IT Briefcase Exclusive Interview: Why SMBs Desperately Need Cyber Insurance and How to Select the Best Coverage

Cyber attacks have become an unfortunate yet inevitable part of doing businesses today. And in the past few years, small and medium-sized businesses (SMBs) have emerged as a major attack target. In fact, according to the Ponemon Institute, more than 55 percent of SMBs experienced a data breach involving customer and employee information in just the past 12 months.

In this interview, Ari Vared, Senior Director of Product at CyberPolicy, will explain why SMBs are so susceptible to cyber attacks. He’ll also discuss the security value of cyber insurance and outline the key factors to consider when shopping for coverage.

• Q. With large-scale breaches like Equifax, Target and Home Depot always in the news, some may find it surprising that SMBs also face substantial cyber risk. What is it about smaller businesses that make them such popular targets?

First of all, SMBs don’t always take cybersecurity seriously. They often fall victim to thinking that no one would want to hack their businesses. Unfortunately, that thinking is dangerous and often leads SMBs to be the focal point for many hackers. Hackers are able to target thousands or even millions of SMBs with little effort by sending out mass malware attacks. Through breaching an SMB, the hacker is often able to access the data and systems of larger enterprises. Just think about what happened with Target – they were hacked through their HVAC vendor.

• Q. How can SMBs realistically and affordably take action to protect their hard-won business?

Good cybersecurity is much easier to implement than one might think. Adhering to basic cybersecurity best practices is critical, such as using unique passwords, implementing two-factor authentication, reigning in Shadow IT and outlining company-wide cybersecurity policies. We also recommend that SMBs leverage cyber insurance to protect their business in the case that something goes wrong. While cyber insurance has historically been inaccessible for SMBs the market has recently adjusted to provide accessible and affordable options tailored specifically to small businesses.

• Q. Anyone who’s ever shopped for health, home or car insurance can attest to how overwhelming the process can be. Is cyber insurance any different? For instance, how should businesses determine what kind of protection they need? Does it depend on the size of the business or industry?

The first step in selecting the right coverage is finding someone you can trust to give you sound guidance. Not all brokers are familiar with cyber insurance, so be sure to find an experienced cyber insurance broker. From there, be sure to ask about the following items:

1. Crisis Management Services – A unique and important element of cyber insurance is access to a full suite of crisis management services. Not every policy will include these, yet they are the most used part of any cyber insurance policy. Services include things like a crisis management coach, breach investigation, data recovery, PR, and a year of credit monitoring for all affected individuals.

2. Sufficient Coverage –There are many offers online for inexpensive, low limit policies or endorsements to one of your existing insurance policies. These policies might make you think you are covered but will likely leave you high and dry if you ever need to use it. Beware of low limit policies that seem too good to be true – they probably are.

3. Beware Exclusions – As they say, the devil is in the details. Insurance is a contract between a business and an insurance company. Often these contracts include exclusion that prevent an insurance policy from kicking in (for example, some policies will not provide coverage if the data came from an unencrypted mobile device). Be sure your agent walks you through the details of your policy and matches you with a highly reputable insurance company.

• Q. You mentioned that cyber insurance is now more accessible to SMBs, how much does it typically cost?

Pricing will depend on the specifics of your company, but in general the pricing for small businesses has been coming down. In 2016, when the first small business insurance policy was broadly introduced to the market, the lowest premium for a $1 million cyber insurance plan was around $63 per month. Since then, though, cyber insurance distribution costs have gone down and the information we use for underwriting has gotten a lot better. This has allowed carriers to offer more affordable, customized insurance options for smaller companies. In fact today, businesses can purchase the same $1 million policy limit with more comprehensive coverage for just $32 per month.

Ari Vared is the Senior Director of Product at San Francisco-based CyberPolicy, providing small businesses with the cybersecurity advice, tools, and insights they need to protect their data, operations and reputation. A wholly-owned subsidiary of CoverHound Inc., CyberPolicy is the world’s first and only comparison site for cyber insurance, helping companies Plan, Prevent, and Insure against today’s modern threats. Ari has spent over a decade helping small businesses sharpen their product, strategy and operations to increase growth and partnership opportunities. His passion for SMBs and expertise in cybersecurity and cyber insurance enable him to provide comprehensive insights for SMBs who are often underserved and most vulnerable to data breaches and cyber attacks.