An Agent’s Guide to Selling Commercial Cyber Insurance

There are several main coverages included, in some form or other, in what we call a “cyber” policy. However, carriers may call it a different name or combine it with other things. It is important to have a discovery conversation with your client to uncover their exposures. It’s equally important to have a conversation with your underwriter about those exposures. Together, we can look at the options you are considering for your insured and see how they fit their needs.

Does My Insured Need Cyber Coverage?

It ultimately depends on their business. Here are some questions you can ask to help uncover the needs of your insured:

If the answer to any of these is yes, they should have cyber liability exposure. Some carriers also call this network security, data breach, and/or privacy liability.

Specific Exposures and Coverages to Consider

Some more specific questions to ask your insured when uncovering exposures could include:

Bad actors may encrypt data and demand a ransom to unlock it so that the insured’s business can continue to operate. They may also exfiltrate the data, demanding a ransom so that they don’t publish the data to the public. For example, trade secrets, PHI (Protected Health Information), etc. In that case, they should be considering coverage for ransomware, post-breach remediation costs, breach management, security and forensic costs, extortion, and/or cyber incident response (carriers use various names for these types of coverage).

If your insured holds sensitive data that is released to the public, they are usually required by law to notify the affected individuals. Coverage for this exposure includes legal and regulatory costs and fines as well as crisis communication. If they accept payment cards, they may need PCI (Payment Card Industry) fines or penalties and assessments coverage.

Other questions to ask include:

If either is yes, they may need coverage for media liability or intellectual property rights infringement and defamation.

If they are, coverage to consider would be funds transfer fraud, dishonesty of employees, social engineering, electronic theft, push payment fraud, unauthorized use of computer resources, and/or cryptojacking coverage. (Again, carriers use varying terms.)

They may want to consider bricking/hardware replacement or system damage coverage.

You can suggest business interruption, income loss and extra expense, and reputational harm coverage.

It is important that both you and your insureds fully understand what kind of coverage any policy under consideration offers or excludes in the case of a catastrophic cyber event.  This is a concern for those using cloud-based services as well.

Current Market Conditions and Best Practices

To wrap up, take this primary word of caution – the cyber insurance market is still finding its feet, and things are changing rapidly. It is a challenging market within the insurance industry, at least for the time being. Therefore, it may not be possible to find a policy that includes everything your insured wants and an interim solution may have to be put in place until the market softens.

If you can coach your insured into having multi-factor authentication and weekly backups that are encrypted and isolated from their system, that will go a long way to helping them find coverage.

At JM Wilson, we understand finding the right policy for your insured can be challenging, especially in complex markets such as cyber. We’re here to help guide you through and find the best possible solution to keep your insured covered.