By: Austin Aten and Michael Carr

Past experience. Industry type. Revenue.  

Insurance providers tick the boxes on these factors when setting prices. But accurately setting cyber insurance prices means providers must also review a business’s risk management controls, best practices, and underlying technology stack. The best insurers provide tools for insureds to monitor for risks and threats to avoid a cyber calamity, which can affect insurance pricing. 

With all of these factors to consider, cyber coverage pricing can seem mysterious. But it shouldn’t have to be. Let’s break it down.

Ways to look at exposure: Actuarial factors 

Two components go into pricing: actuarial science and underwriting. Each views exposure through a different lens. An actuary produces rating plans based on big picture items — the insured’s industry, revenue, company size, and more — that help the insurer predict risk. 

Because cyberattacks can have a tremendous domino effect, actuarial factors must also include things like a business’ tech stack -  the operating systems, hardware, and software they use - and its internal controls. 

At Coalition, we delve into the insured company’s technology uses. We ask questions such as: Who hosts the business’ cloud storage? If Microsoft 365 goes down, how many of our insureds won’t be able to send emails? Is their technology self-hosted or hosted on a joint platform? 

To refine pricing, we also look at a business’ internal controls — its own risk management. How difficult is it for a threat actor to access their network? What controls are in place to stop a threat? One of the biggest risks, particularly since the Covid-19 pandemic took hold, is a company’s remote desktop protocol (RDP) or permitting remote access to Microsoft Windows users. In fact, according to Coalition’s 2021 Cyber Insurance Claims Report, the rate of policyholders who experienced a claim due to exposed RDP increased from 29% to 40%, and the severity of these incidents increased by 103% in 2021. RDP is a popular solution for keeping the business running despite external factors, but it can create substantial exposure to a business’ network systems. 

Eliminating insureds with poor risk management practices and a higher probability of a cyber claim from our risk pool means we don’t have to spread high premium costs across all our insureds to cover businesses with large claims. For some risks, we are able to accomplish this by quoting contingent on the prospect addressing vulnerabilities before binding coverage. All of this helps to make our pricing more accurate.

A cyber insurer who does their research 

Coalition determines each business’ risk using our proprietary data platform that monitors for current and emerging cyber threats, resulting in more accurate pricing. Our monitoring tools provide us with early indicators of the next popular cyber targets and we proactively pass this information along to our policyholders so they can take action to remediate any potential risks.

Gathering threat intelligence data proactively by constantly scanning the internet for potential risks enables us to price appropriately since technology is a more dynamic risk than traditional legacy risk. Coalition policyholders benefit from periodic scans that allow us to evaluate their evolving risk profile and identify for them steps they can take to mitigate those risks to avoid claims.

Coalition’s growing knowledge of general cybersecurity trends allows us to adjust for price before we see losses and be on the cutting edge of which tech and businesses are being targeted with events like ransomware.

Ways to look at exposure: Underwriting factors

Once actuarial information is gathered, our underwriters look at the severity of exposure from vulnerabilities outside the scope of technology-based rating factors, including:

•  Number and type of customers 

•  Company business model

•  Media exposures

•  Prior claims and remediation 

• Professional services exposure for tech E&O coverage 

• Contract provisions 

• Overall use of written contracts

• Potential for class action exposure 

Your safety, your savings

Ultimately, at Coalition, our goal is to keep our insureds safe online. Having a cyber loss doesn’t mean your customer is a bad risk for us. If they are responsive to remediating vulnerabilities and your team is committed to segmenting your network to make it safe, that’s what we’re looking for. 

To that end, we keep a close eye on our policyholders and react immediately to their vulnerabilities. If we find risks in the tech world, we notify our policyholders and offer remediation suggestions. Our quick responses means our policyholders have fewer claims overall, and this translates to a lower likelihood of price increases. 

Coalition offers a wealth of resources to help businesses implement good cybersecurity practices, including our Cybersecurity Guide, which outlines the key tenets of a cybersecurity program — a critical factor in reducing your organization’s cyber risk

For questions about Coalition’s claims process, or to be connected to a broker, reach out to our team.

Are you a broker interested in offering Coalition cyber insurance to your clients? Click here to get appointed.