Kalinich said the discrepancy between the amount of EMEA companies who see higher cyber risk in the future and those who plan to buy cyber insurance is due to the fact that many EMEA companies didn't see the need to protect themselves financially against cyber risk during 2016. 

Growing losses for European companies

"EMEA is different than the U.S., where there have been a number of high-profile litigation situations that cost companies large amounts of money," Kalinich said. He predicted, however, that more EMEA companies would get cyber insurance going forward, in light of the growing amount of European companies that have begun to suffer high financial losses connected to breaches in 2017, including shipping company DPEX Express, consumer goods company Reckitt Benckiser and the European offices of DLA Piper.

Aon predictions, though, may be optimistic, given that it helps its own clients find and purchase cyber insurance and has a vested interest in the cyber insurance industry.

Related: 5 key takeaways from NTT Security's 2017 Global Threat Intelligence Report

Of those respondents who had cyber insurance in 2016, 56% noted their general liability limit was between $2 million and $20 million, while 25% had covered liabilities from $1 million to $5 million. What's more, 62% of those with cyber insurance called their coverage sufficient. Most of these insurance policies covered external attacks by cyber criminals (83%) or those by malicious or criminal insiders (76%).

Around half also covered the costs of communicating with regulators after an incident and of notifying data breach victims of the loss, while 49% covered third-party liabilities as well.

Consequences of international data breach

In addition to coverage, most cyber insurers provided their clients with access to cybersecurity forensics experts (84%) and access to legal or regulatory experts (74%). Such access to legal and regulatory professionals could prove helpful for EMEA companies given how unfamiliar many are with the risk they face under international laws and regulations: Only 30% of respondents, for example, were fully aware of the legal and economic consequences of an international data breach or security incident, while 46 % were "somewhat aware" and 24% were "not aware."

Kalinich, however, noted that this lack awareness is not connected with a lack of understanding of the general fines and legal liabilities under regulations such as the EU's upcoming General Data Protection Regulation (GDPR), but instead with how such liabilities will become reality.

Related: Cyber risk mangement a top priority as companies prepare for GDPR, study says

"They don't have any actual examples of how the EU GDPR fines an entity," he said.  "Why should an organization purchase insurance to cover something or have awareness of something that they don't have actuarial data for?"

Rhys Dipshan ([email protected]) is a legal tech reporter covering everything from in-house technology disruption to privacy trends, blockchain, AI, cybersecurity, and ghosts-in-the-machine.