Incident-specific cyber insurance

The development of technology and the way businesses exchange sensitive information all over the world is through IT resources. As a consequence of such reality, cyber events are more likely to occur with the banking sector as one of the major targets. Cyber insurance is one of the possible protection options. The main goal of this research is to assess the supply of cyber insurance among the banking sector operating in Portugal. To obtain the main goal, the research is based on a 'state of the art' literature review of the cyber insurance market in the world and in the country. An empirical study is made through the application of questionnaires to evaluate potential cyber insurance suppliers. The main findings of this study relate to the fact that the topic is relevant, but no one is prepared to provide the service, and there is a huge market to grow.

The Case for Banning (and Mandating) Ransomware Insurance

As businesses have embraced more and more technology, cyber risk has become one of the essential components of a risk management initiative that seeks to mitigate and analyze the multitude of new risks. One risk mitigation process is investing in cyber insurance to safeguard the organisations’ assets from cyber threats by transferring them to the insurer. For businesses to decide on cyber insurance, choosing the right insurance plan and policy is crucial. To do so, they need to consider the factors of its implementation. Therefore, this paper aims to investigate the adoption of cyber insurance in Malaysian organisations, thus further exploring the organisations' perceptions of the factors of adopting cyber insurance. A qualitative study is conducted to understand and describe Malaysian organisations’ needs, obstacles, and processes related to cyber insurance adoption by interviewing cybersecurity professionals and cyber insurance personnel to explore valuable insight into the existing knowledge. 30% of the respondents have adopted cyber insurance. While 40% of the respondents were unsure, the other 30% did not adopt cyber insurance in their organisation respectively. These insights include the factors in adopting cyber insurance among Malaysian organisations, which might be crucial for informing future research and practice in the cyber insurance industry. The novelty of this research is the overview of knowledge gaps and perceptions related to the adoption of cyber insurance in Malaysian organisations. Also, this research aims to consider the advantages of the relevant obstacles that influence the decision makers to adopt cyber insurance.

PurposeIn recent years, the frequency and severity of cybersecurity incidents have prompted customers to seek out specialized insurance products. However, this has also presented insurers with operational challenges and increased costs. The assessment of risks for health systems and cyber–physical systems (CPS) necessitates a heightened degree of attention. The significant values of potential damages and claims request a solid insurance system, part of cyber-resilience. This research paper focuses on the emerging cyber insurance market that is currently in the process of standardizing and improving its risk analysis concerning the potential insured entity.Design/methodology/approachThe authors' approach involves a quantitative analysis utilizing a Likert-style questionnaire designed to survey cyber insurance professionals. The authors' aim is to identify the current methods used in gathering information from potential clients, as well as the manner in which this information is analyzed by the insurers. Additionally, the authors gather insights on potential improvements that could be made to this process.FindingsThe study the authors elaborated it has a particularly important cyber and risk components for insurance area, because it addresses a “niche” area not yet proper addressed in specialized literature – cyber insurance. Cyber risk management approaches are not uniform at the international level, nor at the insurer level. Also, not all insurers can perform solid assessments, especially since their companies should first prove that they are fully compliant with international cyber security standards.Research limitations/implicationsThis research has concentrated on analyzing the current practices in terms of gathering information about the insured entity before issuing the cyber insurance policy, level of details concerning the cyber security posture of the insured entity and way such information should be analyzed in a standardized and useful manner. The novelty of this research resides in the analysis performed as detailed above and the proposals in terms of information gathered, depth of analysis and standardization of approach made. Future work on the topic can focus on the standardization process for analyzing cyber risk for insurance clients, to improve the proposal based also on historical elements and trends in the market. Thus, future research can further refine the standardization process to analyze in more depth the way this can be implemented and included in relevant legislation at the EU level.Practical implicationsProposed improvements include proposals in terms of the level of detail and the usefulness of an independent centralized approach for information gathering and analysis, especially given the re-insurance and brokerage activities. The authors also propose a common practical procedural approach in risk management, with the involvement of insurance companies and certification institutions of cyber security auditors.Originality/valueThe study investigates the information gathered by insurers from potential clients of cyber insurance and the way this is analyzed and updated for issuance of the insurance policy.

Cyber insurance is becoming an essential tool for managing cybersecurity risks. In this study, we analyze how having the option to subscribe to cyber insurance services affects firms’ risk prevention and mitigation decisions. We model the scenario where the firm purchases cyber insurance in a competitive insurance market and compare it against the case when it does not purchase cyber insurance. When there is a breach, cyber insurance can help cover mitigation expenses and breach losses. Consistent with the prior literature, we find that in most cases cyber insurance exacerbates ex ante moral hazard by decreasing expected risk prevention. However, it enhances ex post efforts by increasing expected risk mitigation, which can lead to more positive outcomes for the insured firm. The mechanism involves designing the contract with a delicate calibration of the coverage of breach losses and the coinsurance rate. Moreover, the findings highlight the importance of a healthy risk mitigation service market in managing cybersecurity risks. Funding: This research was supported in part by the Hong Kong SAR General Research Fund project [16502417]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/serv.2021.0120 .

This paper introduces a novel cyber incident cost estimation methodology, applicable to large Australian healthcare providers. A review demonstrates the poor utility of current risk estimation approaches and the vulnerability of healthcare networks is evaluated using Leibniz’s law of indiscernibles, and Evans’ theory of vague objects. Finally, a quantitative cost calculation method is proposed, merging temporal and impact variables with service data from the Australian Institute of Health and Welfare. This research demonstrates that existing attempts to measure cyber incident risk produces vague results. This is evidenced by 929 Australian healthcare data breaches recorded over 5 years, a AU$0.6bn annual national risk exposure, and low levels of healthcare cyber maturity across three states. The likelihood of data breaches is reported as 99.4%, with known ICT vulnerabilities exceeding 207,000. After logically concluding that healthcare networks are fundamentally insecure, an ‘operational shock’ calculation method is modelled against the AIHW data, to illustrate realistic cyber incident costs. This returns an exposure across Australia’s acute care hospital network of AU$148.1 m from a single incident that takes 1 week to resolve. In considering this quantum, risk transfer options using cyber insurance and improved agency cyber risk programs are required to mitigate significant financial risks.

Ransomware is a growing threat to individuals and enterprises alike, constituting a major factor in cyber insurance and in the security planning of every organization. Although the game theoretic lens often frames the game as a competition between equals -- a profit maximizing attacker and a loss minimizing defender -- the reality of many situations is that ransomware organizations are not playing a non-cooperative game, they are playing a lottery. The wanton behavior of attackers creates a situation where many victims are hit more than once by ransomware operators, sometimes even by the same group. If defenders wish to combat malware, they must then seek to remove the incentives of it. In this work, we construct an expected value model based on data from actual ransomware attacks and identify three variables: the value of payments, the cost of an attack, and the probability of payment. Using this model, we consider the potential to manipulate these variables to reduce the profit motive associated with ransomware attack. Based on the model, we present mitigations to encourage an environment that is hostile to ransomware operators. In particular, we find that off-site backups and government incentives for their adoption are the most fruitful avenue for combating ransomware.

Cybersecurity vulnerabilities of cardiac implantable electronic devices: Communication strategies for clinicians—Proceedings of the Heart Rhythm Society's Leadership Summit

The COVID-19 pandemic was a turning point for all participants in economic relations. The insurance market has faced new challenges related to the format of cooperation with clients changing, as well as the transformation of clients’ business. Remote work has identified threats that can not only stop the industry but also destroy it. One of the examples of such threats is DDoS-attacks, targeted at stopping the computer systems of the victims of the attack. In 2021, the share of organizations that suffered losses after DDoS-attack increased to 86.2 %, 9 pp more than before the COVID-19 pandemic. IT administrators sometimes don’t notice the consequences of attacks, so they can’t assess the state of their business entirely. Cybersecurity experts should be involved in this monitoring, but often they only restore IT systems, without compensation. The set of services in cyber-insurance policy consists of: monitoring the client’s IT systems, providing recommendations for its improvement, assistance in case of DDOS-attack, payment of compensation, and restoration of reputation. Therefore, DDoS-attacks insurance has become more popular during the COVID-19 pandemic. The volume of the cyber-insurance market grew by 39 % in 2020 and reached $7 billion vs 2018. The primary insurers in this area are media and publications, as all their activities are built on Internet-based systems. The article examines the transformation of the cyber insurance market in the world before and after the beginning of the COVID-19 pandemic. The state and prospects of DDoS-attacks insurance are considered, and the necessity of developing of this type of insurance in Ukraine is proved. Recommendations are provided for the introduction of cyber DDoS-attacks insurance products in the portfolio of Ukrainian insurance companies in the context of the Digital Strategy of Ukraine 2030.

Cybersecurity has become one of the greatest challenges in today’s post pandemic, digital and interconnected world, and also a subject of strategic importance for the insurance industry. There is no doubt that the advance of technology and the increased use of big data and cloud computing have set up an opportunity for insurance business, but they also expanded insurance companies’ vulnerabilities towards cyber risk. As insurers collect a large amount of confidential data, including protected personal sensitive information, they are a natural target for cyber-attacks. On the one hand, the aim of the article is to indicate how the risks associated with digitalisation affect the day-to-day operations in selected business areas of an insurance company, and which methods may be used to manage them, on the other. After a general review of cyber risk based on recent branch reports and survey results, the authors identified its global economic impact with particular regard to financial institutions, and also insurers’ exposure and perception of cyber risk and cybersecurity spending. Moreover, administrative decisions issued by the President of the Personal Data Protection Office in Poland, selected jurisdictions and loss scenarios for insurance companies were examined with a deeper dive into underwriting, selling, administration and claims handling processes. The results of the literature study show that cyber risk is recognized to be one of the most significant non-financial risks (in terms of the source, not result of the risk) for insurers and that many proactive security measures can be implemented. However, due to the high vulnerability to leaks of confidential personal and financial data or unauthorized system access, which may cause not only financial loss, but also business interruptions and reputational damage, in the authors’ opinion, loss prevention and reduction are insufficient. Thus, both insurance and non-insurance methods of external financing cyber risk results were indicated. On this basis, the cyber insurance is considered by the authors to be the best tool providing both prevention and financial compensation in case of cyber incidents, also in insurance companies.

Cyber incidents, such as data breaches, ransomware attacks and vulnerability exploitations, are consistently impacting Brazil. This study analyzes 1249 cyber incident reported to the Brazilian National Data Protection Authority from 2021 to 2025. We identify São Paulo and the Federal District as the most targeted states, with ransomware being the most prevalent attack type. The Kaplan-Meier survival analysis reveals rapid incident recurrence in major regions and of certain types of incidents, such as ransomware, vulnerable systems and credential theft. This study provides a foundational overview of Brazil’s cybersecurity scenario. The findings emphasize the importance of enhancing incident reporting and of improving proactive defenses.

Insurance Premium Pricing and Ratemaking in Competitive Insurance and Capital Asset Markets

This paper aims to present a model for increasing the cyber resilience of organizations. Under the business context when cyber incidents risk is the most important risk worldwide for organizations for the third consecutive year, the model proposes a solution for improvement of cyber resilience of organizations, by implementation of a management system based on Business Continuity Management framework and a related software solution for handling the Risk Management data, Business Impact Analysis, Emergency and Recovery Planning, as well as Cyber Crisis Management. The implementation of the digital Business Continuity Management System and Cyber Crisis Management processes is tested through a simulation of a cyber incident leading to disruption of activities and cyber crisis caused by a ransomware attack. The simulation is presented both as design and execution and it can be implemented in any organization having the Business Continuity Management System in place and an internal IT department. The results of the simulation bring evidence for the contribution of the study to the increase of the cyber resilience of the organization. The novelty of the study is represented by the mix of concepts and instruments brought together in the model through which the framework of Business Continuity Management is implemented by means of a dedicated software solution, facilitating steps towards the digitization of the management processes and increase of the organizational and cyber resilience.

Quantification of Cyber Risk – Risk Categories and Business Sectors

This article provides an overview of the current state-of-the-art in cyber risk and cyber risk management, focusing on the mathematical models that have been created to help with risk quantification and insurance pricing. We discuss the main ways that cyber risk is measured, starting with vulnerability functions that show how systems react to threats and going all the way up to more complex stochastic and dynamic models that show how cyber attacks change over time. Next, we examine cyber insurance, including the structure and main features of the cyber insurance market, as well as the growing role of cyber reinsurance in strategies for transferring risk. Finally, we review the mathematical models that have been proposed in the literature for setting the prices of cyber insurance premiums and structuring reinsurance contracts, analysing their advantages, limitations, and potential applications for more effective risk management. The aim of this article is to provide researchers and professionals with a clear picture of the main quantitative tools available and to point out areas that need further research by summarising these contributions.