What’s Holding Back the Cyber Insurance Industry? A Lack of Solid Data

“Ba­sic­ally, it’s a crap­shoot,” Tore­gas ad­ded. “It’s throw­ing darts at the wall to try to es­tab­lish rates.”

One pos­sible solu­tion to the data prob­lem would in­clude the gov­ern­ment. The De­part­ment of Home­land Se­cur­ity is bring­ing to­geth­er or­gan­iz­a­tions—in­clud­ing in­surers and private com­pan­ies—to dis­cuss set­ting up a “third-party re­pos­it­ory” for cy­ber­in­cid­ent in­form­a­tion.

Such a re­pos­it­ory would take in an­onym­ous re­ports and make them avail­able to the pub­lic, so that in­surers, oth­er com­pan­ies, and re­search­ers would have a bet­ter sense of the fre­quency and scale of cy­ber­at­tacks, said Su­z­anne Spauld­ing, un­der sec­ret­ary for the DHS’s cy­ber arm, the Na­tion­al Pro­tec­tion and Pro­grams Dir­ect­or­ate.

“What are the kinds of in­form­a­tion that a com­pany might be com­fort­able provid­ing—again, without at­tri­bu­tion to the com­pany—and that would be use­ful, both for un­der­stand­ing the nature of the chal­lenge we’re fa­cing, but also for in­sur­ance folks to be­gin to de­vel­op products that could help pro­mote safety?” Spauld­ing asked dur­ing a cy­ber­insur­ance event at the Cen­ter for Stra­tegic and In­ter­na­tion­al Stud­ies last month.

Such a re­pos­it­ory is inch­ing to­wards real­ity. A DHS work­ing group ded­ic­ated to cy­ber in­cid­ent data pub­lished a white pa­per last month with 16 data cat­egor­ies it pro­posed for the re­pos­it­ory. The cat­egor­ies in­clude a timeline of the in­cid­ent, its sever­ity, the ap­par­ent goals of the at­tack, the as­sets af­fected or com­prom­ised by the at­tack, and the cost of the breach.

Without this data, the only op­tion avail­able to in­surers is com­ing up with a com­puter mod­el to pre­dict cy­ber risk, a field which Tore­gas says is “totally at its in­fancy.”

But the need for cy­ber­insur­ance is high and grow­ing, and not just to pro­tect com­pan­ies from the of­ten dis­astrous ef­fects of a breach.

“The un­der­writ­ing pro­cess it­self can bol­ster cy­ber­se­cur­ity,” said Treas­ury Un­der Sec­ret­ary Sarah Bloom Raskin at the CSIS event. “To qual­i­fy for cy­ber­insur­ance, a busi­ness typ­ic­ally fills out an ap­plic­a­tion seek­ing de­tails on its risk level and con­trols that mit­ig­ate the risk—the act of en­ga­ging in this pro­cess helps busi­nesses identi­fy tools and best prac­tices that they may be lack­ing.”

For now, the size of the cy­ber­se­cur­ity in­sur­ance mar­ket re­mains a frac­tion of its po­ten­tial.

“The un­lock­ing of the po­ten­tial mar­ket in­to the hun­dreds of bil­lions of dol­lars will hap­pen when they either de­vel­op a com­pre­hens­ive kind of stat­ist­ic­al base of losses, or some strong mod­els that can tell them with some level of con­fid­ence, ‘I pre­dict that if you do the fol­low­ing five things, your losses will be lower than the oth­er guy who had only four of those things ticked,’” said Tore­gas.

(Image via Tammy54/Shutterstock.com)