Cyber insurance may create false sense of security
Most of the losses expected in a substantial cyber security event are not typically covered by insurance policies, FM Global found.
Seven in 10 senior financial executives at the world’s largest companies believe their insurer would cover most or all of the losses their company would incur in a cyberattack. Many of the losses they foresee, however, are rarely covered by insurance, according to a new report by FM Global.
In a study of more than 100 chief financial officers and other senior financial executives commissioned by FM Global, 45% said they expected their insurer would cover “most” related losses from a cybersecurity event, and 26% said they expected their carrier would cover “all” related losses.
But most of the effects these financial executives expect to experience in a substantial cybersecurity event are not typically covered by insurance policies, according to FM Global. These effects include:
- Degradation of the company’s brand/reputation (46% said this was a likely effect of a cybersecurity event);
- Increased scrutiny from the investment community (40%);
- Decline in revenue/earnings (38%);
- Introduction of regulatory compliance problems (35%);
- Decline in market share (24%); and
- Decline in share price (24%).
There was one more choice: “New costs to mitigate the loss,” cited by 53% of senior financial executives. Indeed, many new costs — including expenses related to restoring data or equipment — would be covered by first-party cyber insurance or property insurance, according to FM Global. Litigation and customer notification costs would be covered by third-party insurance. But the rest of the listed costs in the study would likely have to be absorbed by the victimized company, FM Global said.
Moreover, more than half said financial recovery from a substantial cybersecurity event would take months to years.
“As essential as cyber insurance is, the findings indicate financial executives may be deriving a false sense of security from it,” said Kevin Ingram, executive vice president and chief financial officer at FM Global. “While insurance is an essential part of the risk management formula, there are losses related to a cyberattack that insurance cannot cover — like damage to a company’s reputation, lost market share, missed growth opportunities, decreased valuation, and losses stemming from increased cost of capital. That’s why we’re so committed to helping our clients prevent loss in the first place.”
Related: