Setting the stage
The title of this article was also the tile of a session presented at ABA TECHSHOW this year. And each part of the title is true. It is absolutely necessary to have cyberinsurance in order to manage your risk. No amount of technology, policies or training can guarantee that you will not be breached. Expensive? Oh yes. Get ready for sticker shock when you purchase cyberinsurance. Because we teach CLEs on cyberinsurance, we can tell you with some assurance that lawyers are very confused about what specific insurance they need. Insurance companies are not very helpful– the various policies offered across the industry are not at all standardized – and of course they are written in complicated language which often obfuscates their meaning.
Where are we today?
Not in a great place. According to a 2017 survey by the data analytics firm FICO, half of U.S. business have no cyberinsurance, 27% have no plans to buy coverage and only 16% report having a policy that covers all cyber risks. There is a certain justified cynicism about cyberinsurance. The news is rife with companies who had cyberinsurance, but found – after being breached – that a substantial portion of their damages were not covered.