Cyber Insurance

Cybercrime is a cyber security incident where cybercriminals target individuals, businesses, educational institutions or governments with a type of cyber threat.³ The Australian Cyber Security Centre has created a guide for some common cyber threats for small businesses, which includes: 

• Malicious Software (Malware) – Unauthorised software designed to cause harm, including viruses, spyware, trojans and worms 

• Phishing – Emails designed to trick recipients out of money and data by pretending to be a person, brand or company you are familiar with 

• Ransomware – Certain malware that locks down your computer and files until a ransom is paid. 

Cyber insurance may assist your business from losses associated with cyber risks such as unauthorised system access, cyber attacks (including denial of service or hacking attacks), computer viruses and privacy breaches. There is a range of different types of cyber insurance cover, which can include: 

1. IT Security and Forensic Costs 

2. Privacy Breach Costs, including notification 

3. Data Recovery 

4. Business Interruption 

5. Privacy Liability (i.e. your liability to third parties as a result of a privacy breach) 

6. Network Security Liability (i.e. your liability to third parties as a result of cyber events) 

7. Media Liability (i.e. your liability for intellectual property infringement or defamation) 

8. Payment Card Industry (PCI) Fines, Penalties and Assessments 

9. Regulatory Fines, including GDPR fines 

10. Cyber Extortion 

11. Cryptojacking and Telephone Hacking 

12. Funds Transfer Fraud, including phishing or social engineering scams against your employees 

13. Loss from theft of the policyholder's electronic identity.

Business Insurance generally includes damage to property (building and contents), business interruption and liability cover. However, insurers are increasingly applying broad exclusions to these policies for any cyber-related loss as they are only willing to provide cover for cyber-related risks on specialised Cyber Liability insurance policies.  

There may be some coverage for cyber-related losses in other insurance policies, but many cyber losses will only be covered under a dedicated cyber policy. Recent changes in insurance market conditions (particularly over the past 12 months) mean many insurers are also starting to apply cyber exclusions to non-cyber policies. 

Cybercriminals use malware and viruses, computer and network hacking, denial-of-service attacks, social engineering and online scams to commit their crimes. For cybercriminals, it can be relatively easy to access computers and networks inadequately protected by virus software or passwords. 

While a company can put various controls in place to protect their business, a significant number of cyber incidents are caused by human error. Mistakes such as clicking on a link or opening a malicious email can be enough to allow cybercriminals unlimited access to your data and infrastructure. A growing risk for small-to-medium-sized businesses is funds transfer fraud — i.e. a fraudulent request for an employee to send funds to a scammer's bank account. Depending on the Cyber Insurance policy taken out, such losses may be covered. 

Cyber incidents covered under cyber insurances are not all outsider attackers since many policies also cover privacy or security breaches from left laptops or mobile devices, programming errors or threats from rogue employees.