We buy insurance as a promise that if something goes wrong and we need to make a claim, that it will be paid, and we will be in the same position we were before the claim occurred. However, that is not always the case and when claims are rejected by insurers it can be upsetting and disappointing. By understanding the reasons that cyber insurance claims are not paid we might be able to learn how to make sure that the cyber insurance you buy does what it should, if you need to make a claim.
What are the Common Reasons for Cyber Insurance Claim to be Rejected?
1. Failure to Maintain Adequate Security Measures
Many cyber insurance policies require policyholders to maintain specific security measures. If a breach occurs due to the failure to implement or maintain these measures, insurers may deny the claim. Basic security measures include multi-factor authentication, system backups stored off-site (and tested for recovery), staff training, email security, end point protection, vulnerability scans, privileged access management and firewalls.
Example: A company fails to keep its antivirus software up to date, leading to a malware infection. The insurer may deny the claim if regular software patch updates were a policy requirement.
2. Late Reporting of Incidents
Cyber insurance policies often have strict reporting requirements. Delayed reporting can lead to claim denials, as it may impede the insurer’s ability to mitigate damages or investigate the incident properly.
Example: A company discovers a data breach or attack but waits several weeks to report it to their insurer, potentially in breach of the policy’s immediate reporting clause.
3. Misrepresentation or Omission in the Application
If you provide inaccurate information or omit crucial details when applying for cyber insurance, it can lead to claim denials. This can be difficult if you buy the insurance online but if you use an insurance broker, they should be able to help you complete the insurers proposal form or ask Infoprotect UK to help you!
Example: A company fails to disclose a previous security incident on their application. When a related incident occurs, the insurer may deny the claim based on this omission.
4. Acts of War or Terrorism Exclusions
Many cyber insurance policies exclude coverage for acts of war or terrorism. With the rise of state-sponsored cyber-attacks, this exclusion has become increasingly contentious.
Example: A company suffers a cyber-attack that’s later attributed to a hostile nation-state. The insurer may deny the claim under the war exclusion clause.
5. Failure to Obtain Insurer Consent for Expenses
Some policies require the insured to obtain consent before incurring certain expenses related to a cyber incident, such as hiring a PR firm or legal counsel.
Example: A company immediately hires an expensive cybersecurity firm without consulting their insurer, potentially violating policy terms.
6. Social Engineering and Funds Transfer Fraud
Many traditional cyber policies don’t cover losses from social engineering attacks or fraudulent funds transfers unless specifically added.
Example: An employee is tricked into transferring funds to a fraudulent account. If this type of fraud isn’t explicitly covered, the claim may be denied.
How to Improve Your Chances of Claim Approval
- Understand Your Policy: Thoroughly read and understand your cyber insurance policy, including all requirements and exclusions. If you have any questions, your insurance broker should be able to answer them for you.
- Implement Required Security Measures: Ensure you’re meeting all cyber security requirements specified in your policy. This should be an ongoing program of review and not a “once and done” approach.
- Report Incidents Promptly: Establish clear internal procedures for identifying and reporting cyber incidents immediately.
- Be Truthful in Applications: Provide accurate and complete information when applying for or renewing cyber insurance. If you don’t understand a question or what is required, then you should speak to your insurance broker.
- Seek Insurer Consent: Before incurring significant expenses related to a cyber incident, consult with your insurer. It is likely that they will have an approved panel of suppliers who can help you.
- Regular Policy Reviews: As cyber threats evolve, regularly review and update your policy to ensure it meets your current needs. You don’t have to wait until renewal to update or change your insurance policy.
- Document Everything: Keep detailed records of your security practices, incident response procedures, and any cyber events.
By understanding these common reasons for claim denials and taking proactive steps to address them, organisations can significantly improve their chances of having cyber insurance claims approved when they need them most.
Remember, cyber insurance is just one part of a comprehensive cybersecurity strategy.
Partnering with experienced cybersecurity providers like Infoprotect UK can help ensure you have robust protection in place, potentially reducing the likelihood of needing to make a claim in the first place.
