Shifting the Paradigm: Why the Cyber Insurance Industry Should Focus on Preventive Security

Does your organization currently have a cyber insurance policy? Without it, you are missing a critical piece of a holistic security strategy. With increased cyberattacks and expansion in cloud and digital operational technology (OT) assets, organizations face significant costs during and after breaches. This has led to expensive claim payouts by cyber insurance providers, and, ultimately, higher premiums for customers. 

Obtaining and renewing cyber insurance policies can be a challenging and difficult process fraught with trust issues for both parties involved. Organizations must provide extensive evidence and undergo a labor-intensive process for documenting controls. Some insurers even ask for specific evidence around certain vulnerabilities. It can be risky to share this kind of sensitive information with insurers, but they also need to prove their overall cyber risk with quantifiable data. The challenge is striking the right balance of data sharing to prove maturity with minimized risk.

Traditionally, cyber insurance providers have focused primarily on ensuring customers have reactive security solutions in place, like incident response, to mitigate exposure and risk when they apply for a policy. However, the incident response cost structure is unpredictable and expensive. While incident response is an important aspect of a comprehensive cyber insurance program, it should not be its sole focus. Therefore, there is a need to shift towards preventive security measures that focus on reducing the chances of a breach in the first place. Cyber insurance providers should direct their clients to focus on preventive measures in addition to reactive measures in order to obtain a policy.

Preventive security measures help both organizations and cyber insurance providers minimize risk. Classic cyber hygiene measures can make a large impact on risk mitigation with minimal effort. These measures can include:

• Obtaining visibility across your entire attack surface (including cloud and OT)
• Identifying critical vulnerabilities and remediating them in a timely manner
• Assessing roles and right-sizing permissions to minimize misuse and abuse
• Review Active Directory configurations to mitigate potential attack paths

Proactive security platforms not only help organizations prevent successful attacks, they help customers demonstrate their cyber maturity to cyber insurance providers. Preventive measures are also less expensive than reactive counterparts with predictable pricing structures. Aligning preventive measures with cyber insurance requirements can also simplify the purchasing process through standardized reports, dashboards, risk scores, and more. While this might be a double-edged sword, the benefits outweigh the cons in the long run – faster renewal process, high fidelity data that underwriters can trust, mutual understanding of cybersecurity standards and lower premiums.

This collaboration between cybersecurity companies and cyber insurance providers empowers cyber insurance providers to better quantify and manage portfolio risk, leading to potentially reduced cyber insurance premiums and shorter renewal processes for customers. Measured Insurance, for example, offers up to a 20% reduction in premiums for organizations that demonstrate a risk-based cyber program with Tenable. When selecting a cyber insurance policy, it is important to consider the policy's coverage, cybersecurity understanding, and alignment to your organization’s preventive program. Aligning cyber insurance policies to cybersecurity best practices helps to incentivize net risk reduction. At Tenable, we think we will see more partnerships between cyber insurance providers and preventive security vendors to simplify the purchasing process, increase high fidelity data for an accurate view into an organization’s risk, and lower premiums for organizations that are able to prove their cyber maturity.

Prioritizing preventive security is crucial for cyber insurance companies and organizations alike. By deploying preventive security measures and conducting necessary cyber hygiene steps, organizations can mitigate cyber risks, improve their chances of obtaining comprehensive coverage, and potentially save money. Proactive security not only helps prevent successful attacks but also demonstrates a commitment to cyber maturity, which is highly valued by insurance providers.