Gerry Kennedy, the problem for insurers and the insured is cyber risk management is a responsibility of both parties.

← Back to Blog

Gerry Kennedy, the problem for insurers and the insured is cyber risk management is a responsibility of both parties. As has been repeatedly raised market forces have failed to demonstrate the management of cyber risk. To the extent that it is now a regulated risk for some companies in the U.S and from January 2025 the EU. No amount of technology will fix cyber risk management.

There are several factors that go against the insurance industry in managing cyber risk. Factors that are outside of its direct control, but factors that the industry can influence.
1. Cybersecurity risk management regulation is a risk transfer program that requires the insured to manage cyber risk, using cyber insurance contracts.
2. Incident data does not enable underwriting of cyber insurance. There’s correlation between ‘will I be attacked’ and ‘the effect of an attack’ for insurance clients.
3. Cyber regulation changes the risk transfer equation. Moving cyber risk into the board room.
4. 99% of companies are SMEs, that invariably cannot afford cybersecurity and in many cases cyber insurance.
5. There are not enough experienced and skilled cyber professionals globally to enable cybersecurity risk management.
6. Most company boards do not understand cybersecurity risk management and do not adequately oversight and assure cyber risk ‘Left of Bang’.
7. Cyber insurance is a contract. As with all contracts, obligations have to be met. A lack of understanding of inherent and residual risk by the insured can lead to a significant coverage gap. That many boards do not appreciate.

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberinsurance

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7235572759379021824