Spiceworks, the marketplace that connects the IT industry, announced the results of a new survey†examining organizations’ adoption of cyber insurance policies, which are often used to offset the recovery costs associated with security incidents. The†results show†38 percent of organizations across†North America†and†Europe†have an active cyber insurance policy. Although adoption is expected to continue growing, many organizations still aren’t sold on the benefits of cyber insurance and are hesitant to purchase a policy. †
“In a world where cybersecurity breaches increasingly make the headlines, many organizations want the peace of mind an insurance policy offers in the unfortunate event of a breach,” says†Peter Tsai, senior technology analyst at Spiceworks. “As a result, we expect the adoption of cyber insurance to increase in businesses across the globe over the next two years. However, despite these expected gains, many organizations still lack knowledge about cyber insurance, while others are skeptical of the value in general.”
Among the 38 percent of organizations that have a cyber insurance policy, 45 percent purchased insurance within the last two years, and 32 percent purchased their policy three to four years ago. Only 24 percent of organizations have been covered for more than five years. Additionally, according to a separate†poll in the Spiceworks Community, 11 percent of organizations without coverage plan to purchase a cyber insurance policy within the next two years.
Increased priority on security is a top driver of cyber insurance adoption
Most organizations (71 percent) are purchasing cyber insurance as a precautionary measure, while 44 percent cited an increased priority on cybersecurity as the reason they purchased a policy. In fact, according to the†2019 State of IT Budgets, increased security concerns is one of top three drivers of IT budget increases in 2019.
The risk of managing large volumes of personal data also drove 39 percent of organizations to purchase cyber insurance. However, less than 15 percent of organizations purchased a policy due to a recent security incident or data breach.
When comparing the prevalence of cyber insurance policies in†North America†and†Europe, the impact of new regulations such as GDPR becomes apparent. Only four percent of organizations in†North America†purchased cyber insurance because of new data protection regulations, compared to 43 percent in†Europe.
Across both regions, 52 percent of companies with cyber insurance have a coverage limit between one to five million, 19 percent have a coverage limit between six to 10 million, and 16 percent are covered for more than 10 million. However, the results show only 7 percent of organizations have ever filed a claim with their cyber insurance provider. †
Skepticism and a lack of knowledge about cyber insurance is affecting adoption
Among the companies that don’t carry cyber insurance, the lack of knowledge about cyber insurance is one of the top three reasons why they haven’t purchased a policy. Thirty-six percent of IT professionals said their organization isn’t covered due to a lack of knowledge about cyber insurance, while 41 percent said it’s not a priority at their organization, and 40 percent said they don’t have the budget for it.
Additionally, 33 percent of organizations haven’t purchased a policy because they aren’t sold on the benefits, and 20 percent reported insufficient use cases for cyber insurance. Twelve percent of organizations also said they’re not confident claims will be paid out.
Methodology††††
The survey was conducted in December 2018 and included 581 respondents from organizations across†North America and†Europe. Respondents are among the millions of IT professionals in Spiceworks and represent a variety of company sizes, including small-to-medium-sized businesses and enterprises. Respondents come from a variety of industries, including manufacturing, healthcare, nonprofits, education, government, and finance.
