Despite Growing Cyber Risk, EMEA Corporations Slow to Adopt Cyber Insurance
While many wait to see the effects of future cyberthreats, and of regulations like the GDPR, the adoption of cyberinsurance remained stunted in the EMEA region in 2016
October 27, 2017 at 09:53 AM
11 minute read
Building puzzle globe. jannoon028/Shutterstock.com.
In the age of ransomware and phishing, many organizations are looking to cyberinsurance to mitigate their risk. But in Europe, the Middle East, and Africa—the EMEA region—such insurance is slow to catch on, according to Aon Risk Solutions' 2017 EMEA Cyber Risk Transfer Comparison Report.
The report looks at the results of a Ponemon Institute survey of over 500 cyber and enterprise risk managers in EMEA corporations conducted in late 2016. Over one-third of respondents disclosed they had a “material or significantly disruptive” breach or incident within the past 24 months, the average financial impact of which was $3.3 million. Around two-thirds, 65 percent, also said their risk of a cyberattack will likely increase over the next two years, while 22 percent predicted it will stay the same.
But when it came to adopting cyber insurance as a remedy, only 23 percent of respondents reported having plans in place. Among those that didn't, 46 percent had no plans to purchase cyber insurance over the next two years, while 54 percent did.
However, in comparing the results from the previous year's survey, Kevin Kalinich, global practice leader of cyber/network risk at Aon, noted that “the awareness of cyber risk and the intent to purchase cyber insurance both increased by about 40 percent.”
Kalinich said the discrepancy between the amount of EMEA companies who see higher cyber risk in the future and those who plan to buy cyber insurance is due to the fact that many EMEA companies didn't see the need to protect themselves financially against cyber risk during 2016.
“EMEA is different than the U.S., where there have been a number of high-profile litigation situations that cost companies large amounts of money,” Kalinich said. He predicted, however, that more EMEA companies would get cyber insurance going forward, in light of the growing amount of European companies that have begun to suffer high financial losses connected to breaches in 2017, including shipping company DPEX Express, consumer goods company Reckitt Benckiser and the European offices of DLA Piper.
Aon predictions, though, may be optimistic, given that it helps its own clients find and purchase cyber insurance and has a vested interest in the cyber insurance industry.
Of those respondents who had cyber insurance in 2016, 56 percent noted their general liability limit was between $2 million and $20 million, while 25 percent had covered liabilities from $1 million to $5 million. What's more, 62 percent of those with cyber insurance called their coverage sufficient. Most of these insurance policies covered external attacks by cyber criminals (83 percent) or those by malicious or criminal insiders (76 percent).
Around half also covered the costs of communicating with regulators after an incident and of notifying data breach victims of the loss, while 49 percent covered third-party liabilities as well.
In addition to coverage, most cyber insurers provided their clients with access to cybersecurity forensics experts (84 percent) and access to legal or regulatory experts (74 percent). Such access to legal and regulatory professionals could prove helpful for EMEA companies given how unfamiliar many are with the risk they face under international laws and regulations: Only 30 percent of respondents, for example, were fully aware of the legal and economic consequences of an international data breach or security incident, while 46 percent were “somewhat aware” and 24 percent were “not aware.”
Kalinich, however, noted that this lack awareness is not connected with a lack of understanding of the general fines and legal liabilities under regulations such as the EU's upcoming General Data Protection Regulation (GDPR), but instead with how such liabilities will become reality.
“They don't have any actual examples of how the EU GDPR fines an entity,” he said. “Why should an organization purchase insurance to cover something or have awareness of something that they don't have actuarial data for?”
Building puzzle globe. jannoon028/Shutterstock.com.
In the age of ransomware and phishing, many organizations are looking to cyberinsurance to mitigate their risk. But in Europe, the Middle East, and Africa—the EMEA region—such insurance is slow to catch on, according to Aon Risk Solutions' 2017 EMEA Cyber Risk Transfer Comparison Report.
The report looks at the results of a Ponemon Institute survey of over 500 cyber and enterprise risk managers in EMEA corporations conducted in late 2016. Over one-third of respondents disclosed they had a “material or significantly disruptive” breach or incident within the past 24 months, the average financial impact of which was $3.3 million. Around two-thirds, 65 percent, also said their risk of a cyberattack will likely increase over the next two years, while 22 percent predicted it will stay the same.
But when it came to adopting cyber insurance as a remedy, only 23 percent of respondents reported having plans in place. Among those that didn't, 46 percent had no plans to purchase cyber insurance over the next two years, while 54 percent did.
However, in comparing the results from the previous year's survey, Kevin Kalinich, global practice leader of cyber/network risk at Aon, noted that “the awareness of cyber risk and the intent to purchase cyber insurance both increased by about 40 percent.”
Kalinich said the discrepancy between the amount of EMEA companies who see higher cyber risk in the future and those who plan to buy cyber insurance is due to the fact that many EMEA companies didn't see the need to protect themselves financially against cyber risk during 2016.
“EMEA is different than the U.S., where there have been a number of high-profile litigation situations that cost companies large amounts of money,” Kalinich said. He predicted, however, that more EMEA companies would get cyber insurance going forward, in light of the growing amount of European companies that have begun to suffer high financial losses connected to breaches in 2017, including shipping company DPEX Express, consumer goods company Reckitt Benckiser and the European offices of
Aon predictions, though, may be optimistic, given that it helps its own clients find and purchase cyber insurance and has a vested interest in the cyber insurance industry.
Of those respondents who had cyber insurance in 2016, 56 percent noted their general liability limit was between $2 million and $20 million, while 25 percent had covered liabilities from $1 million to $5 million. What's more, 62 percent of those with cyber insurance called their coverage sufficient. Most of these insurance policies covered external attacks by cyber criminals (83 percent) or those by malicious or criminal insiders (76 percent).
Around half also covered the costs of communicating with regulators after an incident and of notifying data breach victims of the loss, while 49 percent covered third-party liabilities as well.
In addition to coverage, most cyber insurers provided their clients with access to cybersecurity forensics experts (84 percent) and access to legal or regulatory experts (74 percent). Such access to legal and regulatory professionals could prove helpful for EMEA companies given how unfamiliar many are with the risk they face under international laws and regulations: Only 30 percent of respondents, for example, were fully aware of the legal and economic consequences of an international data breach or security incident, while 46 percent were “somewhat aware” and 24 percent were “not aware.”
Kalinich, however, noted that this lack awareness is not connected with a lack of understanding of the general fines and legal liabilities under regulations such as the EU's upcoming General Data Protection Regulation (GDPR), but instead with how such liabilities will become reality.
“They don't have any actual examples of how the EU GDPR fines an entity,” he said. “Why should an organization purchase insurance to cover something or have awareness of something that they don't have actuarial data for?”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Call for Nominations: Elite Trial Lawyers 2025
- 2Senate Judiciary Dems Release Report on Supreme Court Ethics
- 3Senate Confirms Last 2 of Biden's California Judicial Nominees
- 4Morrison & Foerster Doles Out Year-End and Special Bonuses, Raises Base Compensation for Associates
- 5Tom Girardi to Surrender to Federal Authorities on Jan. 7
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250