Article
The cold truth about cyber insurance
Cyber insurance policies are designed to cover the costs of security incidents and breaches such as system forensics, data recovery, and legal and customer reparations costs. Typical incident types that are covered include invoice fraud, cryptolocker recovery, and insider threats. While cyber insurance has its place in a holistic approach to security, its place is misunderstood.
To start, it is imperative that organizations understand their critical digital assets and risks since the planful adoption of a cyber insurance policy is vitally important for managing premium costs and ensuring appropriate coverage. But cyber insurance is a post-fail risk offset and it should never replace a proper security program. When businesses overinvest in cyber insurance and underinvest in security controls, they are showing that they expect to be breached and have their insurers solve the problem, even though they won’t. Yes, it is true that the frequency at which data breaches are reported is astounding, and hefty fines under data privacy laws are being issued more frequently. But the better approach for organizations is to pursue a proactive security strategy that is properly balanced with cyber insurance.
To read the full version of this story, visit Dark Reading.
