Deepening cyber resilience through insurance initiatives

IN May, the WannaCry ransomware attack affected over 200,000 computers in more than 150 countries - causing the UK's National Health Service to cancel surgeries, and impacting major businesses like Fedex, Spanish phone company Telefónica and German state railways. Just last month, Petya affected more than 12,000 machines at major corporations such as shipping giant Maersk, the world's biggest advertiser WPP and food company Mondelez.

Two such ransomware attacks in close succession show how vulnerable our systems can be, and importantly, how debilitating such cyber intrusions are.

It is an easy throwaway solution - buying insurance coverage for cyber risk means companies and individuals may transfer some financial exposure to insurance markets; but if you look closely, the cyber risk insurance market is immature and coverage is still less than ideal. It is not clear whether it is due to low levels of awareness or whether some companies, after conducting a cost-benefit analysis, have little incentive to invest in preventing such cyber loss. Even when corporates do decide to buy coverage, the types of losses covered in standalone cyber policies can vary significantly across providers. There are also big differences as to which types of liability would be covered - for instance, whether ransomware would be covered? Furthermore, cyber inci…