Secure your business today
Quone can help you find your ideal cyber security provider within just a few minutes. To secure your business, follow these simple steps.
In today’s digital age, cyber security is a crucial concern for businesses of all sizes. However, the question remains; does your business actually need to be covered for cyber risk? The answer isn’t always straightforward because every business is unique, even those operating within the same industry. Understanding your business’s specific needs and risk appetite is essential in determining the appropriate cyber risk coverage.
The individual nature of cyber risk
While all businesses use technology, they do so in different ways, which means the requirements for cyber cover will vary. For instance, a financial services firm will handle sensitive client data daily, requiring robust security measures. In contrast, a small retail business might primarily use technology for point-of-sale transactions and inventory management, needing different protections.
Consider two businesses within the UK’s retail sector: Company A and Company B. Both sell similar products, but Company A operates a significant portion of its business online, while Company B focuses on brick-and-mortar sales. Company A might face higher risks related to online transactions and data breaches, necessitating comprehensive cyber insurance. Meanwhile, Company B, with its lower online presence, might prioritise coverage for potential point-of-sale system breaches or ransomware attacks affecting its in-store operations. Both compete in the same market but have different risk profiles and insurance needs.
Run Your Own Race: Bespoke Solutions Over Standardisation
In cyber security, one size does not fit all. Businesses must adopt an individual approach, similar to tailoring services and needs in other sectors. For example, in healthcare, patient treatment is highly personalised. A treatment plan that works for one patient may not suit another, even if their symptoms are similar. Likewise, your business’s cyber security plan must be customised to fit your specific risks and operational needs.
Understanding Cyber Insurance: Business Interruption vs. Dependent/Contingent Business Disruption
Jonathan Olley, Divisional Director Cyber of Costero Brokers Limited said “As cyber security is not ‘one-size fits all’, cyber insurance policies are not standardised, and the cover provided under each policy can vary significantly. It is essential when businesses are reviewing their cyber security strategy and risk appetite, IT and Business leaders also consider whether their cyber insurance programme is fit-for-purpose for how they operate. All buyers should be asking:
Does our policy have appropriate waiting periods and retentions for our risk appetite and business activities?
Are we buying a suitable limit for our exposure?
Does our policy cover the failure of a third-party’s IT infrastructure?
If so, which third-parties, how can this coverage be triggered and what exclusions does the policy have?”
From an insurance perspective, it’s important to understand the different available aspects of cyber insurance and their benefits. One often-overlooked component of a cyber insurance policy is the difference between Business and Contingent Business Interruption cover:
Business Interruption Cover: This aspect of a policy covers losses directly incurred by your business due to a cyber incident. For instance, if a ransomware attack shuts down your operations, the business interruption insuring agreement is there to provide reimbursement for the shortfall in income as a result of the network downtime (on top of the costs incurred when responding to the event – which is another aspect of the policy). Business Interruption is often limited to the network that the insured business controls or manages so is not designed to pick up losses arising from the failure of a third-party’s network which the business may be reliant upon to trade normally.
Contingent Business Interruption: This insuring agreement, which not all policies include, covers an insured business for the shortfall in income because of another company’s network suffering downtime. Very often this area of cover is limited only to IT providers and has restricted ways in which it can be initiated. This means that many businesses think they have cover, when in fact they do not. Often, Dependent Business Interruption cover can only be claimed upon for malicious event (or ‘Security failure’) involving a threat actor – Many policyholders who were impacted by the recent Crowdstrike event (July 2024) but only had a ‘Security Failure’ trigger for their Contingent/Business Interruption are likely to have found the claim being denied by insurers and being out of pocket as a result.
Jonathan Olley added “Recent events such as that of Crowdstike demonstrate how imperative it is that businesses don’t just buy a cyber insurance policy but they buy the cyber insurance policy that is appropriate and suitable for how they trade and their risk appetite. Businesses should be challenging their broker to ensure the policy that they acquire is not only competitively priced but significantly delivers coverage that is fit-for-purpose, relevant and going to respond when needed most”.
Cyber incidents happen and will continue to happen
UK businesses have been caught out by third-party actions many times before. One notable example is the 2017 NotPetya attack, which affected companies worldwide, including the UK-based Reckitt Benckiser, and others including Maersk, Mondelez, WPP and more. The malware spread through a third-party software update, causing massive disruption and financial losses which are estimated to be $10 Billion overall from companies affected. Despite having robust internal security measures in place, the companies affected could not prevent the impact of this third-party risk.
The recent incident with CrowdStrike is more nuanced as it wasn’t a cyber attack, or cyber incident as such. However, it has demonstrated that even businesses with strong internal security protocols can still be blind-sided from external cyber related events.
In summary – Tailor Your Cyber Security Strategy
Ultimately, cyber security and insurance are about understanding and managing your business’s unique risks. Don’t fall into the trap of standardisation; what works for another business might not work for yours. By evaluating your specific needs and potential vulnerabilities, you can develop a tailored cyber security strategy and choose the right insurance coverage to protect your business.
If you want to talk to a specialist, Quone can recommend Costero Brokers Limited as a good starting point.
