Why It’s Tough to Get Cybersecurity Insurance in 2024—and How to Qualify
Many businesses are finding it harder than ever to qualify for cybersecurity insurance. Even those that had policies in the past are now being asked tough questions about the layers of protection they have in place to renew their coverage—and they must prove it. Cybersecurity insurance providers are demanding that companies go beyond basic IT maintenance, like patching, backups, and antivirus, and implement advanced cybersecurity services to qualify for coverage.
Key Cybersecurity Insurance Questions You Need to Answer
Here are some of the critical questions insurers are asking to determine eligibility for cybersecurity insurance in 2024:
- Do you have Multifactor or Two-Factor Authentication (MFA/2FA) for all business email accounts?
- What email security filtering tools are you using?
- Do you conduct regular phishing training and testing for employees?
- How frequently do you back up electronic data?
- Are your backups stored offline or in the cloud and inaccessible from your network?
- Is MFA required to access your backups?
- Have you successfully tested your ability to restore data from backups in the last six months?
- Do you maintain at least three separate copies of your data in different geographic locations?
- Do you use multi-factor authentication to secure all network administrator accounts?
- Is employee access to sensitive information restricted to a business-need-to-know basis?
- Do you use endpoint detection and response (EDR) or next-gen antivirus (NGAV) for all endpoints (e.g., SentinelOne, CrowdStrike)?
- Do you allow remote network access, and if so, do you use a secure VPN with MFA?
- Do you have a Business Continuity Plan (BCP) or Disaster Recovery Plan (DRP) in place, and is it tested annually?
- Is all sensitive data encrypted, both in transit and at rest?
These questions demonstrate that insurance providers are no longer just looking for basic IT protection—they want to see a comprehensive cybersecurity strategy in place.
The Cost of Cyberattacks: Is Cybersecurity Insurance Worth It?
Many companies are now paying for additional layers of cybersecurity because they avoided it in the past, and the cost of not being prepared can be devastating. Noles recommends a minimum $1 million policy that includes cyberextortion coverage. The average cost of recovering from a cyberattack can reach up to $600,000—and that’s just for legal fees, not counting IT recovery costs or downtime.
Watch Out for Policy Gaps
While cybersecurity insurance can help manage risks, it’s not a complete solution. Policies often do not cover wiring fraud, for example, so businesses need to look at alternatives like Managed Detection & Response (MDR), incident response, and secure wire transfer applications. Never send wire instructions via email—this is a common tactic for cybercriminals.
Cybersecurity Insurance Is Not a Substitute for Managed Protection
Think of it this way: Just as a homeowner’s insurance policy isn’t a replacement for a monitored alarm system, cybersecurity insurance isn’t a substitute for proactive cybersecurity measures. The two should work together to protect your business. You need to decide how much you’re willing to invest to protect your assets and your reputation.
At Beyond Computer Solutions, we offer enterprise-grade cybersecurity protection at a cost that small and medium-sized businesses can afford. If you’re trying to qualify for cybersecurity insurance but aren’t able to answer “yes” to some of these key questions, we’re here to help. Contact us for a free consultation to review your cybersecurity needs and insurance options.