Cyber Insurance

As cyber risk has grown, cyber insurance has become an important way for organisations to transfer part of its financial impact. Policies vary widely, but typically cover two types of loss.

First-party cover pays the insured organisation's own costs, such as investigating and responding to an incident, restoring data and systems, notifying affected customers, lost income from business interruption and, in some cases, ransom payments where legal. Third-party cover pays for claims from others, such as customers whose data was stolen, and regulatory fines and penalties where insurable.

For example, after a data breach exposing customer records, a retailer's cyber policy might pay for forensic experts, legal advice, customer notifications, credit monitoring services and settlements with affected customers.

Insurers increasingly require minimum security standards, such as multi-factor authentication and regular backups, before offering cover. The market has faced challenges, including rising ransomware claims, difficulty modelling risk and the potential for one widespread attack to affect many policyholders at once. Exclusions, such as for acts of war, can be significant.