Businesses of all sizes and across all industries are aware -- more now than ever -- about how cyberattacks can wreak havoc on business operations. The financial impact of lost productivity, ransom payments and data recovery, legal fees and fines, and lost business reaches into the billions of dollars for U.S. businesses.
Among the top cybercrimes are data breaches, ransomware, and phishing scams, those tricky emails that invite individuals to click on a malicious link. According to a 2023 Internet Crime Report issued by the Federal Bureau of Investigation, the second-costliest type of crime was business e-mail compromise (BEC), resulting in $2.9 billion in losses.
Cyberattacks are not a concern for large corporations alone that operate on a global scale. Any business that stores sensitive data or works with online transactions is susceptible to these attacks – even when the best measures to avoid them are in place. Protective firewalls, employee training programs, and advanced authentication software provide some defense. But as cybercriminals develop increasingly more elaborate schemes at a rapid speed, some company leaders may wonder if cyber insurance is a good fit for them.
What is Cyber Insurance?
As its name implies, cyber insurance is designed to cover financial losses incurred by cyber incidents. Much like automobile insurance, it is tailored to safeguard a company in a specific area that goes above what the company’s general liability or property insurance covers.
Many policies have a first-party coverage and a third-party coverage option. Terms and conditions for policies will vary depending on a number of factors, including the type of business and the insurance company. First-party cyber coverage is intended to cover losses that the business has incurred from the attack. Experts note that cyber insurance for businesses covers legal fees, breach recovery costs, and online vandalism recovery involving lost productivity and customers.
Third-party coverage would cover losses incurred by someone who was affected outside of the business. For example, if a company experienced a data breach and sensitive customer information was made vulnerable, third-party cyber insurance policies may cover those losses incurred by the third party.
Weighing the Costs
As inflation and other global changes are putting more financial demands on mid-size and small businesses, companies must weigh the option of adding a budget line for another insurance policy against the risk of a cyberattack.
Cybersecurity experts report that by the end of 2024, the average annual cost for cyber insurance for a business ranged from $500 to $5,000. Small business resource platform AdvisorSmith reported that in 2022, the average annual cost to businesses for cyber insurance in Indiana was $1,484, slightly less than the national average.
Cyber insurance is no different than any other insurance – it is an “in case” measure that can keep a company from a financial loss that could be devastating. Small or mid-size companies are at increased risk, according to an article published by the U.S. Chamber of Commerce, which noted that these entities are prime targets for cybercriminals because they may not put as much attention into cybersecurity as larger companies do.
Things to Consider
Cyber insurance policies will differ in both cost and coverage for each company based on a number of factors, including business size, coverage needs, security measures already in place, and industry risk.
The Indiana Council on Cyber Security has developed a Cyber Insurance Toolkit for businesses. The resource offers guidance to businesses about underwriting questions, security controls, risk exposures and more.
