Arctic Wolf and Cyber Risk Alliance’s 2023 Cyber Insurance Outlook Report found that while more than 70 percent of organizations surveyed in the report have a cyber insurance policy, nearly half of that group said their coverage started less than a year ago.

What’s drawing so many newcomers to cyber insurance? Kevin Kiser, senior director of insurance sales at Arctic Wolf, said it’s a growing consensus that it’s not a matter of if but when a cyber attack will happen.

“As I get out and talk with customers, that’s a growing consensus,” he said on The Insuring Cyber Podcast. “That’s trickling into the board meetings. At the C-level, we’re seeing basically a standing topic of cybersecurity and what organizations are doing to mitigate that risk.”

The report was based on survey findings from more than 500 IT security professionals. Kiser said it’s not only the likely inevitability of cyber attacks but also changes in how companies are doing business with third-party vendors that is driving more newcomers to the cyber insurance market.

“I think one of the other drivers is contracts,” he said. “More and more organizations are adding insurance as a requirement in their everyday business arrangements and business contracts, so in order for me to gain a certain partnership or become a vendor to an ecosystem, I need to prove that I have cyber insurance.”

That said, finding the right cyber insurance coverage isn’t without challenges, and it could be getting more difficult as insurers amp up the requirements. The Cyber Insurance Outlook report found that cyber insurance carriers are exercising more due diligence and requiring more of customers to maintain or grant new coverage. Premiums are also rising, with 77 percent of respondents in the survey saying their annual premiums rose in the past year.

“I think the natural driver of the increase in eligibility for insurance around security controls and the rising premiums are a result of claims,” Kiser said. “From a cyber insurer perspective, of course the rise in claims is going to cause insurers to look more critically at what are their requirements.”

As insurers exercise more scrutiny, Kiser urged companies seeking coverage to return to the basics of cybersecurity controls.

“It’s controls like having MFA (multi-factor authentication) in place,” he said. “Certain backup strategies like snapshots will assist in reducing the severity of an incident because you can recover and restore more effectively. On top of that, the external vulnerability scanning and management are certain items that will help reduce either the severity or frequency.”

He added that incident response planning and collaboration between insureds and their insurance brokers are also crucial.

“Working with your insurance broker, IT firm, privacy law firm, to run through different tabletop exercises really helps reduce the severity as well,” he said.

In fact, Kiser said collaboration among insureds and brokers will be important in 2024 as underwriters continue to be more cautious about granting cyber coverage.

“The client should be working with their insurance broker to understand what are the things that we can do to reduce our severity or frequency,” he said. “I think that’s something that the IT stakeholder can do more of is work with their CFO or risk manager and the insurance broker to have a more collaborative conversation around here’s what we’re doing from an IT and security perspective and here’s how it impacts frequency and severity. And then the broker and the team can help tell that story to the underwriters.”

Check out the rest of the episode to hear what else Kevin had to say, and be sure to check back for new episodes of The Insuring Cyber Podcast publishing every other Wednesday along with the Insuring Cyber newsletter. Thanks for listening.