Business Daily Media

Business Marketing


Just 25% of business are insured against cyber attacks. Here's why

  • Written by Jongkil Jay Jeong, CyberCRC Senior Research Fellow, Centre for Cyber Security Research and Innovation (CSRI), Deakin University
Just 25% of business are insured against cyber attacks. Here's why

In the past financial year, the Australian Cyber Security Centre received 76,000 cyber-crime reports[1] – on average, one every seven minutes. The year before, it was a report every eight minutes. The year before that, every ten minutes.

The growth of cyber crime means it is now arguably the top risk facing any business[2] with an online presence. One successful cyber attack is all it takes to ruin an organisation’s reputation and bottom line. The estimated cost to the Australian economy in 2021 was $42 billion[3].

Read more: Why are there so many data breaches? A growing industry of criminals is brokering in stolen data[4]

To protect itself (and its customers), a business has three main options. It can limit the amount of sensitive data it stores. It can take greater care to protect the data it does store. And it can insure itself against the consequences of a cyber attack.

Cyber-insurance is a broad term for insurance policies that address losses as a result of a computer-based attack or malfunction of a firm’s information technology systems. This can include costs associated with business interruptions, responding to the incident and paying relevant fines and penalties.

The global cyber-insurance market is now worth an estimated US$9 billion (A$13.9 billion). It is tipped to grow to US$22 billion by 2025[5].

But a big part of this growth reflects escalating premium costs – in Australia they increased more than 80% in 2021[6] – rather than more business taking up insurance.

So coverage rates are growing slowly, with about 75% of all businesses in Australia having no cyber-insurance, according to 2021 figures from the Insurance Council of Australia[7].

Challenges in pricing cyber-insurance

With cyber-insurance still in its infancy, insurers face significant complexities in quantifying cyber risk pricing premiums accordingly – high enough for the insurers not to lose money, but as competitive as possible to encourage greater uptake.

A 2018 assessment of the cyber-insurance market by the US Cybersecurity and Infrastructure Security Agency[8] identified three major challenges: lack of data, methodological limitations, and lack of information sharing.

Read more: How cybercriminals turn paper checks stolen from mailboxes into bitcoin[9]

Lack of historical loss data means insurers are hampered in accurately predicting risks and costs.

Because of the relative newness of cyber crime, many insurers use risk-assessment methodologies derived from more established insurance markets such as for car, house and contents[10]. These markets, however, are not analogous to cyber crime.

Companies may be hesitant to disclose information about cyber incidents, unless required to do so. Insurance carriers are reluctant to share data pertaining to damage and claims.

This makes it hard to create effective risk models that can calculate and predict the likelihood and cost of future incidents.

So what needs to be done?

Deakin University’s Centre for Cyber Security Research and Innovation[11] has been working with insurance companies to understand what must be done to improve premium and risks models pertaining to cyber insurance.

Here is what we have found so far.

First, greater transparency is needed around cyber-related incidents and insurance to help remedy the lack of data and information sharing.

The federal government has taken two steps in the right direction on this.

One is the Consumer Data Right[12], which provides guidelines on how service providers must share data about customers. This came into effect in mid-2021.

The other is the government’s proposal to amend privacy legislation[13] to increase penalties for breaches and give the Privacy Commissioner new powers.

Read more: After the Optus data breach, Australia needs mandatory disclosure laws[14]

Second, insurers must find better ways to measure the financial value and worth of the data that organisations hold.

The primary asset covered by cyber insurance is the data itself. But there is no concrete measure of how that data is worth.

The recent Optus and Medibank Private data breaches provide clear examples. The Optus event affected millions more people than the Medibank Private hack, but the Medibank Private data includes sensitive medical data[15] that, in principle, is worth far more than data regarding just your personal identity.

Without an accurate way to measure the financial value of data, it is difficult to determine the appropriate premium costs and coverage.

Cyber insurance is a new, specialised market with significant uncertainty. Given the ever-increasing risks to individuals, organisations and society, it is imperative that insurers develop robust and reliable risk-based models as soon as possible.

This will require a consolidated effort between cyber-security experts, accountants and actuaries, insurance professionals and policymakers.

Authors: Jongkil Jay Jeong, CyberCRC Senior Research Fellow, Centre for Cyber Security Research and Innovation (CSRI), Deakin University

Read more


Sign of the times: why the art of signwriting is making a comeback in 2020

Homo sapiens might be 200,000 years old but writing is relatively new, only emerging around 5,000 years ago in Mesopotamia. The human-drawn image on the other hand is much older. The oldest cave paintings from Spain date back...

Self-employed Australians not achieving their full business potential due to lack of mentoring

New research by RedZed, a leading loan specialist for the self-employed, has revealed that only 1 in 5 self-employed Australians currently have a mentor and nearly half have never had one. However, of those who have had a mentor...

Shop Small is Back with Business Grants to Support Small Businesses

American Express’ Shop Small movement returns for its 11th year in Australia, highlighting the valuable contribution small businesses make while encouraging shoppers to show their support.     New this year, Americ...