Crypto, ransomware brings cyber insurance in vogue

Exposure to ransomware, compromised emails, cryptojacking, disgruntled employees or adversaries attacking a company’s software or machinery is forcing India Inc to up its cyber insurance. India Inc’s cyber insurance cover ranges from $1 million - $100 million a year and at 35% a year growth rate, cyber insurance is the fastest growing insurance segment.

While banks, NBFCs, IT firms were regular customers, now startups and manufacturing are queuing up insurance. This is because the former can’t afford large losses in its balance sheet and the latter sector, post pandemic, is getting its entire production and billing process completely digitized, exposing them to the risk of cyber attacks.

“Cyber insurance business is growing at a CAGR of 30-35% over the past 2 years. Around ₹300-400 crore comes from cyber insurance alone for insurers now. At least 2-5% of the overall new premium collection is generated from sales of cyber insurance,” said T A Ramalingam, chief technical officer, Bajaj Allianz General Insurance.

“Cyber insurance is fastest growing segment”

Sanjay Datta, Chief - underwriting, reinsurance and claims, ICICI Lombard General Insurance Co Ltd told Mint that Cyber insurance market is growing at over 50% annually.

This is primarily due to low base effect since the amount of companies’ assets covered under cyber insurance three years ago was low due to lack of awareness. Typically, the amount of asset cover is 50-100 times the annual premium paid for cyber insurance.

The premium for insurance covers depends on the size of the firm and consulting firm Aon pegs that the covers range between $1million-$100 million in India. Ramalingam of Bajaj Allianz says the amount of premium depends on the company’s turnover, chances of losses, availability of adequate IT backup system etc.

“The premium for global companies is typically higher than domestic firms,” said Ramalingam.

Industry watchers note that after two years of the pandemic, the manufacturing sector which went into a frenzy to digitalise its processes-billing to procurement, is one of the key markets for cyber insurance.

But due to frequent cyber attacks and their severity the loss ratio in cyber insurance has been high over the past three years, which has increased the cyber insurance premium cost by over 50% over the past year, said Datta.

The cyber criminals, after sending ransomware, often force the company’s management to halt manufacturing process since infected computers prevent the company from seamlessly completing the manufacturing and payment cycle. In such a scenario the whole business comes to a standstill, causing significant revenue losses, says Bajaj Allianz.

Recently one of the largest manufacturing companies was affected by a “Ransomware cyber-attack” The systems of the company was not operatable thus leading to business interruption to the company, The company had procured a cyber liability insurance from ICICI Lombard.

“It had cover for business interruption losses, forensics expenses etc. Our cyber claims experts engaged with the client with in the “Golden Hour” and mitigated the damage to the systems , limited the business interruption losses. Simultaneously we engaged forensic experts to understand the extent of “ ransomware” penetration in the system and helped the company to restart the business. The policy covered losses arising out of business interruption , fees of forensic experts and other related expenses to the ransomware attack,” said Datta of ICICI Lombard.

A senior advisor on cyber insurance said that on 31st of December,2021, all employees of a manufacturing firm received an email from the HR department in their official ID that the company had offered them gift vouchers. Most including the CEO clicked on the link and it turned out to be a malware that brought down the firm’s systems.

“There is significant increase in demand for cyber insurance in India with a potential CAGR in excess of 40% over the next three years,” said Prasanna Kumar, executive vice president and head of financial services and professional group at Aon. Kumar told Mint that there is a demand for cyber specialists who can advise clients on addressing their needs. “The critical part is demand for forensic consultants, legal counsels, incidence response consultants,” Kumar added.

According to Deloitte, cyber insurance as a skill set is rare and “complicated”. “ Unlike regular insurance covers, there is no historical data for cyber insurance and every other day a new threat emerges,” said Anand Venkataraman, partner, Risk Advisory, Deloitte India.

A cyber insurance underwriter will need to know about the insurance sector and cyber attacks, which is a very new area.

While ransomware remains the top form of threat, email exposures by disgruntled employees and cryprojacking -where the attacker takes away access to terminals and illicitly mines cryptocurrencies- are gaining notoriety.

“As of Now there are two types of products the “ Corporate Cyber Liability policies” for the Corporates and Retail cyber liability policies for the Individual buyer. In addition, there is a growing segment of B2B2C where a corporate buy a policy for its customers or offer them to buy it on their own platform or application,” Sanjay Datta, Chief - underwriting, reinsurance and claims, ICICI Lombard General Insurance Co Ltd told Mint.

According to Datta, more than 3,000 corporates buy cyber insurance policies while 20,000 plus policies are held by individuals. The uptick in digital payments has raised the need for more insurance against cyber attacks.

“The business prospects and demand of cyber insurance will be very high due to every day increased adoption of technology , ever changing and dynamic nature of the risks which it represents. We foresee even the best of the cyber secure firms opting for cyber insurance as a residual risk transfer mechanism,” added Datta.