- 22% expect their policy to offer full coverage, 10% expect it to fall short
- Data breaches and reputational damage are major concerns
- Companies should look at finances before considering operational recovery readiness
New research from Cohesity has revealed that many UK businesses could be significantly overestimating the protection they get from cyber insurance policies, with just one in five (22%) British CEOs believing their policy would cover both the additional costs and lost revenue that an attack could lead to.
A third expect it would cover the additional costs only, another third believe their policy is only sufficient for lost revenue, and a further one in 10 did not expect it to cover either of the two categories.
The report’s conclusion is that cyber insurance in its current state for many UK businesses is only enough to transfer some of the financial risk – but not enough to restore systems, data or operations.
Cyber insurance policies don’t provide enough cover
According to the study of 100 CEOs from large enterprises, businesses expect a cyberattack to reduce their revenue by an average of around 15%, but many businesses lack a detailed understanding of how much an attack could actually end up costing them. As many as one in five (21%) haven’t even conducted business impact modelling.
Among CEOs’ biggest fears are data breaches (49%), brand and reputational damage (38%), high recovery costs (36%), revenue loss (34%) and production downtime (30%). They’re all either financial concerns or incidents that could lead to financial loss, and yet it’s clear that policies are unlikely to offer enough cover.
With many totally unaware of the potential impacts and the extent of their policy’s cover, Cohesity urges businesses to start off with calculating financial exposure and understanding what their policy covers.
After that, they can go on to prove that critical systems can actually be recovered, because without an insurance payout, this would likely not be possible.
“Organisations must be able to identify the systems and data needed to keep the business operating, assigning clear responsibility for recovery decisions and regularly testing whether critical services can be restored securely,” UK&I VP Fraser Hutchison explained.
