Experts: Cyber insurance market full of 'trap doors'

Cyber insurance offered by major carriers is extremely diverse, with the absence of standardization meaning the market can be hard to navigate for brokers and buyers alike.

Cyber insurance offered by major carriers is extremely diverse, with the absence of standardization meaning the market is full of “trapdoors” for the unwary buyer, lawyers told a security conference Tuesday.

“No two [application] forms are alike, no two policies offer the same coverage,” Richard Bortnick, a New Jersey based attorney who represents insurance companies, told the Privacy and Security Forum in Washington, D.C..

“There are 75 or 80 policies out there,” said Charles Bernier, an insurance broker with ECBM. Unlike other kinds of insurance, there is no standardization. “They are all different,” he said. Even policies that use the same terminology may not be comparable: “The same word can be interpreted differently by two different carriers,” he said.

As a result, added insurance attorney Scott Godes, “It is very difficult to read these policies,” and hard to be sure what exactly is covered, meaning it could “ultimately be an unwelcome surprise.”

“If in doubt,” he concluded, “ask.”

But even many insurance brokers don’t really understand the very specialized cyber insurance market, said Bortnick. “The brokers may not know what they’re doing … Brokers have made mistakes and … not brought the right coverage for their client.”

It’s important to determine, for example, what will trigger coverage, said Bortnick, Is it an “event” or an “act”? The distinction is vital. “It doesn’t matter what coverage you have … if you can’t reach the coverage” because the triggering event doesn’t qualify.

For example, some policies, borrowing terminology from disaster coverage, require a period of continuing downtime before the policy kicks in, said Godes. “But with a computer outage, you might be up and then down again” several times before the issue is fixed.

“Some older policies only kick in if [personally identifiable information] is involved,” said Godes.

Other policies may have a “retroactive date,” meaning if a breach is discovered that started before the policy was purchased, it won’t be covered.

As the market matures, “there will be more standardization,” said Bernier. He compared the cyber insurance market to employment practices liability insurance, or EPLI, which provides coverage to employers to reimburse them for claims made by employees alleging discrimination. “Ten or 15 years ago, that [market] was like this, but we gradually saw more standardization [of coverage] emerge.”

The market is still very young, added Bortnick. “How do you rate” a company’s risk or security? he asked “There’s no historic data.”

And, he added to laughter from the audience, “There haven’t been enough lawsuits.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure