Magda On Cyber
Published in

Magda On Cyber

Why every Company needs Cyber Insurance ?

There’s no such thing as 100% security.

Cybersecurity is about managing risk and protecting your assets against threats. The goal is to make it as hard as possible for attackers to succeed, while still making it easy for legitimate users to access what they need.

There are many ways to reduce risk and increase security, but there are always trade-offs. For example, you can encrypt your data, but that makes it harder to use. You can implement two-factor authentication, but that might add friction for users. There’s no silver bullet when it comes to cybersecurity — it’s an ongoing process of evaluation, implementation, and monitoring.

That said, there are some basic steps you can take to improve your posture based on your risk appetite. Now, this is where it becomes even more interesting …

Photo by Vlad Deep on Unsplash

Can you be compromised even with good cybersecurity in place?

According to the Identity Theft Resource Center’s (ITRC) data breach analysis, there were 1,291 data breaches through September 2021. This number indicates a 17% increase in data breaches in comparison to breaches in 2020, which was 1,108. And, that number is only expected to grow in the coming years.

One of the reasons for this increase is that cyber-crime is becoming increasingly sophisticated. Cybercriminals are getting better at finding vulnerabilities in networks and devices, and they’re also getting better at hiding their activities. As a result, businesses need to be increasingly vigilant about cybersecurity and take steps to protect their networks and data.

But, sometimes that is not enough …

APT attacks are a very sophisticated and dangerous type of cyberattack.

APT is short for Advanced Persistent Threat. An APT attack is typically carried out by a well-funded and highly skilled hacker team that’s specifically targeting your organization with the intent to steal sensitive data or compromise your systems.

Because these attacks are so sophisticated, they can be very difficult to detect and protect against. APTs are typically very well planned and executed, and can be very difficult to detect. They often use multiple methods to penetrate the target network, including social engineering, malware, and spear phishing. Once inside the network, the attacker will probe for vulnerabilities and try to exploit them in order to achieve their goal. Very often those attacks are undetected until it is too late …

It’s not “if”, but “when” …

How much are you ready to lose financially after a cyber attack?

No one can be completely financially prepared for a cyber attack. The best we can do is hope to minimize the damages and have a plan in place for incident response.

The average cost of a data breach is now over $4 million according to the latest data breach report by IBM and the Ponemon Institute, and even a small businesses can face significant expenses in the aftermath of an attack.

There’s no escaping the fact that a cyber attack can be extremely costly. The $4 million is just the direct cost — not including indirect costs like lost productivity, customers, and potentially even revenue. Legal communication is critical in the event of a data breach. In order to protect your company’s interests, you’ll need to be in constant communication with your legal team. They can help you understand your rights and responsibilities under state and federal law, for example.

Forensic investigators will be needed to determine the extent of the data breach and identify the attackers. This process can take months or even years, so it’s important to have a team of experts on standby.

And unfortunately, victimized companies often have to spend even more money to improve their security in the wake of an attack.

But while the financial impact of a cyber attack can be significant, it’s important to remember that it doesn’t have to be devastating. There are steps you can take to minimize the damage and strategic decisions you can make that will help you recover financially.

The first step is to have robust insurance coverage in place. This will help ensure that

The best way to prepare for this is to have a comprehensive incident response plan in place. This should include steps for notifying all affected parties, conducting forensics to determine the extent of the attack and recovery.

So there’s no surefire way to protect against a cyber attack, but having a strong incident response plan in place can help mitigate the impact of an attack and minimize the chances of it happening again.

Here are some important components of an effective incident response plan:

  1. Establish a dedicated incident response team. This team should be responsible for coordinating all aspects of the response, from identifying and containing the breach to conducting investigations and communication with stakeholders.
    2. Create clear guidelines and protocols for dealing with incidents. These should be tailored to your organization’s specific needs and vulnerabilities, and should cover everything from who needs to be notified in the event of an attack to what type of data needs to be collected during an investigation.

How does cyber insurance help?

One way to help offset these costs is to purchase cyber insurance, which can help defray the cost of recovery, loss of profit but also can come very handy with incident response.

Cyber insurance coverage will typically provide support for your business after a wide range of cyber-attacks, including data breaches, hacking, ransomware amongst others. Its coverage is important for businesses because it can help protect them financially in the event of a data breach or other cyber incident.

Cyber insurance can help cover the costs of incident response, including the costs of hiring a cybersecurity firm to help investigate and remediate the incident. It can also help pay for the costs of notifying affected customers, providing credit monitoring services, and repairing or replacing breached systems.

The cost of cyber insurance will vary depending on the size and type of your business, as well as the level of coverage you choose. However, most policies will include features such as legal communication and forensic analysis, which can be invaluable in the event of a data breach.

Cyber insurance exclusion refers to the fact that most cyber insurance policies do not cover losses incurred as a result of social engineering attacks, involving financial losses.

Social engineering is a type of attack where an attacker uses human interaction techniques, such as deception or manipulation, to exploit vulnerabilities in people’s behavior or emotions in order to gain access to sensitive information or systems. Because social engineering attacks are often successful due to people’s lack of awareness or poor security practices, they are one of the most common types of attacks used by cybercriminals.

As such, many cyber insurance policies do not include coverage for losses incurred as a result of these types of attacks. Furthermore, most traditional policies like property often exclude cybercrime from their policies. This is because losses resulting from cybercrime are typically excluded under general insurance policy wording as a result of exclusionary clauses, including: exclusion of electronic data and valuable papers; professional services, legal or medical advice, recommendations or information; matters arising out of infringement of copyright, trade mark, patent or other intellectual property rights; and others.

Cyber insurance is a critical piece of your overall cybersecurity strategy. By protecting your business from the financial consequences of a data breach or a cyber attack, you can focus on mitigating the damage and preventing future attacks. If you’re not sure if cyber insurance is right for you, talk to an expert about your specific needs. Together, you can create a plan that will help keep your company cyber resilient !

Follow Magda on Twitter:


By Magda Chelly

Chief Security Officer | TEDx Talk | Author & Keynote Speaker | IFSEC Global Top 20 Cybersecurity Influencer | Entrepreneur | PhD, S-CISO, CISSP, Cert SCI (General Insurance)

Find out on


Follow Magda on her Social Media Accounts:



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store