Most insureds, Cavanaugh said, don’t realize their General Liability policies probably don’t cover physical damage caused by cyber attacks. Also noted: What we’ve all seen in the media — that audacious thefts of money and securities through funds-transfer fraud is also on the rise.

Perhaps the most interesting point underscored by Cavanaugh is the evolving role of cyber insurance providers less as purveyors of policies and more as cyber risk consultants. This was a point made later by David T. Vanalek, director of U.S. Professional Liability for Markel, in his presentation.

Both speakers noted that underwriters are striving to get more accurate pictures of their clients’ risks, and to do this they are hiring staff with deeper domain expertise in information technology and legal issues. They each encouraged insureds to seek out carriers that have IT security experts on their cyber insurance teams.

Here are some key takeaways from the ISC² June meeting.

Key takeaways for insureds:

• If you handle personal data, financial data, or healthcare data, you need cyber insurance.
• Organizations handling personal healthcare information are increasingly targeted by cyber criminals
• Ransomware/cyber extortion attacks are likely to increase due to the widespread availability of the software tools – and their low cost.
• Evaluate your potential cyber insurance provider carefully (see below for some specific tips).
• Cyber criminals use information to create detailed profiles they can use in personalized attacks.
• If you’re in healthcare or any other industry where hacked devices can cause bodily injury, be sure your cyber policies cover bodily injury.
• Cyber insurance is a service not just a product. It’s not a risk transfer relationship — it’s a risk management relationship.
  
  

Key takeaways for insurance professionals:

• Cyber insurance is not widely adopted by small and mid-sized businesses, which presents an opportunity for carriers, agents and brokers equipped to serve these companies.
• There’s not much historical claims data available for carriers writing cyber policies — so there’s always an element of uncertainty in the underwriting process.
• The largest companies involved with underwriting and distributing cyber insurance coverages have adopted a professional services model — consulting closely with clients on their cyber risk throughout the lifecycle of their relationships.
• Underwriters of cyber risk need a keen understanding of various security standards and protocols — and the risks associated with each.