Are Cyber Insurance Rates Masking Deeper Issues With Uninsured Risk?

Cyber insurance premiums have decreased by 15% since their peak in 2022. However, Kevin Townsend writes in SecurityWeek that this reduction is likely influenced by the insurance industry’s cyclical nature rather than significant advancements in cybersecurity.

Cyber insurance premiums surged in 2021-2022 due to insurers underestimating the scale and complexity of cybercrime. Stricter policy exclusions, coverage denials, and higher premiums accompanied these rising costs.

While insurers now claim better actuarial assessments and businesses report enhanced security measures, the insurance market’s inherent instability plays a pivotal role. Historically, insurers have focused on minimizing losses rather than preventing breaches, and they often rely on exclusions to manage risk.

The recent premium reductions reflect market corrections rather than a fundamental shift in cybersecurity effectiveness. Industry experts, including Ilia Kolochenko, cybersecurity practice leader at Platt Law LLP,  suggest that such changes stem from increased competition, insurers’ capacity adjustments, and self-insurance measures adopted by businesses unwilling to buy from insurers due to claim denials.

Cyber insurance follows a predictable cycle of “hard” and “soft” markets, in which rates fluctuate based on capacity and demand rather than insured parties’ security practices. The nature of cyber risks, including unpredictable large-scale breaches, further complicates the landscape.

Lawyers should be aware that the drop in cyber insurance premiums masks deeper issues. The instability of cyber insurance markets poses risks for businesses that rely on coverage to offset losses from breaches. Firms must also address the challenge of uninsured or underinsured third parties, which can expose companies to unexpected liabilities.