Clinton Daniel
For companies facing the growing financial risks of cyberattacks, buying insurance is only part of the equation. Choosing the right insurer — and understanding how that insurer operates before a crisis — can make a meaningful difference when an attack occurs.
Research from the University of South Florida finds that security executives should pay particular attention to two areas when evaluating cyber insurance partners: how insurers underwrite policies and how they handle claims.
Dalton Crabtree
The study, published in the Journal of Insurance Issues, examined industry research, interviews and direct access to practitioners at an anonymized cyber insurance carrier. The researchers found that details that may receive less attention when a policy is purchased can become consequential after an incident.
For example, proprietary carrier data examined in the study showed that more than 10% of submitted claims were denied because they were reported too late. Insurers also can influence which forensic, legal and technical-response providers organizations use following an attack.
Matthew Mullarkey
The researchers developed four recommendations to help security executives evaluate potential insurers, emphasizing that the decision should extend beyond comparing premiums and coverage limits. Understanding an insurer’s underwriting requirements and claims process can help organizations select a partner that supports their broader resilience following a cyberattack.
Authors: Clinton Daniel, Dalton Crabtree, and Matthew Mullarkey, University of South Florida; Olga Biedova, College of Charleston.