{"id":5084,"date":"2017-08-24T05:41:37","date_gmt":"2017-08-24T05:41:37","guid":{"rendered":"https:\/\/securenow.in\/blog\/?p=5084"},"modified":"2026-03-25T11:14:59","modified_gmt":"2026-03-25T11:14:59","slug":"cyber-risk-insurance-india-window-shoppers-converts-even-attacks","status":"publish","type":"post","link":"https:\/\/securenow.in\/insuropedia\/cyber-risk-insurance-india-window-shoppers-converts-even-attacks\/","title":{"rendered":"Cyber risk insurance in India: More window shoppers than converts even after attacks"},"content":{"rendered":"
<\/div>

Published in Factordaily on 24th August 2017
\nA company is hit by ransomware every 40 seconds somewhere in the world, thanks to the rise of the ransomware-as-a-service model that is available \u2018on demand\u2019 to criminal gangs who increasingly target businesses. To date, 2017 has seen this trend play out in full force, with high-profile attacks such as Petya and WannaCry.
\nRansomware is estimated to be a billion-dollar-plus industry, and the damages caused by it to the industry are many orders higher. The losses from Petya on Danish shipper Maersk were estimated to be $200-$300 million. Losses from WannaCry alone were estimated to be around $4 billion.<\/p>\n

While ransomware has been dominating the headlines, companies face plenty of other existential risks, as laid out in a recent report. Losses from a massive cloud service disruption could range from $4.6 billion for a large event to $53 billion for an extreme event; according to a report titled \u2018Counting the Cost\u2018 published last month by global insurance market Lloyd\u2019s and risk-modeling firm Cyence. In a mass software vulnerability scenario, the average losses range from $9.7 billion to $28.7 billion for large and extreme events.<\/p>\n

India too has seen breaches of large magnitude in recent times. more than three million Indian debit cards were compromised in late 2016, reportedly affecting the operations of all the major banks. In May this year, Zomato\u2019s user data was dumped on the dark web, and later pulled down by the hacker. Last month, Reliance Jio\u2019s database was temporarily leaked online and an Ola employee was arrested for unauthorized use of the know-your-customer feature of Aadhar, the country\u2019s unique ID project.<\/p>\n

<\/figcaption>
<\/figcaption>
New business models such as ransomware-as-a-service make it easier for cyber-criminals to target businesses.<\/figcaption><\/figure>\n

Anti-virus and internet security solutions provider McAfee estimates that cyber-criminal activity costs the global economy more than $400 billion. This is expected to increase five times to $2.1 trillion by 2019. Lloyd\u2019s estimates cyber insurance<\/a> to be worth between $3 to $3.5 billion globally with consulting firm PwC pegging it to be worth $7.5 billion by 2020.
\nBut here\u2019s the jolt: in India, the world\u2019s second-largest internet market by users, cyber insurance accounts for less than 1% of the global market.
\nWhat gives?<\/p>\n

More noise than the size<\/b><\/h2>\n

The whole liability insurance<\/a> market in India is about Rs 2,000 crore, estimates by a New Delhi insurance broker. \u201cCyber liability, as a standalone product, is between 3 to 5% of that. So in the scheme of things, it is not meaningful yet,\u201d says Kapil Mehta, co-founder of Securenow.
\n\u201cThe noise in the market is much more than the actual size of the market, as yet. Either their foreign clients are telling them that they ought to be buying this insurance, or they are concerned about these threats on their own,\u201d Mehta says of Indian companies. \u201cThey do come, spend a lot of time asking questions, go through the underwriting process, but often not go through the purchase, because these insurances are complicated and come with a lot of ifs and buts. And they\u2019re expensive.\u201d
\nThis specialist line of insurance, estimated to be a Rs 100 crore plus market, is growing rapidly, reckons Sushant Sarin, Executive Vice President, Commercial Lines at insurer Tata AIG General Insurance.<\/p>\n

\u201cWe have seen a sudden and drastic spike in the number of engagements and queries\u2026 but conversions themselves have not moved up at the same rate,\u201d says Kiran Lokhande, Head of Liability Underwriting, at Bajaj General Insurance. The uptake in cyber liability covers has been 10 to 15% but that doesn\u2019t square up with the number of organizations that are exposed to the risk, he insists.<\/p>\n

<\/figcaption>
<\/figcaption>
Cyber insurance accounts for less than 1% of the global market in India.<\/figcaption><\/figure>\n

\u201cThe average policy premiums for a Rs 5 crore cover start from Rs 2.5 lakh onwards,\u201d says Sarin. The premium is calculated based on the type of business, the scale of the data an organization deals with, the nationality of the data subjects, the cyber security capability of the organization, the amount of insurance cover purchased, etc. His estimate of the growth in the business is higher at 20 to 25%.
\n\u201cIndian IT companies with global exposure, multinational corporations operating in India, are signing up for them, but typical \u2018Lala type\u2019 Indian companies are reluctant due to the premium,\u201d says Manu Dev Summi, Senior Manager at Delhi-based Corporate Risks India Insurance Brokers<\/a>. (The \u2018Lala type\u2019 companies he refers to are thrifty ones that typically come with a trader background.) The current offerings in the market are not helpful for claims in the range of Rs 5 lakh to Rs 10 lakh, he says, adding that he recommends these policies for clients who see a claim of Rs 50 lakh or higher.<\/p>\n

Still maturing<\/b><\/h2>\n

As demand grows, the premium will shrink, and the Corporate Risks manager is confident. \u201cIn the coming years, it will be possible that every individual needs a cyber risk policy<\/a>. So much of your personal data is on your mobile, and if it gets stolen, then you are faced with the threat of cyber risk,\u201d says Summi.
\nWhile they are increasingly a necessity for businesses, cyber insurance providers are struggling to come up with products that can cover all aspects, including investigation, liability, cost, and insurance cover or claims, says Sanchit Vir Gogia, Founder & CEO of research firm Greyhound Knowledge group. \u201cCyber insurance is complex. A forensic probe is an expensive exercise, so who will bear its cost remains a question. Even the factors that determine business losses vary and importantly the definition of \u201cbusiness loss\u2019\u2019 remains highly ambiguous.\u201d<\/p>\n

<\/figcaption>
<\/figcaption>
In certain risk scenarios, businesses stand to lose tens of billions of dollars from a massive cloud service disruption.<\/figcaption><\/figure>\n

Most companies are confused between cyber liability insurance coverage<\/a> (CLIC) and errors and omissions (E&O) insurance, Gogia said, citing data from an upcoming Greyhound survey, State of Cyber Insurance 2017<\/i>. Some 68% of organizations surveyed mixed up CLIC and E&O with just 12% having clarity on cyber insurance. CLIC covers technology-related losses, while E&O<\/a>, also known as professional liability insurance<\/a>, protects against losses from negligence claims made by a client.<\/p>\n

Buyers of cyber risk insurance services in India include banking and IT sectors and the average limits bought are around $5 million, with larger companies opting for up to and over $10 million limits. Some of the largest programs in the market can even range up to $100 million. Companies that provide cyber insurance offerings in India include ICICI Lombard, HDFC Ergo, Bajaj Allianz, and Tata AIG.<\/p>\n

<\/figure>\n
The cyber insurance industry is expected to double its growth by 2020.<\/figure>\n

As insurance companies typically lack domain expertise in cybersecurity, they have started partnering with cybersecurity firms and data analytics vendors. Symantec, for example, offers security analytics solutions for insurers to help them undertake cyber underwriting work and understand the probability of cyber-attacks across a diverse catalog of scenarios. California-based FireEye has global partnerships with insurance companies such as Ace Group and Marsh to mitigate cyber risk. Swiss Re, a reinsurer from Zurich, uses a cyber risk assessment platform provided by Cyence for its underwriting work.
\n\u201cWe recommend organizations undertake a Response Readiness Assessment which tests their ability to respond to cyber security incidents, as strong scores can translate into lower premiums,\u201d says Subhendu Sahu, Acting Country Manager for India at FireEye.<\/p>\n","protected":false},"excerpt":{"rendered":"

Published in Factordaily on 24th August 2017 A company is hit by ransomware every 40 seconds somewhere in the world, thanks to the rise of the ransomware-as-a-service model that is available \u2018on demand\u2019 to criminal gangs who increasingly target businesses. To date, 2017 has seen this trend play out in full force, with high-profile attacks […]<\/p>\n","protected":false},"author":4,"featured_media":5189,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_lmt_disableupdate":"no","_lmt_disable":"no","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[410,319],"tags":[204,260,717,1506,1507,1508],"class_list":["post-5084","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-media-coverage","category-media","tag-liability-insurance","tag-professional-liability-insurance","tag-cyber-insurance","tag-cyber-liability-insurance-coverage","tag-eo","tag-cyber-risk-policy"],"acf":[],"modified_by":"SecureNow","_links":{"self":[{"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/posts\/5084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/comments?post=5084"}],"version-history":[{"count":8,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/posts\/5084\/revisions"}],"predecessor-version":[{"id":35933,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/posts\/5084\/revisions\/35933"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/media?parent=5084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/categories?post=5084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securenow.in\/insuropedia\/wp-json\/wp\/v2\/tags?post=5084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}