The insurance misconception
We've heard it many times: "We have cyber insurance, so we're covered." This mindset is wrong, and it's dangerous.
What cyber insurance actually covers
Cyber insurance typically covers:
- Incident response costs
- Legal fees and regulatory fines
- Business interruption losses
- Data recovery expenses
- Notification costs
What it doesn't cover:
- Reputation damage
- Lost customer trust
- Operational disruption during recovery
- Future premium increases
The growing problem of claim denials
Insurers are increasingly denying claims when organisations can't demonstrate basic security controls were in place. Common reasons for denial:
- Lack of MFA - If you didn't have MFA enabled, your claim may be denied
- Unpatched systems - Known vulnerabilities that weren't addressed
- No security training - Staff fell for a phishing attack with no training program
- Inadequate backups - No recoverable backups available
Rising premiums and stricter requirements
Cyber insurance premiums have increased 50-100% annually. Insurers now require:
- Completed security questionnaires
- Evidence of security controls
- Regular vulnerability assessments
- Incident response plans
The right approach
Cyber insurance should be one layer of your defence strategy, not your entire strategy. Think of it like car insurance: you still need to drive safely.
Recommended approach:
- Implement strong security controls (Essential Eight is a great start)
- Train your staff regularly
- Have tested incident response procedures
- Then get appropriate insurance coverage
Conclusion
Invest in prevention first, insurance second. The cost of good cybersecurity is always less than the cost of a breach.
The Essential Eight series
This article is part of our Essential Eight series for Australian businesses.