After the Wanacry incident two weeks ago, we’ve had many companies asking how they can better protect themselves from cyber-attacks. Today, I’m sitting down with Karen Roeder, the Director of Commercial Lines at Integrated Insurance Solutions to discuss the basics of Cybersecurity Insurance, and how it can help protect your company. 

Trevor Parker Let’s start off with the most important question, what is Cybersecurity Insurance?

Karen Roeder Cyber Insurance was developed to cover IOT (Internet Of Things). It protects companies from numerous risks; liability associated with a data breach is the most widely discussed.

Trevor Parker Interesting, what does Cybersecurity Insurance cover?

Karen Roeder  Cyber insurance provides both liability and first-party coverage.

The liability portion usually has three coverage options available:  network and information security (claims due to unauthorized access to data, failure to notify of a breach, transmission of a computer virus), communications and media liability (electronic content claims for copyright infringement, plagiarism, defamation etc.)  and regulatory defense expenses.

First-party coverages include: crisis management expenses, security breach remediation and notification expenses, computer program and electronic data restoration expenses, computer fraud, funds transfer fraud, e-commerce extortion and business interruption.

Trevor Parker Considering recent events such as Wanacry, would you say you’ve had an increase in companies purchasing Cybersecurity insurance?

Karen Roeder I have not seen an increase despite the numerous data breach and cyber extortion stories in the news.  The industry estimates that only 9% of businesses have cyber coverage.

Trevor Parker I’m sure small companies are interested in protection, but likely worry about the cost. How much does Cybersecurity Insurance cost for basic coverage?

Karen Roeder Small companies have often felt that hackers will pursue larger companies with deeper pockets.  The statistics show that small companies are actually being targeted the most (43% of the time).  There are many factors that go into the rating of this policy, so it is difficult for me to throw a number out. We can obtain a rough estimate with four pieces of information: company name, address, number of employees, and annual revenue figure.

Trevor Parker Do larger companies need different Cybersecurity Insurance coverage?

Karen Roeder Companies, regardless of size, need the same cyber coverage.  The difference would be the limit of coverage purchased.

Trevor Parker What are Cybersecurity Insurance requirements for companies to get coverage?

Karen Roeder Insurance carriers require a completed application.  If a company is missing some key risk management protocols, the carrier may require that they are implemented prior to or within 30 days of binding coverage.

Trevor Parker What companies are at risk of Cybersecurity breach or an attack similar to that of Wanacry?

Karen Roeder Every company is at risk.  If you have employees, a website, email, laptops, smartphones, tablets, etc.  then you are exposed.

Trevor Parker What are the benefits of going for Cybersecurity policy through an independent insurance broker such as Integrated Insurance Solutions versus directly with a carrier?

Karen Roeder Having an independent insurance broker is a huge asset.  We work for our clients, negotiating the best terms and pricing with multiple insurance carriers.  By going direct, you lose access to a valuable knowledge source and advocate.

Trevor Parker Can you give me an example of how a Cybersecurity breach would be handled?

Karen Roeder When you discover the breach, you call the insurance company’s 24/7 claims number.  A claims specialist is assigned to begin mitigation.  They may investigate remotely or dispatch personnel to your physical location.  If a ransom is involved, they will negotiate on your behalf.

Trevor Parker What do companies risk if they go by not obtaining Cybersecurity Insurance?

Karen Roeder Their business. Most companies do not have the capital available to recover from a breach.  Notification costs alone are estimated at $217 per record.  This doesn’t include the cost of forensics, restoration of data, crisis management, public relations, loss of customers, and lawsuits.

Trevor Parker Thank you for your time and answers, Karen. Do you have any last comments about Cybersecurity Insurance for companies?

Karen Roeder Please investigate buying some amount of Cyber coverage.  Even if you can only afford a small limit, it is better to have some coverage than nothing at all.