The tragedy, Kouns says, is that small-to-midsize businesses can find it very difficult to recover from a data breach without the right insurance, given all the notification and other costs associated with a breach.

Kouns says it is his perspective as an IT security professional that drives his desire to create “real insurance” for data-breach risk. He contends that much of the coverage currently provided doesn't protect much.

 “It's the new, sexy insurance. There are 30 carriers now writing it,” Kouns says. Some carriers are providing what he terms “chop-shop” insurance—multiple exclusions included—and he doubts there is actually much coverage to these policies.

The result is a developing market that can be a “saving grace or a moral hazard,” he observes.

“Right now you can get a policy with a $1 million limit for $1,500 in premium,” Kouns says. “That is worrisome. It's too cheap. Companies will buy the coverage and think they don't need to do anything to secure their systems.”

Kouns says work needs to be done with companies before Markel will underwrite the risk. The company also provides consulting and risk-management services. “We want to improve security across the board because many of these businesses do not have a clue about this risk or what to do about it,” Kouns says.

Other companies are identifying this growing specialty-insurance market trend: The Hartford has expanded its cyber-risk coverage to include data-breach coverage designed for small businesses.