The Economics of Cybercrime and Security
Cyber Insurance
How cyber insurance covers breach and ransomware costs, why pricing it is hard, and how insurers push clients to improve security.
Cyber insurance helps firms cover losses from attacks.
What it covers
- Investigation and recovery costs.
- Business interruption.
- Legal and notification costs.
- Liability to customers.
- Sometimes ransom payments, though this is controversial.
Why pricing is hard
- Limited data: cyber risks are new and change fast.
- Correlated risk: one attack, like a software flaw, can hit thousands of firms at once, unlike house fires.
- Moral hazard: insured firms may relax security.
Insurers as regulators
Insurers increasingly require minimum security, like multi-factor authentication and backups, before issuing policies, pushing better practices.
Market growth
Premiums rose sharply around 2021 after ransomware losses, then stabilised.
In India
Cyber insurance for businesses is growing, and some insurers offer personal cyber policies covering online fraud.
War exclusions
Insurers debated whether state-sponsored attacks count as war, which is usually excluded, after disputes over the NotPetya (2017) attack.
An insurer refuses to cover a company until it enables multi-factor authentication and offline backups. The company upgrades, reducing its risk.
One cyber attack can hit many firms at once, making it harder to insure.
- Cyber insurance covers recovery, interruption and liability.
- Limited data and correlated risk make pricing hard.
- Insurers require security measures before coverage.
- Personal cyber policies are growing in India.
No recording for this one yet - EconReader can read it aloud for you.