A Cyber Resilience approach is needed to manage and transfer cyber risk.
The disconnect between transferring risk through insurance and mitigating risk through security is causing the cyber insurance industry to experience significant price swings. After years of severe loss ratios at 60%-80%, insurers increased premiums by 94% from 2019 to 2022. In 2023, prices have dropped dramatically despite continued strong cybercrime trends from ransomware actors.
This whiplash makes planning for insurance incredibly difficult for organizations and hurts cyber insurance as a risk transfer tool. At Resilience, we’re taking a new approach to cyber insurance. Our policies work in conjunction with enhanced cybersecurity visibility, connecting our pricing and coverage to our clients’ unique risk profiles. This approach prioritizes aligning the risk transfer process with the organization’s overall risk management strategy and has helped us achieve loss ratios that are less than 1/3rd of the industry average in 2022.
The Insurance Problem
The cyber insurance industry needs more historical data and is overwhelmed by brilliant threat actors who are constantly changing the threat landscape. This has made it an incredible challenge to predict risk, leading to volatility in the cost of incidents. In 2020, ransomware alone cost $416 million. By 2021, it had more than tripled to $1.2 billion. This exponential growth has put immense pressure on cyber insurers to improve their loss ratios and increase their profitability.
The success of cyber insurance relies on data provided by cyber security, and risk mitigation relies on risk transfer to fill in any gaps. However, cybersecurity is losing faith in insurance solutions due to its disconnect from the more technical aspects of cyber risk. The insurance industry largely operates on status-quo benchmarking and fails to recognize the unique risks of organizations, leading to coverage and pricing that does not adequately address the right risks for each company.
A deeper approach has become necessary as cyber risks grow in complexity. Cyber risk modeling is a relatively new field that allows insurers to quantify their clients’ risk exposure. However, for traditional insurers who do not collect client data to feed these models, this can be just as ineffective as benchmarking. “Modeling cyber risk based on enhanced data visibility allows us to really understand which threats matter most,” said Davis Hake, Co-Founder at Resilience. “Our data tells our clients how much loss their organization can handle through their coverage and reserves while sharing prioritized security recommendations to help their organization handle a breach without experiencing business interruption.”
At Resilience, our access to our proprietary data models helps us offer coverage that addresses specific facets of our clients’ cyber risk. The work we do when underwriting policies is based on enhanced cybersecurity visibility from our expert assessments and analysis. These assessments consider the specific risk mitigation solutions that our clients have implemented to strengthen their risk posture. Referencing these controls on the front end and throughout our client’s policy periods allows our policies to respond to changes in the client’s risk profile. As our clients improve their controls and overall cyber hygiene, our underwriters continuously reference this data to offer coverage that aligns with their changing environment.
Most cyber insurance policies are issued after a one-time consultation with a risk manager, with questions answered by a security director and pricing based on industry benchmarking. Resilience takes a continuous approach to underwriting to adjust coverage based on improvements in the client’s security infrastructure. This process requires a partnership approach between our experts across insurance underwriting, claims, cybersecurity, risk quantification, etc. Our teams of experts are available to offer incident response support, connections for consultations around notification requirements, and 24/7 claims expertise to help our clients recover from an incident without impacting their ability to deliver value.
Through this partnership approach, we have seen dramatic results; out of our client base that opted into Resilience’s risk management solution with continuous engagement from our security team, none of the ransomware victims elected to pay any extortion in 2022. By providing this cross-departmental expertise, Resilience understands our clients’ risk profiles better than any traditional cyber insurance provider in the market, providing stability to our clients and a real partnership for managing cyber risk together.