Cyber insurance trends to look for in 2021

The cyber insurance industry is rapidly evolving, opening doors for stronger relationships between insurers and policyholders.

The cyber insurance firms that will be ahead of the curve are the ones that offer helpful tools, speak in layman’s terms and collaborate with the cybersecurity sector.

According to recent research conducted by Cowbell Cyber, 65% of small and medium-size businesses (SMEs) are planning to spend more on cyber insurance as part of their cyber resilience plan in the next two years. This comes as little surprise in the midst of COVID-19 as cybercriminals have become more opportunistic, and have developed new tactics to wreak havoc on their victims.

It is critical, now more than ever, for organizations to insure their most valuable assets, which of course includes their digital assets.

As the cyber insurance market evolves, industries of all types are realizing the need for specific, tailored cyber policies to address their unique needs. The coming year will usher in a wave of transformation for cyber insurance. Here are my three predictions on where the cyber insurance industry is heading.

Cyber insurance education will continue to grow.

The cyber insurance industry still has a long road ahead in educating, not only potential policyholders but also agents and brokers. But over the next few years, the educational gap should get smaller. In order to do so, insurers must offer accessible, easily digestible cyber policies for those who aren’t as familiar with cybersecurity, while still ensuring the intelligence and speed behind the policy can keep up with today’s digital landscape.

Businesses are increasingly becoming aware that cyber insurance is a necessity rather than a luxury. Many of them, however, aren’t sure how to select the right policy. In fact, according to research by Advisen and PartnerRe, the top three obstacles to selling and writing cyber insurance are:

Not understanding exposures;
Not understanding coverage; and
Cost.

Having a clearer picture and understanding of exactly what cyber attacks are covered — and what is not — is vital for policyholders. Further, the cyber insurance industry needs to continue getting better at explaining exposures and risks, leading to more transparency overall.

Ideally, the cyber insurance process should be 100% online, eliminating outdated and confusing questionnaires that result in unverifiable assessments. Going into the next few years, insurers will remove unnecessary jargon from policies and deliver an improved experience for both policyholders and insurers. Insurers also will provide helpful online tools for policyholders, which will educate them on the risks that are most threatening to their particular organizations.

Cybersecurity and insurance will develop close partnerships.

Once considered separate industries, the cybersecurity and cyber insurance sectors are growing closer together. This will create some interesting opportunities for both sides. For example, if a company has good cybersecurity measures in place, they’ll likely receive some insurance “coverage credits” akin to earning better auto insurance rates (thanks to driver telematics) when you’re a good driver, you earn better auto insurance rates and options.

Cyber resilience requires both cybersecurity and cyber insurance. In pursuit of cyber resilience, organizations deploy cybersecurity tools for threat protection, detection and mitigation. When an incident actually occurs, they need to be prepared with a response and recovery plan. Technology helps, but cyber insurance mitigates loss in the aftermath of an inevitable breach.

In the future, we will see insurers working closely with cybersecurity experts to provide coverage for more sophisticated attacks such as ransomware, cyber extortion, social engineering and business interruption.

Insurance industry language will become more standardized.

As mentioned above, one of the common reasons why businesses lag in adopting cyber insurance is a lack of coverage understanding. The cyber insurance industry has a lot of work to do in order to establish clarity. This includes dedicating simple terms to refer to each type of sensitive information, whether that be corporate files, health records or personal data.

Both security practitioners and insurers need to deploy clear messaging that illustrates exactly what risks businesses may have and how they can protect themselves. In addition, all stakeholders should work off of a single source of truth, curating policies with the philosophy that technology and comprehensive assessment will deliver the most protection.

The cyber insurance industry is rapidly evolving, opening doors for stronger relationships between insurers and policyholders. The cyber insurance firms that will be ahead of the curve are the ones that offer helpful tools, speak in layman’s terms and collaborate with the cybersecurity sector, empowering policyholders to learn more about the cyber landscape, as it relates to their particular business sector.

Leave a Reply Cancel reply

Commercial P&C Insurance

Commercial Office Space Set for a Strong Comeback

The sustained increase in demand for office space across the nation since late 2022 suggests that the market has moved past its lowest point, according to insights from the real estate technology platform, VTS. Demand for office space began to rise in late 2022 and continued into early 2023. Since then, the office market has experienced a period of stability and growth, supported by favorable economic factors, indicating a market rebound. This conclusion is drawn from the VTS Office Demand Index (VODI), which tracks unique new tenant tour requests for office properties in key U.S. markets. The VODI serves as an early indicator of future office leasing activity. According to the index, demand for office space has grown consistently over the past 12 months, closing the second quarter with a 17% year-over-year increase and a 34% rise from the VODI’s lowest point in December 2022. A significant shift in office-based employment patterns further supports the belief that demand for office space has stabilized. After reaching its peak in August 2022, office-based employment declined by 3.9% in early 2024. However, this trend has since stabilized, and employment growth has remained steady. Additionally, a recent decrease in work-from-home rates has fueled the renewed demand for office space. “They say you can only recognize a market bottom after it has passed, and the office space market is no exception. Following what we now see as the bottom, the national demand has gradually increased, though it remains susceptible to economic challenges,” said Nick Romito, CEO of VTS. “However, the growth observed in VODI over the past 18 months, coupled with positive trends in the office-using workforce, suggests that the market has reset, and the worst is behind us.” It’s important to note that this national trend does not impact all local markets equally. Cities like Los Angeles and New York City have seen healthy growth in office space demand, while markets such as San Francisco and Washington, D.C., have experienced prolonged stagnation. In Los Angeles, office space demand surged in the second quarter, briefly surpassing pre-COVID levels, driven by an increase in the average size of office spaces sought by tenants. New York City followed a similar overall pattern, though with some softness in the second quarter. Conversely, San Francisco’s demand for office space remains unpredictable, largely due to its tech-focused workforce, which continues to favor remote work more than other industries. “Markets heavily dependent on the tech sector, like San Francisco and Seattle, are on a markedly different post-COVID recovery path compared to more diversified markets like Los Angeles and New York City. It may take some time before we see office demand in San Francisco and Seattle return to pre-COVID levels,” added Ryan Masiello, Chief Strategy Officer at VTS.

Cyber Liability

Global IT Outage Puts Business Interruption Insurance in the Spotlight

In July, a global IT outage had a significant impact on business interruption insurance policies, overshadowing the effects on cyber insurance coverages. “This incident wasn’t a result of a malicious attack, which is why typical cyber insurance policies may not have been activated,” explained Peter McMurtrie, a partner in West Monroe’s insurance sector, in an interview with PropertyCasualty360.com. “Where coverage was applicable, factors like deductible amounts, waiting periods, and coverage limits played a critical role in determining the extent of exposure,” McMurtrie noted. “Standard policies for small businesses were less likely to offer coverage, while more complex policies for mid-sized companies and Fortune 500 corporations may have included broader triggers for non-malicious outages caused by third-party software issues.” The outage was triggered by a software update on July 19, 2024, by cybersecurity firm CrowdStrike, which affected organizations worldwide using Microsoft Windows. This interruption had far-reaching consequences, including disrupting hospital systems, media outlets, financial institutions, delaying thousands of flights, and halting daily business operations. McMurtrie emphasized that while the initial impact of the outage was similar for both large and small businesses, the ability to recover operations and whether insurance covered the loss of business income varied. “Larger companies are more likely to have advanced disaster recovery plans that ensure service redundancy following unexpected outages,” he added. “Their insurance programs also tend to cover a wider range of incidents.” According to Microsoft, the CrowdStrike update error affected over 8.5 million Windows devices globally. The incident highlighted the interconnected nature of our global ecosystem, including cloud providers, software platforms, security services, and their clients. “It’s a stark reminder of the importance of prioritizing safe deployment and disaster recovery across the tech industry,” the company said in a blog post. McMurtrie pointed out that the outage’s widespread impact was largely due to its effect on organizations that are critical to societal infrastructure—sectors like agriculture, airlines, banking, energy, government, healthcare, manufacturing, and retail. “Insurance companies base their risk appetite on their ability to understand and price risks appropriately. This becomes increasingly challenging with emerging threats,” he said. “However, I anticipate that insurers will respond by clarifying policy language, refining risk selection criteria, and possibly developing new products specifically designed for this evolving exposure.”

Cyber insurance trends to look for in 2021