Digital Risk: Enterprises Need More Than Cyber Insurance
Threatonomics

Cyber Resilience Must Do More

A New Approach to Cyber Insurance Coverage

by Killian Brady , COO Underwriting, Sales & Distribution at Resilience
Published

The disconnect between transferring risk through insurance and mitigating risk through security is causing the cyber insurance industry to experience significant price swings. After years of severe loss ratios at 60%-80%, insurers increased premiums by 94% from 2019 to 2022. In 2023, prices have dropped dramatically despite continued strong cybercrime trends from ransomware actors.

This whiplash makes planning for insurance incredibly difficult for organizations and hurts cyber insurance as a risk transfer tool. At Resilience, we’re taking a new approach to cyber insurance. Our policies work in conjunction with enhanced cybersecurity visibility, connecting our pricing and coverage to our clients’ unique risk profiles. This approach prioritizes aligning the risk transfer process with the organization’s overall risk management strategy and has helped us achieve loss ratios that are less than 1/3rd of the industry average in 2022.

Transforming Cyber Insurance to Meet Emerging Security Risks

The cyber insurance industry needs more historical data and is overwhelmed by brilliant threat actors who constantly change their threat tactics. This has made it an incredible challenge to predict risk, leading to volatility in incident costs. In 2023, ransomware payments surpassed the $1.1 billion mark, the highest number ever observed. This represents a significant increase from 2022, where ransomware payments were around $567 million, described as an “anomaly” compared to the overall upward trend. 

The success of cyber insurance relies on data provided by cyber security, and risk mitigation relies on risk transfer to fill in any gaps. However, cybersecurity is losing faith in insurance solutions due to its disconnect from the more technical aspects of cyber risk. The insurance industry largely operates on status-quo benchmarking and fails to recognize organizations’ unique risks, leading to coverage and pricing that do not adequately address the right risks for each company.

A deeper approach has become necessary as cyber risks grow in complexity. Cyber risk modeling is a relatively new field that allows insurers to quantify their clients’ risk exposure. However, for traditional insurers who do not collect client data to feed these models, this can be just as ineffective as benchmarking.“Modeling cyber risk based on enhanced data visibility allows us to understand which threats matter most,” said Davis Hake, Co-Founder at Resilience. “Our data tells our clients how much loss their organization can handle through their coverage and reserves while sharing prioritized security recommendations to help their organization handle a breach without experiencing business interruption.”

Blending Insurance Coverage with Proactive Risk Management

At Resilience, our access to proprietary data models helps us offer coverage that addresses specific facets of our clients’ cyber risk. The work we do when we, as underwriters, base our policies on enhanced cybersecurity visibility is what we do from our expert assessments and analysis. These assessments consider the specific risk mitigation solutions that our clients have implemented to strengthen their risk posture. 

Referencing these controls on the front end and throughout our client’s policy periods allows our policies to respond to client risk profile changes. As our clients improve their controls and overall cyber hygiene, our underwriters continuously reference this data to offer coverage that aligns with their changing environment.

During a one-time consultation, most cyber insurance companies issue policies  with a risk manager, with questions answered by a security director and pricing based on industry benchmarking. Resilience takes a continuous approach to underwriting to adjust coverage based on improvements in the client’s security infrastructure. 

This process requires a partnership approach between our experts across insurance underwriting, claims, cybersecurity, risk quantification, etc. Our teams of experts are available to offer incident response support, connections for consultations around notification requirements, and 24/7 claims expertise to help our clients recover from an incident without impacting their ability to deliver value.
Through this partnership approach, we have seen dramatic results; out of our client base that opted into Resilience’s risk management solution with continuous engagement from our security team, none of the ransomware victims elected to pay any extortion in 2022.

Enhancing Your Cybersecurity Strategy with Comprehensive Insurance Coverage

By providing this cross-departmental expertise, Resilience understands our clients’ risk profiles better than any traditional cyber insurance provider in the market. This provides stability to our clients and a real partnership for managing cyber risk together.

With Resilience, you gain more than just insurance; you achieve a proactive, adaptive strategy tailored to the unique challenges of your business. Experience the difference with Resilience and ensure your organization is protected and prepared. Request a demo today and see how our innovative approach to cyber insurance coverage can enhance your company’s resilience against cyber threats.

You might also like

How to get everyone on the same page about your cybersecurity plan

Everyone needs cybersecurity–and we’d argue that most organizations need cyber insurance–but not everyone understands how or why cyber risk solutions actually benefit their company. Resilience is tackling both the “how” and the “why” with our dual product offerings: The Edge Solution Platform and the Edge Engagement Summary. First, the Edge Solution. Edge is packed with […]

2025 cybersecurity and insurance predictions

Get ready for threats both old and new in 2025

It’s prediction season, and while no one can see into the future, we can definitely take some educated guesses. From increasingly severe ransomware attacks to deepfakes that deceive Fortune 500 companies, we’re keeping an eye out for some major events in 2025. And while many organizations are taking steps to beef up their defenses, the […]

Contrasting and comparing FAIR with the Resilience solution

As market awareness of cyber risk quantification grows, we frequently receive questions from clients and curious risk managers about FAIR (Factor Analysis of Information Risk)—what it is, whether it truly provides accurate cyber risk quantification, the effort needed to set it up and maintain, and more. Clients often ask us to compare the FAIR methodology […]

How does Resilience establish the probabilities presented in my LEC?

Managing risk successfully at any level requires an understanding of a concept called “probability.” As both an insurance company (risk transfer) and a cyber risk management company, Resilience relies on understanding probabilities to price our services and to guide our clients to greater levels of cyber resilience. As we often receive questions from our clients […]

Moving beyond heat maps for better risk management

Heat maps are among the most widely used—and debated—tools for risk managers worldwide to communicate risks in their registries or project portfolios. Despite their popularity, we advise leaders seeking transparency in discussing risk and value to avoid relying on them. What are heat maps? Risk managers often use heat maps (or risk matrices) to represent […]

Breaking Lemonade: Understanding Value at Risk

I talk a lot about value-at-risk among my colleagues, with our customers, and the broader market. Value-at-risk may be the single most important measure to grasp, without which one cannot accurately measure risk transfer, excess risk, risk acceptance, and return on controls. Yet, these are all important concepts that leadership in modern organizations need to […]