Cyber insurance coverage: How much does your business need?

According to Guy Carpenter, the CrowdStrike tech outage cost businesses globally between US$300 million and US$1 billion in insured losses. In the immediate aftermath, many companies asked this literal million-dollar question: “Is my cyber insurance policy sufficient to cover losses, settlements, and damages from a similar incident?”

Asia has undergone a rapid digital transformation in recent years, corresponding to increased exposure to cyber outages and threats, with the average weekly cyber attacks per organisation in the region rising 23% year-on-year in Q2 2024.¹ While cyber insurance can help companies mitigate losses from business interruption, breach response costs, ransomware, and more, what would be the appropriate cyber insurance coverage required for your business? 

Determining the right amount of cyber insurance coverage for your business

There are two approaches you can consider in determining the optimal amount of cyber insurance needed to meet your specific business needs:

#1: Benchmark your risk profile against industry peers

You can gain an indication of how much cyber insurance you should be purchasing by comparing your cyber risk profile against industry peers. Digital tools such as Marsh’s Blue[i] cyber risk analytics can provide you with tailored insights into cyber threats, enabling you to make decisions about cybersecurity investments by: 

• Measuring cyber threats specific to your organisation, business impact, and cybersecurity controls, covering more than 800 security controls and 110 unique cyber event scenarios.
• Calculating the potential losses of cyber incidents based on standard metrics such as the number of employees, revenue, and past incidents.

#2: Quantify your cyber risk exposures

The lack of quantitative assessment of cyber risk can result in underinsurance and impact the cost and terms of a cyber insurance policy, leading to a protection gap when a cyber incident occurs. Quantifying cyber risk exposures requires specialised skills, and Marsh Asia’s Cyber Risk Quantification can help you with the following capabilities:

• A six-step qualitative and quantitative consultant-led approach that analyses your existing cyber coverage and gaps. The approach also evaluates the total cost of risk of your cyber insurance programs. 
• Conduct a comprehensive analysis of threats by identifying vulnerabilities based on your business’s digital footprint and cyberattack scenarios.
• Provide expert advisory capabilities including forensic accounting, claims, and actuarial analytics to define losses and identify the optimal insurance structure. 
• Tailor the foreseeable loss amount based on your organisation’s vulnerabilities and the maximum potential financial impact from a cyber incident offset against your current cybersecurity risk profile.

How do you decide which is the best approach

Cyber Benchmarking and Cyber Risk Quantification are practical approaches to support you in making informed decisions about your cyber security coverage. 

Cyber Benchmarking is beneficial for your companies if you are in the early stages of your cybersecurity journey, providing a quick and direct solution to quantify cyber risk exposures generally. 

On the other hand, if you have a large business that already has cyber insurance, and you want to enhance and optimise the coverage, Cyber Risk Quantification is for you. It also caters to companies seeking tailored, in-depth insights into their cybersecurity posture and quantitative measurements of risks for further improvements.