Cyber Liability Insurance: Recent Statistics and Key Insights

1. Cyber Liability

2. Recent Statistics • 40% More buyers today than 2011 of Stand Alone Coverage • 10% More buyers since 2017. Largest gain ever recorded • Top Reasons for Buying Coverage: • Expenses & Fines related to a breach • Liability Costs • Reputation of Your Organization • Top Claims Reported in 2018: • Hacking remains #1 • Ransomware • Phishing Attacks

3. Recent Statistics • Claims almost Doubled from 2017 to 2018 • Claims have Grown 4x since 2016 • 2018 Allocation of Cyber Claim Costs: • IT Forensics 51% • Breach Coach 30% • Notification Costs 12% • Incidents Grew 38% Overall from 2017 to 2018 • Financial Fraud Up 89 from 2017 to 2018 • Ransomware Demands Skyrocketing in $$$ Size

4. K-12 Cyber Incidents Since 2016 = 438!!!

6. 2018 K-12 Statistics/Trends • More than Half were carried out or caused by “Insiders” (Staff or Students) • 23% were a result of a loss of control of Vendors or Partners. Highlights the Need to Strengthen “Contractual Requirements” of Those you are Doing Business with. • Another 23% Carried out by “Unknown Actors”. External to School Community. • 60% of Breaches included Student Data • 46% Included Data about Current or Former Staff Members • Most Concerning was many Attacks were targeted at School Business Officials including largest ever @ $2mm!!!

7. Transfer of Risk Through Insurance Traditional Property and Casualty Policies • Provide protection for bodily injury and property damage from physical perils Fidelity or Crime Policy • Provides protection against the theft of money, securities and tangible property Cyber Liability Policy • Provides protection for network security, privacy and the theft or release of confidential information – both personal and business

8. Property & Casualty Insurance Not developed to cover cyber exposures • Language did not specifically address the exposures • Pricing did not contemplate the risk • Early avenues of possible coverage have been closed Emerging expansion of cover under property policies • Some expansion to address business interruption

9. Fidelity or Crime Insurance Typically Includes • Computer Fraud • Funds Transfer Fraud • Forgery Often inadequate to address today’s exposures • Nuances in policy language and varying interpretations leave gaps in coverage Look to add affirmative coverage • Social Engineering – Fraudulent Transfer Coverage

10. Cyber Liability Insurance Addresses Network Security and Privacy Liability Incidents • First Party Costs – the costs an organization faces when dealing with a breach incident • Third Party Liability – the costs an organization faces for their liability to others as a result of a breach incident

11. First Party Costs Typical Breach Event Costs Include • Legal guidance • Forensics investigation • Crisis management / public relations • Breach notification costs • Credit monitoring Other Business Costs Include • Business interruption • Data restoration • Extortion • Cyber crime – social engineering • Consequential reputational loss

12. Third Party Costs Civil Lawsuits • Consumer class action • Corporate or financial institution suits • Credit card brands • PCI fines, penalties and assessments Regulatory Actions • State AG investigations • FTC investigations • Health and human services – i.e. HIPAA • Foreign privacy entities – GDPR

13. Access to Key Resources At the time of loss • Forensics firm – who, what, where, when • Attorney for various state compliance requirements • Including contractual indemnification obligations • Public Relations expense – brand protection • Credit monitoring, notification assistance • ID restoration services • Licensed investigator/fraud specialist Pre-breach loss mitigation services • Access to free and discounted services

14. IT security, policies and procedures don’t always work! Cyber insurance fills gaps in “traditional” insurance Acts as a financial backstop to the organization Assists the organization with continuity planning Helps to establish relationships with key vendors Demonstrates an organizational commitment to network security and privacy Insurance as a Last Line of Defense