Fighting fake war imagery
Read more 
Cyber insurance is no silver bullet for cybersecurity
Regulators and businesses hope cyber insurance will drive stronger security practices. In reality, a narrow focus on mitigating financial loss makes it an unreliable solution
Image created using Leonardo.ai
Cybercrime is projected to cost $10.5 trillion globally every year by 2025. Ransomware, advanced persistent threats, and data breaches push organisations to reduce their cyber risk. Cyber insurance is presented as a powerful tool to recover from incidents and a mechanism to incentivise better cybersecurity practices. The global cyber insurance market is expected to surpass $23 billion by 2026.
As reliance on cyber insurance grows, questions about its value and effectiveness in strengthening cybersecurity practices have come to the fore. Despite hopes in government and policy circles, the actual impact of cyber insurance on cybersecurity practices has not lived up to expectations.
The hope of cyber insurance
Cyber insurance is designed to minimise organisations’ financial losses from cyber incidents by covering costs like breach notification, data restoration, legal fees, and even ransomware payments. Insurers evaluate an organisation’s security posture by assessing the implementation of specific security controls. For instance, does the business mandate multi-factor authentication? The presence of such security measures translates into lower risks, making the applicant a favourable or ‘good risk’ for them to insure. This benefits the applicant in terms of securing insurance and typically at a lower premium.
This idealised ‘win-win’ scenario has been central to the argument that cyber insurance fosters better cybersecurity practices. There is a nuance to this argument, though. The cybersecurity controls that insurers require would need to be comprehensive, appropriate, and effective. For instance, aligned to cybersecurity standards, such as ISO 27001 or the NIST Cybersecurity Framework. This, however, is not the case.
Far from a silver bullet
Despite its potential, research reveals that cyber insurance falls short in improving security practices. A report by the Royal United Services Institute (RUSI) think tank points out that cyber insurance policies often lack standardisation and fail to incentivise organisations to adopt security practices aligned with frameworks like ISO 27001 or NIST CSF. Another study emphasises that insurance requirements may be motivated by various other factors (eg, controls that reduce very specific risks, length of policy period, liable risks) rather than improving overall organisational security in a meaningful way.
Not only does this gap weaken the argument for cyber insurance improving security, it also poses a risk for businesses. Organisations meeting insurance requirements (which may be minimal in terms of security) may mistakenly believe they are well-protected, only to find themselves vulnerable to attacks that exploit overlooked weaknesses. Furthermore, insurers themselves face mounting challenges as the increasing frequency and sophistication of cyberattacks result in unsustainable claim payouts.
A recent study of insurers in the US, UK, and Australia that reviewed 68 cyber insurance application forms reaches a similar, quite damning conclusion. Although international standards like ISO 27001 and the NIST Cybersecurity Framework emphasise governance and incident management as core components of security, insurance applications often, instead, emphasise technical measures like encryption, firewalls, and antivirus software. These are undoubtedly essential components of any cybersecurity strategy, but they are insufficient on their own.
Measures such as information security policies, risk assessments, employee training, management accountability, and secure configurations are often overlooked in application forms. Ignoring these issues leaves organisations exposed. In 2017, one of the largest US consumer credit reporting agencies, Equifax, was breached – exposing 147 million individuals’ data – because Equifax had failed to patch a known vulnerability. This lapse highlighted the critical role of governance and operational controls in preventing catastrophic risks alongside technical measures.
Surprisingly, the study also revealed that many insurers place minimal emphasis up front on incident response and recovery capabilities, even though these are crucial for mitigating cyber incidents like ransomware. This may well be because insurers offer these services post-incident anyway. While this approach eases the burden on organisations, it risks fostering overreliance on external support and could leave them less prepared internally against cyberattacks.
The study focused only on the application forms themselves, but insurers may also use interviews, site visits, automated tools, or audits to further assess applicants. The reality, however, is that these methods are resource-intensive, so most insurers rely on application forms and their streamlined questions to reduce costs and effort. This is especially likely for small-to-medium-sized enterprises (SMEs). Given this context, a crucial noteworthy point is that SMEs make up a majority of most countries’ economies – in the UK, as of 2024, over 99% of the business population.
The shortfall lies in the intent
Cyber insurance, at its core, is designed to mitigate financial risk rather than directly enforce or promote robust cybersecurity measures. Insurers prioritise specific controls for practical reasons, like risk quantification and market demands, instead of aiming to align with comprehensive security best practices. As such, their primary goal of managing financial risk can diverge from the broader objective of enhancing security. While this may be logical from an insurance perspective, it undermines the assumption that insurance inherently promotes better, and more holistic, security practices.
Implications for policy and practitioner communities
For policymakers
Cyber insurance alone cannot drive significant improvements in day-to-day security practices. Insurance is valuable for post-incident recovery, but its potential to incentivise stronger cybersecurity currently appears limited by its focus on a limited range of security controls. Regulators could aim to collaborate with insurers to explore the incorporation of robust governance and operational controls into application forms, aligning them with recognised frameworks like ISO 27001 and the NIST CSF.
For practitioners
Organisations must view cyber insurance as a complement to, not a substitute for, proactive security measures and recognise that meeting insurance requirements alone does not ensure comprehensive protection. Businesses must independently prioritise governance, incident response planning, and secure configurations to address vulnerabilities that insurance policies may overlook.
For insurers, aligning their policies with established cybersecurity frameworks can create long-term value because encouraging stronger controls among policyholders could reduce claims and foster greater trust in the insurance market. By addressing such risks, insurers can contribute to better security outcomes for all stakeholders.
Toward a balanced perspective
Cyber insurance, while valuable, is not the silver bullet to cybersecurity challenges that many hoped it would be. Its primary strengths currently lie in financial risk mitigation and post-incident support, not in driving proactive security measures. To unlock its full potential, stakeholders must address these limitations and integrate cyber insurance into a broader cybersecurity framework. Through collaboration between policymakers, insurers, and businesses, cyber insurance can evolve into a key component of a resilient cybersecurity strategy.
