The 2021 Travelers Risk Index states that cyber risk is the number one concern for all businesses.
Breaches have increased for large businesses by 73%, for midsize enterprises by 200%, and for smaller-sized companies by 300%. This means that everyone is at risk of experiencing a cyber-attack. But only 51% of start-ups and SMBs (small to medium-sized businesses) that have recently been hacked actually purchased cyber insurance. In recent news, agents/brokers are now trying to get their hands on the remaining 49% of companies that aren’t yet covered by cyber insurance since it’s going to represent a great future market - because unfortunately, all business owners need this kind of consulting services once they have already fallen victim to an attack like this one.
Although cyber insurance is a good risk transfer measure, you should understand that purchasing a cyber-policy does not ensure that your company will be able to stay in business following an attack. Many companies fail after suffering from a cyber-attack because the unexpected costs associated with forensic investigations, consultants and legal counsel can break your business. According to a recent analysis by the ACRN (Accenture Cyber Risk Study Network Community), the average cost for malware attacks was $2.6 million. The Keeper/Ponemon “2019 Global State of Cybersecurity in Small and Medium-Sized Businesses” report puts the average cost of business interruption caused by a cyber-event at $1.9 million and the average cost of damage/theft to IT assets or infrastructure caused by a cyber-event at $1.24 million.
Many small or midsize businesses cannot absorb these costs and sustain operations. Large companies face being overwhelmed by the costs of a significant cyber event. Consider the NotPetya attack that occurred in the summer of 2017 and caused Merck, Maersk and FedEx three weeks of business interruption losses ranging from $300 million to $670 million…. Companies need to undertake cyber risk assessments so they know the CyberRisk Advisory with their operations and the financial impacts of these and possibly other attacks. With this knowledge, they are better prepared to buy appropriate insurance coverage and close major gaps in their security program.
SMBs tend to think of cyber-attacks as “breaches” involving personally identifiable information (PII). What they do not know is that the cyber threat environment has become sophisticated and that cybercriminals are targeting them. As for why SMBs are targeted, we can say that it's because most often than not, SMBs don't understand what real threats look like. They don't take precautionary measures as much as they should due to the fact a lot of security breaches go unnoticed. This makes it easier to carry out attacks unnoticed so in a sense, SMBs make easy targets.
Attacks today can be vicious, but often rely on more than just one type of attack to successfully execute. Any company that does not have a resource-allocation strategy to guide it through a serious attack can expect failure. Most companies don't realize they will be targeted and therefore do not ensure that their backup/recovery plans are complete and that their employees are aware and trained. Ransomware has proven how important it is to treat security with due diligence at all times.
The bottom line is that insurance agents and brokers need also to be doing more than just selling cybersecurity policies. They need to be procuring cybersecurity consulting services for their clients, or if necessary steer them to trusted suppliers who can then develop a data breach insurance transfer plan that's anchored in their business operations and addresses the key risks throughout broader, integrated risk management.
Companies should perform regular cyber risk assessments to avoid any accidents that might occur later on in the form of cyber breaches. For example, a company may not know the vulnerabilities present in its systems or have an idea of what kinds of threats it is facing. And that’s understandable! Not every company has perfect defenses for their systems and data, but if a company takes measures to assess their risks and is actively working on remediating them, then it will help turn anything that would've turned into a lawsuit into a simple fine.
Cyber consulting services can also help clients develop responses to incidents and full backup/recovery plans. Ransomware has proven that these services make the difference between being able to restore from an incident and facing massive costs.
Conclusion:
Cyber risk assessment and consulting services (CyRAACS) support organizations to keep their data safe by providing a means of assessing, planning, and measuring the risks facing an organization and the most effective ways to mitigate them.
CyRAACS (CERT-IN empanelled company Bangalore) It offers regular audits and assessments of your company's cyber risks and vulnerabilities, offering tips and recommendations to help you improve as well.
Comments