Why Cyber Insurance Is Like the 'Wild Wild West': FinTech Insider

But if you read the fine print, it will say you needed to do the following seven things [to be fully insured]. So the burden of proof falls on the organization to [show] that it's doing the basic things when it comes to protecting itself.

In other words, you can't walk around and have open networks and hope that your insurance policy will cover you. The insurance policy is only going to cover you as long as you've taken the necessary steps to protect yourself.

And you still may fall victim [to cyberattacks], because things happen outside your control. For example, if  you get caught up in a larger cyberterrorism issue — will your policy pay out in that case? Again, depends on the policy.

My point is that cyber insurance or cyber coverage doesn't always protect you. You've got to pay close attention to the fine print and work with insurance agents who understand cybersecurity, because then you'll get better advice when it comes to it what the policy actually covers.

TA: Could insurance policies be written without first ensuring that clients are compliant ?

Yenamandra: It depends totally depend on the insurance agency.

A lot of insurance agencies only focus on cybersecurity, and they probably would do a very good job of making sure they educate the insureds on what they need to pay attention to.

But I've seen insurance agencies that are more generalists. They write a lot of insurance policies, but cyber's just another thing they do. They may not be as educated in that area and therefore may not be able to provide all of the expertise that a firm has to have.

The industry is struggling at a much higher scale with the way insurance is currently being written. Today, insurance agents will send a prospective insured a multi-page application. That application will have a bunch of questions on it, things like: Do you have antivirus software on your devices? Do you have backups? Do you have a firewall?

How do you think a firm is going to respond? If it is trying to get a good policy and a low premium, it's not going to say 'no.' Or [the potential insured] sends it to its [outside] IT firm, which will probably say 'yes,' because it's getting paid to do so.

The problem is that the industry is very much based on self adaptation.

The insurance firm gets the self-adaptation model application form back from the prospective insured and then it plugs that into a model, and that model is based on some broad-brush assumptions.

For example, …. 30% of firms that provide some of that data aren't going to [provide] correct [information], so they assume that only 70% of firms are protected. The insurance firm then writes a policy based on that [assumption].

If the organization is as protected as Fort Knox and spends all this money to protect itself, it's still getting the same policy as a firm that has nothing in place. … The industry today is struggling with this.

In the next four or five years, we'll see massive change [with] trust-but-verify models. The insurance agent will have to make sure that a firm is compliant before it gets insurance.

TA: Could regulators force companies to be insured and to be liable?

Yenamandra: We're already seeing that if you are an organization that has a lot of power,  with power comes responsibility.

For example, let's talk about an organization that has [many individuals'] Social Security numbers and is operating at a level that could put all these people and that data at risk.

It's certainly within the realm of reason to assume that if [the firm] does not follow the basics when it comes to cyber risk, that the corporate umbrella may be pierced and the CISO may be personally liable.

There is a lot of discussions around [the case of] Equifax. I don't know if anybody personally was prosecuted, but that case could be a precedent for a lot of future issues because that attack was so unprecedented.

Certain states are mandating that firms have cybersecurity insurance. And there's been a lot of discussion about holding the CISO of certain organizations personally liable if they're found negligent of their fiduciary responsibility.