AI-supported technological innovations have been changing the cybercrime landscape since 2022 and, instrumentalized by criminals, have led to a very high threat level in the area of cyber security. Cyber insurance offers companies the opportunity to protect themselves against the financial consequences of cyber incidents.
An insurance-relevant cyber incident occurs when the confidentiality, integrity or availability of data or IT systems is breached as a result of an attack. The insurance covers, for example, the costs of restoring data records after a hacking attack, claims for damages by a third party, legal costs or the costs of business interruption as a result of a security incident.
The costs of such cyber risk insurance are usually calculated according to the turnover, company size and sector of the company to be insured and can amount to several thousand euros per year, depending of course on the scope of benefits, the loss amounts and the deductible.
For comparison: In 2023, the average cost of an IT security incident worldwide amounted to USD 4.45 million.
Important to know in this context: On average, it can take up to 280 days for a cyberattack to be detected, contained and fully remediated, including the removal of all fragments of the attack.
Business interruptions often occur during this period due to data loss or the compromise of IT systems, which can lead to a loss of sales, reputational damage or even insolvency for the damaged company. Compared to the average amount of damage caused by a cyber attack, cyber insurance is therefore a relatively inexpensive way to protect yourself financially.
However, the key point here is that an essential prerequisite for obtaining full insurance cover from the insurer is that the company to be insured has implemented state-of-the-art IT security measures. These security measures ensure that the company is protected against cyber attacks in the best possible way, thus reducing the risk of claims being settled by the insurance company.
If these security measures are not implemented, the insurance company may refuse to pay in the event of a claim.
State-of-the-art measures can be found in industry-specific standards such as ISO/IEC 27001, the BSI basic protection catalogs, the GDPR or the NIST Cybersecurity Framework. Examples include measures such as the regular updating of hardware and software, the collection and analysis of log data, the implementation of endpoint detection and response software and intrusion detection/prevention systems. All of these measures are aimed at ensuring the protection goals of IT security - availability, confidentiality and integrity.
