Business Daily Media

Just 25% of business are insured against cyber attacks. Here's why

  • Written by Jongkil Jay Jeong, CyberCRC Senior Research Fellow, Centre for Cyber Security Research and Innovation (CSRI), Deakin University
Just 25% of business are insured against cyber attacks. Here's why

In the past financial year, the Australian Cyber Security Centre received 76,000 cyber-crime reports[1] – on average, one every seven minutes. The year before, it was a report every eight minutes. The year before that, every ten minutes.

The growth of cyber crime means it is now arguably the top risk facing any business[2] with an online presence. One successful cyber attack is all it takes to ruin an organisation’s reputation and bottom line. The estimated cost to the Australian economy in 2021 was $42 billion[3].

Read more: Why are there so many data breaches? A growing industry of criminals is brokering in stolen data[4]

To protect itself (and its customers), a business has three main options. It can limit the amount of sensitive data it stores. It can take greater care to protect the data it does store. And it can insure itself against the consequences of a cyber attack.

Cyber-insurance is a broad term for insurance policies that address losses as a result of a computer-based attack or malfunction of a firm’s information technology systems. This can include costs associated with business interruptions, responding to the incident and paying relevant fines and penalties.

The global cyber-insurance market is now worth an estimated US$9 billion (A$13.9 billion). It is tipped to grow to US$22 billion by 2025[5].

But a big part of this growth reflects escalating premium costs – in Australia they increased more than 80% in 2021[6] – rather than more business taking up insurance.

So coverage rates are growing slowly, with about 75% of all businesses in Australia having no cyber-insurance, according to 2021 figures from the Insurance Council of Australia[7].

Challenges in pricing cyber-insurance

With cyber-insurance still in its infancy, insurers face significant complexities in quantifying cyber risk pricing premiums accordingly – high enough for the insurers not to lose money, but as competitive as possible to encourage greater uptake.

A 2018 assessment of the cyber-insurance market by the US Cybersecurity and Infrastructure Security Agency[8] identified three major challenges: lack of data, methodological limitations, and lack of information sharing.

Read more: How cybercriminals turn paper checks stolen from mailboxes into bitcoin[9]

Lack of historical loss data means insurers are hampered in accurately predicting risks and costs.

Because of the relative newness of cyber crime, many insurers use risk-assessment methodologies derived from more established insurance markets such as for car, house and contents[10]. These markets, however, are not analogous to cyber crime.

Companies may be hesitant to disclose information about cyber incidents, unless required to do so. Insurance carriers are reluctant to share data pertaining to damage and claims.

This makes it hard to create effective risk models that can calculate and predict the likelihood and cost of future incidents.

So what needs to be done?

Deakin University’s Centre for Cyber Security Research and Innovation[11] has been working with insurance companies to understand what must be done to improve premium and risks models pertaining to cyber insurance.

Here is what we have found so far.

First, greater transparency is needed around cyber-related incidents and insurance to help remedy the lack of data and information sharing.

The federal government has taken two steps in the right direction on this.

One is the Consumer Data Right[12], which provides guidelines on how service providers must share data about customers. This came into effect in mid-2021.

The other is the government’s proposal to amend privacy legislation[13] to increase penalties for breaches and give the Privacy Commissioner new powers.

Read more: After the Optus data breach, Australia needs mandatory disclosure laws[14]

Second, insurers must find better ways to measure the financial value and worth of the data that organisations hold.

The primary asset covered by cyber insurance is the data itself. But there is no concrete measure of how that data is worth.

The recent Optus and Medibank Private data breaches provide clear examples. The Optus event affected millions more people than the Medibank Private hack, but the Medibank Private data includes sensitive medical data[15] that, in principle, is worth far more than data regarding just your personal identity.

Without an accurate way to measure the financial value of data, it is difficult to determine the appropriate premium costs and coverage.

Cyber insurance is a new, specialised market with significant uncertainty. Given the ever-increasing risks to individuals, organisations and society, it is imperative that insurers develop robust and reliable risk-based models as soon as possible.

This will require a consolidated effort between cyber-security experts, accountants and actuaries, insurance professionals and policymakers.

Authors: Jongkil Jay Jeong, CyberCRC Senior Research Fellow, Centre for Cyber Security Research and Innovation (CSRI), Deakin University

Read more https://theconversation.com/just-25-of-business-are-insured-against-cyber-attacks-heres-why-193533

TDCR Founder John Fenga on Reshaping Cryptocurrency Transactions

John Fenga, the CEO and founder of The Digital Currency Reserve (TDCR), is leading the charge to transform the cryptocurrency landscape with innovat...

Business Borrowing on the Rise – Why You Need to Prioritise Cash Flow Heading into 2025

With 2025 on our doorstep, it’s vital that business owners commit to better understanding their company cash flow in the New Year, amid an increas...

2025: E-Commerce's Reinvention Begins Now

This has been a year of disruption for the retail sector, but if 2024 was about survival, 2025 is about reinvention. With consumers evolving faster ...

4 Key Ways to Protect Your Small Business During Your 2025 Launch

With a focus on key protective measures, these tips equip you with the necessary insights to ensure a successful and secure start. Whether you're ...

Digital Matter Launches New Tracking Solution

New Remote Monitoring Solution:  Accuracy, Performance and Longevity   Digital Matter, a leader in low-power GPS and IoT hardware development, ha...

Unveiling Amazon Nova: The New Generation of Foundation Models

Amazon’s latest state-of-the-art foundation models offer intelligence and industry-leading price performance Amazon Nova models enhance the exten...

Sell by LayBy