How ransomware is affecting the cyber insurance industry

Remember the good old days when ransomware wasn’t so rampant across industries and all types of companies, large and small? Us too. Unfortunately, the way in which hackers are using ransomware has changed significantly in the last several years, leaving every company vulnerable. So, many companies have turned to cyber insurance to protect their bottom line in the case of an attack. 

A recent SonicWall 2022 Cyber Threat Report claimed that governments around the world saw a 1,885% increase in ransomware attacks in 2021. But the rise of ransomware attacks isn’t just affecting the businesses being targeted — it’s making a huge impact on cyber insurance companies. According to credit ratings agency AM Best, ransomware now accounts for 75% of all cyber insurance claims.

Cyber insurance companies are often stuck paying the ransom, which is starting to impact cyber insurance services. The result? Skyrocketing premiums, new stipulations that make it harder for companies to qualify for cyber insurance, and insurance carriers leaving the game altogether. 

That being said, cyber insurance is still a necessity for nearly all companies, especially small and mid-sized enterprises (SME) that likely couldn’t survive the financial devastation of a breach or ransomware attack. So what can you do?

Here’s how ransomware is affecting your ability to purchase cyber insurance and how you can adapt without breaking your company’s bank.

Ransomware is running rampant

Modern ransomware is evolving to become more insidious — and more successful. Hackers are no longer just searching for valuable data to encrypt but to also leverage as blackmail. Hackers will steal this information and threaten to publish it if the company doesn’t pay up. This means that just having regular backups isn’t sufficient.

To increase their odds of success, hackers are using more sophisticated software and tools to automatically send phishing emails and scan the internet for gaps in security that can be exploited. This allows hackers to work much faster similar to how your business gains efficiency through process automation.

With thousands of automated attacks running constantly, and the average ransomware payment hitting $570,000, the ransomware industry is proving to be incredibly profitable, attracting bigger players like the Italian Mafia and nation-states.

If you have cyber insurance, the ransom payment is often covered. However this is starting to change as insurers have started to amount hefty losses. Liability limits continues to go down as a result.

Cyber insurance carriers are responding in a big way

Because cybercrime is on the rise and cyber insurance is becoming more costly to support, carriers are responding in some pretty extreme ways. Premiums for cyber insurance are skyrocketing. In Q4 of 2021, the Marsh Global Insurance Market Index reported that cyber insurance pricing spiked by 130% in the U.S. And the CEO of AIG said premiums have increased 40% for clients. Those trends aren’t likely to slow as Standard & Poor’s Corp. predicts cyber insurance premiums will increase 20% to 30% per year in the near future. 

Fortunately, SMEs aren’t seeing premium increases that are quite this high, but they are facing a different challenge. And that’s the fact that carriers are becoming more selective in the companies they choose to insure, limiting coverage and creating strict requirements to attain it. 

A weak security posture poses a greater risk of a breach. So many insurance carriers now require companies have the following in place:

• Multi-factor authentication: By enabling multi-factor authentication, having a user’s credentials will not be enough for a hacker to break into your network and lock up your data.   
• Robust vulnerability and patching management: Patching critical patches (fixing known vulnerabilities) within 24 hours drastically reduces the attack surface an attacker can take advantage of. 
• Principles of least privilege: By limiting the number of people who have access to sensitive data, you limit the opportunities hackers have to break into your environment and access that data.   
• Security tech stack: Implementation of a cohesive set of security tools to detect and respond to cyber attacks.

Other companies, like AXA, are continuing to offer cyber insurance but have ceased offering coverage for ransomware attacks, knowing that paying the ransom will only feed the cycle and encourage criminals to increase the pace and severity of attacks. Given the rate of ransomware attacks, this means organization’s can’t just leave the responsibility to their cyber insurance provider.

How organizations can adapt to cyber insurance changes

Increased premiums and requirements for coverage pose a great challenge for all companies, especially for SMEs with limited resources to manage a robust security program. But going without cyber insurance also isn’t an option. The best way to protect your business is to invest in the minimum effective dose of cyber security and do your research before buying a cyber insurance policy. 

Make sure you clearly understand the requirements needed to attain cyber insurance — while keeping reasonable rates — then work towards setting up the appropriate security controls to meet those requirements. Though setting up those controls will be an investment in and of itself, it will lead to lower premiums and a lower risk of a breach, saving you money over time. 

Once you’ve secured your environment, make sure you know what is and isn’t covered by your cyber insurance. Don’t assume that ransomware is covered as many carriers have removed that from their offering.

To protect your company against a devastating ransomware attack and secure the best rates, SMEs should consider partnering with an MSSP in conjunction with a cyber insurance policy. A good MSSP will act as an outsourced security department, helping you secure the tools and protocols needed to protect your environment against a ransomware attack — and help you meet cyber insurance requirements. They’ll provide 24/7/365 monitoring, detection and response services, so you’ll not only be able to attain great insurance rates, but you’ll be protected against the most damaging attacks.

SolCyber is a modern MSSP that helps SMEs get Foundational Coverage that enhances their security posture without unnecessary tools that add expenses but not protection. Through our Insurance+ Program, you’ll not only get security tools and services but we’ll help fast track your cyber insurance application process and help you save up to 30% on premiums.

If you need help improving your security or navigating the world of cyber insurance, drop us a note and let’s chat. 

TAKE OUR 3-MINUTE CYBER INSURANCE RISK QUIZ AND FIND OUT YOUR RISK SCORE!