Although the thefts of records at large corporations such as Sony have garnered headlines, hackers are finding easy pickings, going after small-to-midsize businesses, which Kouns says he wants to educate and insure.

“They [hackers] are finding it easier to steal in small increments,” he explains. “Think about it—people start really looking for you when you take millions of records.”

Kouns points out that news accounts of Sony's data breach appear to imply there was one breach, but the corporation was actually hacked 21 times.

The tragedy, he says, is that small-to-midsize businesses cannot typically recover from a data breach. Regulations and laws regarding a business' obligations after a breach are different in each state. There are additional federal regulations for the healthcare industry. Add attorneys' fees and recovery costs, and the amount can be prohibitive.

On the side Kouns is one of the curators of DataLossDB.org, a research project aimed at documenting known and reported data-loss incidents worldwide.

Kouns' perspective as an IT security professional appears to drive his desire to create “real insurance” for data-breach risk.

And he has a somewhat different, untraditional take on the insurance that is currently provided—which isn't worth much, he contends.

“It's the new, sexy insurance. There are 30 carriers now writing it,” Kouns says. Some carriers are providing what he terms “chop-shop” insurance—multiple exclusions included—and he doubts there is actually much coverage to these policies.

The result is a developing market that can be a “saving grace or a moral hazard,” he observes.

“Right now you can get a policy with a $1 million limit for $1,500 in premium,” Kouns says. “That is worrisome. It's too cheap. Companies will buy the coverage and think they don't need to do anything to secure their systems.”

Kouns says work needs to be done with companies before Markel will underwrite the risk. The company also provides consulting and risk-management services.

“We want to improve security across the board because many of these businesses do not have a clue about this risk or what to do about it,” Kouns says.

Other companies are identifying this growing specialty-insurance market trend. Hartford has expanded its cyber-risk coverage to include data-breach coverage designed for small businesses.