Security and Compliance
Harden Now or Pay Later: Cybersecurity Insurance Policy Exclusions
Matt WielandTopics: Security and Compliance
Cybersecurity insurance has become a fundamental part of the risk management strategy for many businesses. As cyber threats evolve, insurance providers are adapting their policies to reflect the changing landscape and rising cost of claims payouts. Recent additions to cybersecurity insurance policy exclusions have tightened the terms and conditions for claim submissions, emphasizing the importance of up-to-date security measures.
In the United States, cybersecurity insurance rose an alarming 79% during Q2 of 2022. Unfortunately, this is just the tip of the iceberg, as this rise comes after two consecutive quarters of premiums doubling quarter over quarter. You read that correctly. Insurers are raising premiums, tightening their scrutiny, excluding vulnerable technologies, and adding new precautions around the type of cyberattacks they cover.
New Cybersecurity Insurance Policy Exclusions to Know
Critical Vulnerabilities
This exclusion means that if an attack or breach stems from a known critical vulnerability, recognized as a Common Vulnerability and Exposure (CVE) in the National Vulnerability Database, and you haven’t installed the necessary patch, the insurance carrier won’t cover the claim.*
Takeaway
Regularly update and patch your software. Plus, keeping your system up to date can prevent an attack from happening in the first place.
Outdated Hardware and Software
Using unsupported or legacy hardware or software that creates a vulnerability can leave you without coverage. New exclusions in some policies allow insurers to avoid claim payments if this is the case.*
Takeaway
Invest in maintaining, updating, or replacing outdated hardware and software. Not only does this safeguard your business, but it also ensures that you’re eligible for cybersecurity insurance coverage.
Zero Day Exclusion
This exclusion states that even if there was nothing you could have done to prevent the attack or breach, such as in the case of a zero-day exploit, the insurance company won’t protect you.*
Takeaway
While you can’t always prevent a zero-day attack, having a robust cybersecurity infrastructure and response plan can mitigate the damage. Also, consider working with another insurance company if you find this exclusion in your policy terms or renewal offers.
State-Backed Cyber Attacks
With the rise in state-backed cyberattacks, the corporate world must elevate their level of concern around this specific threat. Mindsets that retort back “we’re too insignificant to be a target” signal a need for a paradigm shift within the organization. Insurance companies are excluding certain attacks linked to war and conflict, leaving organizations exposed.**
Takeaway
State-backed threat actors create serious risk, even to non-strategically vital organizations. Watch for policy exclusions around state-sponsored attacks, while also building better defenses against these sophisticated attackers.
Cybersecurity Insurance Policy Exclusions
A Rapid Evolution
These new exclusions in cybersecurity insurance policies underline the importance of hardening your cybersecurity measures now. Cybersecurity partners like Recast Software can help you navigate these new challenges, meet common cybersecurity policy requirements, and ensure that your organization is taking proactive measures to secure your digital environment well beyond your cybersecurity policy minimums.
Recast Software’s suite of solutions can help your organization stay ahead of the curve. Reach out to us today to find out how we can tailor a cybersecurity strategy that aligns with your insurance requirements, keeping your business protected and compliant.
Sources
*https://www.cpapracticeadvisor.com/2022/10/12/cyber-insurance-changes-to-plan-for-in-2022/71561/
