Insuring against cyber-attack

How much is a business reputation worth? It seems sensible to suggest it would be close to whatever a business could be sold for when at its best, with customers coming out of everywhere to buy its products and finance houses falling over themselves to invest in its future.  If the reputation is damaged enough, that will be the cost, for it will be the end of the business.

There are many applications which claim to help with `reputation management’, but in fact the vast majority are really in the post hoc salvage business. They work to help a business reclaim at least some of its former reputation by helping it recover as quickly as possible. But in practice, of course, the initial damage will have been done.

There is a growing argument that defending the reputation of any business now needs to be a proactive process that managements must undertake. There are tools now starting to appear that can counter the damage done by cyber-criminals who, using techniques such as denial of service (DoS), botnets, worms, spear phishing and drive-by exploits now account for an estimated £27bn cost to the UK economy, according to a Cabinet Office and National security and intelligence report entitled `Keeping the UK safe in cyber space’. Cyber-crime and data breaches are now considered one of the top emerging risks for the 21^stcentury.

According to industrial insurance specialist Allianz Global Corporate & Specialty (AGCS), all businesses now need to review their vulnerability to a cyber-attack and the financial and reputational damage it may cause.

The AGCS response to this growing cyber criminality is, however, something of a post-hoc solution, the launch of an insurance package called the Allianz Cyber Protect. This is designed to enable businesses to protect themselves against cyber-criminals, data loss and the potential ramifications.

Allianz is offering a comprehensive suite of three insurance products to address various first and third party liability issues that can arise from a serious cyber-attack or data breach. The main elements include acomprehensive policy offering cover up to a limit of €50m and covering a broad range of cyber exposures; three levels of business interruption cover that can be tailored to the client’s needs; and immediate access to a crisis response team, in partnership with global consultants KMPG Forensic, Dell SecureWorks, Incoming Thought Ltd and E-merging Technologies Group Inc.

According to the recently published Information Security Breaches Survey 2013from the UK Department for Business, 93 percent of large UK companies and 87 percent of smaller businesses have experienced a data breach in the past 12 months. AGCS reckons companies are now facing attacks on a daily basis and firms, such as online retailers, where the business has critical dependency on digital networks, may not be fully aware of how a cyber-attack could be fatal to their business.

This can be particularly important for the SME community, as AGCS claims many cyber-criminals are now hacking into the systems of SME firms as a way of ‘piggy-backing’ access to larger companies they partner with. This could be a particularly risky situation for the smaller businesses, as they could then face significant claims for damages from the larger partner.

The real problem for the SME community then becomes finding the money to pay for the needed protective tools and services, or paying hefty insurance premiums because they do not have sufficient defences in place. The third – often most common – option is to end up taking the risk.  

But that risk is only going to get worse, as data protection legislation around the globe changes. Within the next few years new legislation will be in place in the European Union (EU) which will significantly increase the financial burden placed on companies. Under new proposal from the EU, companies could be fined up to 2% of their turnover for a data breach.

Elke Vagenende AGCS underwriting product developer, observed, “reputation is an intangible asset which cannot be seen or felt, yet it is a decisive factor in a business’s future success. Irreversible damage can be done to a brand’s reputation if they do not have risk management and mitigation in place to combat a data breach. This product suite covers the costs of crisis communication for the purpose of safeguarding the company's reputation.”