By: 19 January 2019
Mactavish finds ‘significant flaws’ in cyber cover

Insurance governance consultancy Mactavish has found that there has been a surge in businesses buying specialist cyber insurance, but warned that the immaturity of this market means there are significant flaws in the majority of these policies.

The consultancy, which advises organisations of all sizes on their insurance requirements, and which has worked with a quarter companies in the FTSE 100, has recently launched a new cyber risk consulting practice.

Mactavish’s new practice recently reviewed dozens of ‘off-the-shelf’ cyber insurance policies and identified seven significant common flaws:

  • Cover can be limited to events triggered by attacks or unauthorised activity—excluding cover for issues caused by accidental errors or omissions
  • Data breach costs can be limited—for example, covering only costs that the business is strictly legally required to incur (as opposed to much greater costs that would be incurred in practice)
  • Systems interruption cover can be limited to only the brief period of actual network interruption, providing no cover for the more significant knock-on revenue impact in the period after IT systems are restored but the business is still disrupted
  • Cover for systems delivered by outsourced service providers (many businesses’ most significant exposure) varies significantly and is often limited or excluded
  • Exclusions for software in development or systems being rolled out are common and can be unclear or in the worst cases exclude events relating to any recently updated systems
  • Where contractors cause issues (for example, a data breach) but the business is legally responsible, policies will sometimes not respond
  • Notification requirements are often complex and onerous

Bruce Hepburn, CEO of Mactavish, commented: “There are a number of new cyber insurance policies being launched, but despite a sharp increase in cyber incidents this market is very immature and in many respects untested. Perhaps some of these policies have been rushed to market by insurers eager to capitalise on the growing cyber risks facing organisations, and their desire to spend significant amounts of money to protect themselves against this.”

“Very few claims have been made on these new cyber insurance policies, but my bet is that many will be disputed, or settlements will be much lower than clients expected. However, this can be avoided if organisations first understand the cyber risks they face, and then secure a bespoke policy to meet their needs.”