By Alexei Alexis, Reporter
Eight out of 10 companies have suffered a cyberattack that wasn’t fully covered under their cyber insurance policy, according to an analysis by Israeli cyber risk quantification firm CYE.
On average, each insurance gap left more than three-quarters of a breach uncovered, CYE said in a report released Wednesday. The research, which analyzed 101 breaches across various sectors, revealed an average of US$27.3 million in uncovered losses per incident.
“This study underscores how many companies rely on cyber insurance to cover the losses incurred as a result of cyber incidents and are then taken by surprise when they find that their insurance only covers a small portion,” vice president of data science at CYE, Nimrod Partush, said in a press release.
Direct written premiums for cyber insurance worldwide could rise to US$23 billion by 2025, with US businesses paying about 56% of the total, according to a February report from the Insurance Information Institute, an industry association.
US businesses — the primary purchasers of standalone cyber insurance policies — are facing broader exposure to data breaches and cyberattacks through their reliance on Internet of Things (IoT) technologies, the expansion of remote work, and greater use of cloud data storage, according to the Triple-I report.
Meanwhile, an August 2023 survey from cybersecurity firm Delinea found a rising list of exclusions that could make cyber insurance coverage void, including a lack of security protocols (43%), human error (38%), acts of war (33%), and not following proper compliance procedures (33%).
“Our survey results find that most organizations are not approaching cyber insurance with the same diligence — they are simply looking to get covered,” chief security scientist and advisory CISO at Delinea, Joseph Carson said in a press release when the survey was unveiled. “What they’re not checking is whether the policy they had last year is what they need now, or if their policy changed at renewal. This ‘cyber insurance gap’ could put a lot of organizations in a tough place when a cybersecurity incident occurs, and they want to utilize this financial safety net.”
In one case study highlighted by CYE, Capital One in July 2019 reported a major security breach with an estimated cost of US$138 million, including expenses related to customer notifications, credit monitoring, technology updates and legal support. Despite receiving US$73 million through insurance coverage, the company faced US$65 million in uncovered damages.
“This event highlights the substantial repercussions of cybersecurity breaches on companies, particularly when insurance does not fully cover the resultant financial losses,” the CYE report said.
