Cyber ​​insurance rates fall as companies improve security, report says

LONDON (Reuters) – Cyber ​​insurance premiums are falling globally as companies become more adept at reducing their cybercrime losses, even as ransomware attacks rise, broker Howden said in a report on Monday .

Insurance premiums to protect businesses against cyberattacks soared in 2021 and 2022 as the COVID-19 pandemic drove cyber incidents.

But premiums have been falling over the past year, according to Howden’s annual report. The cyber insurance market has seen double-digit price reductions in 2023/24, Howden said.

Additional security, such as multi-factor authentication, has helped protect companies’ data, reducing insurance claims.

“MFA is the most basic thing you can do, it’s like locking the door when you leave the house,” said Sarah Neild, head of cyber retail at Howden in the UK.

“Cybersecurity is a multi-layered beast,” Neild added, also pointing to greater investment in IT security, including staff training.

“Overall, customers are more robust.”

Insurers’ greater appetite to offer cyber insurance is also leading to price reductions, Neild said, even as attacks increase.

Global ransomware attacks declined following Russia’s invasion of Ukraine in February 2022, as hackers in those countries focused on the military effort.

However, recorded ransomware incidents increased by 18% in the first five months of 2024 compared to the previous year, the report said.

Ransom software works by encrypting data. Typically, hackers offer an access code to victims of an attack, allowing them to recover data in exchange for cryptocurrency payments.

Business interruption is often the biggest cost following a cyberattack, but companies are able to reduce these costs with better backup systems, such as through the use of cloud providers, the report states.

Most of the cyber insurance business is in the United States, but growth in the $15 billion global cyber insurance market is expected to be fastest in Europe in the coming years, given currently lower penetration levels, it says the report.

Small businesses are less likely to purchase cyber insurance, in part due to a lack of cyber risk awareness, the report added.

(Reporting by Carolyn Cohn; Editing by Alison Williams)