Cyber: Conversation starters

Cybercriminals are increasingly intercepting electronic fund transfers, often by hacking into email accounts, pretending to be someone else and sending fraudulent instructions. Payments are often unrecoverable as they are siphoned off into other accounts quickly, and banks are rarely able to recall the funds and refund the losses.

These scams are hard to spot because cybercriminals are taking the time to study how their victims send and receive payment requests, and they often come from legitimate email accounts that have been compromised. Despite this risk, only 30% of SMEs identify phishing and social engineering as a major threat, suggesting many businesses may underestimate the techniques behind these attacks.* 

Cyber insurance can reimburse significant financial losses that come from scams like these. In fact, funds transfer fraud makes up about a quarter of CFC’s cyber claims globally. 

If sensitive information that businesses are responsible for is subject to unauthorized access or disclosure, they will likely have to notify affected individuals of the breach. They may also be required to provide other services to these individuals, such as credit monitoring or identity theft insurance.

When it comes to PII, there are often rules and regulations about how to secure this data. If you do not adhere to them and subsequently suffer a cyber event, you could face regulatory fines and penalties.

Cyber insurance covers a range of costs associated with responding to data breaches, including legal advice, notifying affected individuals and any regulatory fines and penalties that may be incurred. Yet 68% of SMEs don’t realise comprehensive cyber insurance includes legal and regulatory support. * 

Businesses are often more dependent on computer systems than they realize. Cybercriminals increasingly use ransomware and extortion attacks to encrypt key data and demand payment to restore access. Yet despite its potential to bring business operations to a standstill, only 30% of SMEs identify ransomware as a major threat. *

Most small businesses lack the technical resources to deal with these attacks in-house. Downtime can severely impact operations for weeks or even months, while back-ups may also be deleted or encrypted.

Cyber insurance gives you access to technical experts to help get you back online fast, while covering financial losses from business interruption and the cost of re-creating lost or corrupted data. It can even cover the reputational impact of cancelled contracts and customers choosing to go elsewhere.

Most SMEs lack the resources to have their own in-house cyber security or incident response team to prevent or respond to cyber attacks. Who would you call if you came to work one day and found all your computers inaccessible and encrypted by malware?

A good cyber policy gives you access to a technically-led incident response team, able to step in quickly to help contain the incident and get the business back online quickly. The policy will cover the costs of triaging, containing and repairing your network back to an even more secure state than it was before the attack. 

Proactive cyber attack prevention services are also a vital part of what insurance offers. These services would typically be unavailable to everyday businesses, including vulnerability scanning, threat monitoring and intelligence feeds, but should come at no extra cost. Still, 68% of SMEs don’t realise comprehensive cyber insurance includes proactive cyber security protection, while 61% don’t realise incident response support is included. *

Many ransomware attacks stem from cybercriminals exploiting remote access solutions, whether by conducting brute force attacks which crack simple passwords or by using stolen login credentials. 

Similarly, funds transfer fraud scams often rely on cybercriminals gaining remote access to employee email accounts to perpetrate their scams. Employees may also be more susceptible to phishing scams while working from home, especially when they have no one in the immediate vicinity to sense check suspicious emails. 

In addition, there’s always the risk that work devices taken outside of the office can be lost or stolen, which may result in a data breach. 

Cyber insurance can protect against the financial losses that result from the unintended consequence of remote working, whether that be in the form of ransomware, funds transfer fraud or a data breach.  

Having good cyber security controls in place can make an organization less vulnerable to attack, but it can never make them 100% secure. Indeed, humans are often the weakest link in the cyber security chain. 

This includes everything from employees clicking on a malicious link or attachment in a phishing email, handing over their username and passwords to fraudsters, using weak passwords, not following up new funds transfer requests with a phone call, or losing devices containing sensitive information. 

Yet there’s a double misunderstanding around human error. Only 28% of SMEs identify it as a major cyber threat, while 74% don’t realise comprehensive cyber insurance covers human-error related incidents. *  

Cyber insurance covers the financial losses that can result from these common errors, as well as giving you access to technical experts if someone makes a mistake. It also usually comes with a range of free cyber security tools, including phishing tools to help employees better spot suspicious emails.