The future of cyber insurance: Navigating the complex digital landscape

As technology continues to advance at an unprecedented pace, our dependence on digital systems and data has grown exponentially. This rapid digital transformation has also brought about a myriad of cybersecurity risks, making cyber insurance increasingly vital to modern risk management. Cybercriminals continuously find new ways to exploit vulnerabilities in networks, systems and applications, causing massive financial losses, reputational damage and legal liabilities. This has driven up demand for cyber insurance, leading to a transformation in the way policies are designed and implemented. Rising premiums and fine print exclusions pose a threat to broadcasters trying to insure against events that trigger significant business interruption and lost ad revenue. 

The future of cyber insurance lies in its ability to adapt to emerging threats.  In a recent report, IBM found that ransomware breaches grew 41% over the last year and took 49 days longer than average to identify and contain. During such events, businesses averaged $4.54M of cost due to ransomware attacks. In a December 2022 interview with the Financial Times, Zurich CEO, Mario Greco, warned that cyber-attacks “…will become uninsurable…”  

Insurers have consistently increased premiums and limited coverage in recent years due to the influx of cyber claims.  A.M. Best Co. reported a “notable” 8.4% increase in Q1 2023 cyber premiums. The evolving landscape calls for broader coverage scope, leading some insurers to drop cyber coverage altogether.  But where does that leave you?

These factors are leading many organizations to reevaluate cyber insurance in the marketplace, looking into alternative risk solutions, in addition to beefing up corporate infrastructure and protocols to defend against attacks and reduce the impact of the inevitable breach.

Threats to Rising Cyber Insurance Premiums

Artificial Intelligence seems to be dominating current news feeds. ChatGPT, the “metaverse,” and other similar technologies are showing signs of tremendous value to companies, but, at what cost?  This same technology is and will be used in cyber-attacks that will lock down ad servers and jam signals. Incredible infrastructure and protocols are being implemented to try and thwart these attacks, but as technology changes, daily defense measures must also. Information Security Officers have their hands full with implementing mechanisms and procedures to prevent attacks from happening and to mitigate attacks that penetrate defenses. Cyber-attack insurance coverages, exclusions, and limits shouldn’t be another concern on the list.

Information security stakeholders need a reliable safety net that doesn’t exclude certain protections when needed most. Insurance reserves shouldn’t be held hostage at the same time servers are.  Many marketplace cyber policies will pursue a resolution with ransomware criminals that could take days, weeks or months at a time. Self-insured broadcasters can be reimbursed almost immediately from a qualified cyber-attack, reducing or eliminating loss of income.

Grayson Price, chief operating officer of Preservation Services

Benefits to Self-Insuring Against Cyber Risks

Self-insuring against cyber risks involves assuming the financial burden of potential incidents without relying on external insurance providers. This approach can be appealing for financially stable organizations with robust cybersecurity measures already in place. Self-insurance allows broadcasters to retain control over their response strategy, tailor coverage to their specific needs, and potentially save on premium costs. Self-insuring via captive insurance affords broadcasters even more control and flexibility to design policies that precisely align with their risk appetite and risk management frameworks.  

Captive insurance is an alternative risk solution that allows a non-insurance company to set up a wholly owned insurance company to cover its own risk in an effort to lower costs. Self-insuring through the use of captive insurance helps broadcasters avoid certain exclusions that marketplace insurers implement in order to reduce claims payouts in an ultimate effort to protect other insureds in their pools and to prevent skyrocketing premiums each year.  This customization ensures that policy coverages directly address their unique vulnerabilities and mitigates risks specific to their operations.  

According to the National Association of Insurance Commissioners, approximately 90% of Fortune 500 companies are self-insured through a captive insurance model. The benefits achieved at the Fortune 500 level can also be achieved in small and mid-sized markets as well.  A broadcaster would be able to store up its own reserves year over year during “good” years with low or no claims and use those reserves in “bad” years when events may occur.  

Another benefit to self-insuring in a captive is quicker claim turnaround. Reimbursement for an approved claim can be issued within a day or two of an incident and can be used to purchase new servers, download back up data, etc. instead of waiting on negotiations with an attacker to release the data.  Additionally, broadcasters can avoid potential disputes with insurers over coverage and claims. This eliminates the need to interpret policy wording and mitigates the risk of coverage gaps that might exist in marketplace policies.  

Conclusion

The insurance landscape is changing whether we like it or not.  Pooled risk in marketplace insurance is making it harder for broadcasters to contain cost on cyber and other policies. Policy exclusions are making it more difficult to cover necessary threats. Regardless of a broadcaster’s risk appetite, alternative risk solutions like captive insurance should be a topic of discussion.