Skip to Main Content

An Agent’s Guide to Selling Commercial Cyber Insurance

A Day in the Life of an Underwriter

Posted in Professional Development

Author: Jaime Fenimore

There are several main coverages included, in some form or other, in what we call a “cyber” policy. However, carriers may call it a different name or combine it with other things. It is important to have a discovery conversation with your client to uncover their exposures. It’s equally important to have a conversation with your underwriter about those exposures. Together, we can look at the options you are considering for your insured and see how they fit their needs.

Does My Insured Need Cyber Coverage?

It ultimately depends on their business. Here are some questions you can ask to help uncover the needs of your insured:

  • Do they use email where business details, contracts, or payments are discussed?
  • Do they store any PII (Personally Identifiable Information) of their clients?
  • Do they have a network that employees can sign into?
  • Do they process credit card payments? 
  • Do they use any cloud-based services?

If the answer to any of these is yes, they should have cyber liability exposure. Some carriers also call this network security, data breach, and/or privacy liability.

Specific Exposures and Coverages to Consider

Some more specific questions to ask your insured when uncovering exposures could include:

  • Do they store business or client data that is so sensitive that a bad actor could hold it for ransom?
  • Do they have data backups to prevent loss of data that would interrupt their business?

Bad actors may encrypt data and demand a ransom to unlock it so that the insured’s business can continue to operate. They may also exfiltrate the data, demanding a ransom so that they don’t publish the data to the public. For example, trade secrets, PHI (Protected Health Information), etc. In that case, they should be considering coverage for ransomware, post-breach remediation costs, breach management, security and forensic costs, extortion, and/or cyber incident response (carriers use various names for these types of coverage).

If your insured holds sensitive data that is released to the public, they are usually required by law to notify the affected individuals. Coverage for this exposure includes legal and regulatory costs and fines as well as crisis communication. If they accept payment cards, they may need PCI (Payment Card Industry) fines or penalties and assessments coverage.

Other questions to ask include:

  • Do they advertise their business online or in print?
  • Do they have a website?

If either is yes, they may need coverage for media liability or intellectual property rights infringement and defamation.

  • Are they concerned about cybercrime?

If they are, coverage to consider would be funds transfer fraud, dishonesty of employees, social engineering, electronic theft, push payment fraud, unauthorized use of computer resources, and/or cryptojacking coverage. (Again, carriers use varying terms.)

  • Are they worried about a cyber-criminal “bricking” their computer systems? (i.e., they are making it as useful as a brick)

They may want to consider bricking/hardware replacement or system damage coverage.

  • Are they worried about a cyber incident causing their business to come to a halt?

You can suggest business interruption, income loss and extra expense, and reputational harm coverage.

It is important that both you and your insureds fully understand what kind of coverage any policy under consideration offers or excludes in the case of a catastrophic cyber event.  This is a concern for those using cloud-based services as well.

Current Market Conditions and Best Practices

To wrap up, take this primary word of caution – the cyber insurance market is still finding its feet, and things are changing rapidly. It is a challenging market within the insurance industry, at least for the time being. Therefore, it may not be possible to find a policy that includes everything your insured wants and an interim solution may have to be put in place until the market softens.

If you can coach your insured into having multi-factor authentication and weekly backups that are encrypted and isolated from their system, that will go a long way to helping them find coverage.

At JM Wilson, we understand finding the right policy for your insured can be challenging, especially in complex markets such as cyber. We’re here to help guide you through and find the best possible solution to keep your insured covered.

Related Blogs

view all blog posts