortion demands, or business email compromise. Typical first-party coverage includes:
- Loss of or damage to digital assets such as data and software, including the costs of data restoration from backups
- Business interruption, including the costs of failing to meet contractual obligations while systems are down
- Ransomware or extortion demands, where often the insurer will take the lead in negotiations
- Customer notification of a privacy breach
- Reputational damage due to loss of IP or customers (although some policies exclude reparations for anything related to loss of IP)
- Electronic theft of money or other financial assets
Third-party cyber insurance covers the assets of others affected by a cybersecurity breach, most typically your customers or partners. Typical third-party coverage includes:
- Forensics and other investigation activities (also relevant to first-party coverage)
- Setting up a 24/7 help hotline
- Legal costs, including consultation
- Civil damages or regulatory fines
- Restoration of reputation
It is equally important to understand what is excluded from cyber insurance policies, including the grounds on which the insurer may deny claims:
- Failure to implement and maintain cybersecurity best practices
- Specific exclusions for PCI or other self-regulatory fines
- Act of war (e.g., some insurers refused claims for malware attacks related to the Russian military, such as NotPetya, which they deemed an act of war.)
- Long-term loss of income
- Pre-breach lawsuits based on charges of malpractice or negligence
- Loopholes related to social engineering exploits, such as a fraudulent request being completed over the telephone rather than a computer
The insurance world is all about risk management, and one of the challenges facing cyber insurance providers is the lack of a reliable cyber risk model. With ransomware payments alone reaching $412 million in 2020, cyber insurance underwriters are rightly concerned about maintaining a profitable balance between premiums collected and claims paid out. There are general pricing considerations such as company size and revenues as well as the level of deductible.
Other more specific factors that affect the cost of cyber insurance premiums are:
- Sector: Highly regulated sectors such as financial services and healthcare are both prime targets for cybercriminals due to the sensitive nature of the data that they collect as well as liable for regulatory penalties and fines.
- Location: The cost of premiums vary from country to country and often from region to region within a country.
- Proven security measures: A well-documented and well-implemented cybersecurity program (firewalls, antivirus/anti-malware protection, secure backups, internal incident response plan, and so on) lowers the risk to the insurer and hence the premium.
As the cost of cybercrime skyrockets, cyber insurance providers are becoming proactive, providing expertise and support to help their customers maintain a robust security posture that prevents attacks. They also encourage their customers to implement IT best practices that promote resilience should an attack take place.
How Acronis helps MSPs and their customers lower cyber insurance costs
Acronis unifies data protection and cybersecurity to deliver integrated, automated cyber protection that solves the safety, accessibility, privacy, authenticity, and security (SAPAS) challenges of the modern digital world. With flexible deployment models that are well-suited to MSPs and their customers, Acronis Cyber Cloud provides superior cyber protection for data, applications, and systems, with innovative next-generation antivirus, backup, disaster recovery, and endpoint protection management solutions.
With award-winning machine intelligence-based anti-malware and blockchain-based data authentication technologies, Acronis is committed to full-cycle security in all environments—from cloud to hybrid to on-premises:
- Secure, always-available data centers around the globe
- Seamless integration with your existing PSA and RMM stack, providing a single interface for deploying security policies consistently and automatically across all endpoints
- Acronis Active Protection stops attacks in real time to safeguard all data, including the backup files created by Acronis; it also includes self-defense mechanisms for the Acronis backup software
- Acronis Cloud Brain, based on machine learning models and behavioral analytics, detects and prevents in real time even the most dangerous and sophisticated threats
- Acronis Notary leverages blockchain technology to guarantee data authenticity
A veteran company whose industry-leading solutions are trusted by 500,000 companies including all of the Fortune 1000, Acronis’ proven ability to prevent attacks is recognized by cyber insurers as a risk mitigator. In addition, Acronis’ tamper-proof backup solution supports quick recovery should an attack occur, which translates into fewer and lower claims. In short, deploying Acronis can lower the cost and maintain the stability of cyber insurance premiums.
Learn more about how Acronis can help you secure your assets and those of your customers. Request a demo or try us out to get an inside look.
Guest blog courtesy of Acronis. Read more guest blogs from Acronis here.
