The Expert Podcast

Cyber risk for companies is a very serious subject. Many companies are either avoiding thinking about it or maybe heading to sand ostrich style. But cyber risk, in many measurements, is actually more probable, more likely, and even more severe than any other type of risk. It could be product liability, fire liability, or premises liability. Cyber risk is a big deal.

So, what is the reality of the marketplace? Well, this is a great article from the Financial Times saying the corporate world is losing its grip on cyber risk. Losing its grip. What does that mean? Well, it means it's out of control, right? And the subheadline is even worse: "Reasonably priced cyber insurance that also improves resilience seems to be beyond reach." What this means is that this author is saying that if you're a company, it is difficult to get cyber liability insurance coverage that's reasonable in price and that's going to help you cover your potential risk or your losses.

If you are a mid- or small-sized company, you should check into rates for cyber insurance to see what the reality is. It may be that it's already too expensive. If you can find a policy that's at all reasonable, we'd recommend locking that in because once you have a policy and the insurer can see your risk, many times that helps you retain that policy for renewal. Two or three years from now, it may be difficult to get coverage at all because you're not an established risk.

If you've not checked for coverage or availability of markets, you may want to do that because even if you're not able to get coverage, the questions that are asked by that underwriter will help you see some of the risk your company might have. Look, you might get rejected for coverage, and the underwriter might say, "Look, your company's too much of a risk. We can't take on this policy." But they'll tell you why. It's because of X, Y, and Z. And those could be reasons that help you maybe make some adjustments within your operations, within your sales process, or in your IT department that could help reduce some of those risks.

Maybe that risk reduction will help get you a policy. Even if it doesn't, it at least helps you reduce the risk within your company because you don't want to lose your grip on your company because some hacker, ransomware, or cyber attack puts you out of business or incurs a huge expense that is unrecoverable.