Direct written premiums for cyber insurance worldwide could rise to $23bn by 2025, with the US businesses paying about 56% of the total according to Insurance Information Institute (Triple-I).
Triple-I’s latest edition of Cyber Insurance: State of the Risk said two primary factors may be at work in developing this trend. The first is the ubiquitous threat of data breaches and cyber attacks and the second is insurers have made strides in clarifying policy coverage and exclusions, improving risk managers’ understanding of product value and helping insurers better manage costs and rate stability.
The US businesses, the primary purchasers of standalone cyber insurance policies, are facing broader exposure to data breaches and cyber attacks through their reliance on Internet of Things technologies, the expansion of remote work and greater use of cloud data storage.
Purchasing cyber insurance as a standalone policy can lower the cost to a business in the event of a data breach or cyber attack involving sensitive information by covering damages that general liability insurance policies may not, including:
- Legal fees
- Repairing digital infrastructure
- Restoring clients’ personal information
- Recovering proprietary data
The report said, “In 2023, the average data breach cost for organisations climbed higher than ever, to $4.45m according to IBM’s Annual Data Breach Report. This figure is a 15% increase over 2020, but only 2.3% over 2022.”
According to Swiss Re Institute the global cyber insurance market tripled in volume in the five years ending in 2022. The direct written premiums worldwide totalled an estimated $13bn.
Given that more than half of these premiums are paid by the US businesses, the National Association of Insurance Commissioners and the US Homeland Security Department’s Cyber Security and Infrastructure Security Agency are showing greater interest in this line of coverage.
“Insurers are taking a more sophisticated approach to underwriting and fortifying policy wording and exclusions. Nonetheless, they need more robust data on attacks and breaches to predict and manage liability,” said Triple-I. M