Why cyber insurance is critical for technology businesses
Businesses in the technology industry face unique cyber exposures due to the data they possess and the technologies they use to support operations. They often store and process sensitive information on behalf of clients and may have direct access to customer applications and systems — all of which makes them prime targets for cybercriminals. These businesses may also rely on third-party software and services to build their products, which can expose them to additional risks if the components have vulnerabilities.
Technology companies typically have a broad attack surface due to their complex and interconnected IT infrastructures, creating a greater opportunity for adversaries to exploit vulnerabilities, gain unauthorized access, and disrupt services. Plus, many organizations have a significant online presence, exposing them to a wide range of threats that can target employees, customers, or infrastructure, underpinning the importance of cyber insurance.
For technology companies that provide services via written contract, a cyber incident can trigger an Errors and Omissions (E&O) claim. These companies may need to maintain specific insurance coverages due to contractual agreements, requiring them to perform specific services, secure data, and control system access. A cyber incident can impact a company’s ability to deliver those services, triggering a breach of contract and exposing clients or other third parties to attacks.
How bad could one small security incident be?
$293,000
Average cost of a cyber claim for technology businesses
40%
Percentage of cyber attacks originating from email inbox
$489,000
Average ransomware loss for technology organizations
Unique exposures for technology organizations
How essential technologies can create cyber risk
Artificial intelligence (AI) & machine learning (ML)
AI and ML systems have become more prevalent in organizations as a way to automate manual tasks, improve efficiency, and maximize productivity. However, these can be exploited to manipulate decision-making processes or trick algorithms into making incorrect predictions, impacting business operations.
Cloud infrastructure
Technology companies typically rely on cloud services for storage, computation, or data processing. Breaches in cloud infrastructure may expose customer data, proprietary information, or sensitive configurations, making the companies vulnerable to various cyber threats.
Code repositories
Code repositories are used to store and manage source code. A repository breach can expose sensitive code, API keys, or authentication credentials that can be exploited for unauthorized access or further attacks.
First-party software & services
Customer web applications and backend database security is a unique exposure for technology companies with customer-facing assets. Whether third parties use the tech-enabled solution for processing orders, tracking shipments, interfacing with suppliers, managing inventory, or managing customer relationships, data flow must be considered an asset with pertinent business risk, similar to financial or tangible assets.
Intellectual property
Many technology companies are involved in research, development, and innovation. They may have valuable intellectual property, proprietary algorithms, or patents that can make them attractive targets for industrial espionage or cyber theft.
Internet of Things (IoT) devices
IoT devices are programmable pieces of hardware used to transmit data over the internet or other networks. They can be embedded into other mobile devices and are vulnerable to intrusions, making them prime targets for attackers to gain access to a business' network.
Third-party software & services
Technology companies often rely on third-party software, libraries, or APIs. If these external components have existing vulnerabilities, or vulnerabilities are discovered in them later, it can create security risks for the technology companies that depend on them.
How sensitive data can increase business liability
Communication & messaging data
Technology firms that provide communication platforms, email services, messaging apps, or social networks gather significant amounts of user-generated content and communications. Breaching these systems can result in blackmail, compromised privacy, or dissemination of sensitive information.
Corporate confidential data
Technology companies may have access to internal operations data, trade secrets, or intellectual property — both their own and that of their clients. Unauthorized access of corporate confidential data could cause significant damage to the data owner, damage client relationships, and even trigger a breach of contract.
Financial data
Many technology businesses handle financial transactions and have access to bank details, credit card information, income and assets, loan information, and credit history. Threat actors may attempt to access this data to compromise financial security.
Personally identifiable information (PII)
PII is any data that can potentially identify a specific person. PII can be used to launch cyber attacks or gain access to networks to initiate attacks. Organizations that mishandle PII or fail to respond to a data breach appropriately can be subject to fines, penalties, and other financial damages.
Protected health information (PHI)
Technology companies can have access to, or process, PHI for their clients. Often as a “Business Associate,” some may even be bound by the Health Insurance Portability and Accountability Act Privacy Rule (HIPAA), which carries additional data protection and reporting requirements if an actual or suspected data breach occurs.
User credentials & personal data
Technology companies maintain customer databases containing users' personal information, including sensitive information like usernames and passwords. These databases are attractive to cybercriminals for identity theft, financial fraud, or selling the information on the dark web.
For more insights, download our complete guide:
Business impacts for technology businesses
What to expect after a cyber incident
Breach of contract or failure to provide services
A cyber incident can impact a company’s ability to provide services, especially those providing technology or consulting services. If a company is unable to fulfill its obligations, it can result in a breach of contract that may expose a company to legal action and expenses beyond the direct costs to respond to an incident that would otherwise be covered by cyber insurance. By adding an endorsement to a cyber insurance policy, technology companies can maintain professional liability coverage that is aligned to the services that they provide.
Direct costs to respond
Responding to a cyber event can require numerous direct costs, also known as first-party expenses. If a technology company experiences BEC and sensitive data is involved, it can trigger a need for additional legal counsel, forensic investigation, victim remediation, and notification. Simple investigations can cost tens of thousands of dollars, while complex matters can increase costs exponentially.
Liability to others
The evolving cyber landscape can be difficult to navigate, particularly as it relates to legal, compliance, and contractual issues. Many technology companies face new and unexpected exposures after a cyber event. Even with strong contracts, policies, and best practices in place, a data breach, security failure, or even a simple mistake can trigger liability to third parties and expose an organization to regulatory investigations and legal action from victims.
Business interruption and reputation damage
A cyber event that impacts essential technology can have a significant impact on an organization's ability to operate and can be highly visible to clients, customers, and other stakeholders. Even short periods of disruption can lead to direct loss of revenue and inhibit a company’s ability to support clients, negatively impacting client retention and acquisition.
Cybercrime
Beyond ransomware and data breaches, technology companies and their clients are vulnerable to the theft of money by electronic means. If an attacker dupes someone in the billing department to alter payment instructions, an organization can lose tens or hundreds of thousands of dollars almost instantly. Attackers can also gain access to email accounts and send fraudulent invoices or payment instructions to donors, beneficiaries, and other third parties.
Recovery and restoration
After a cyber event, resuming operation is no easy task. If an attacker damages or destroys essential technology, data, or equipment, an organization may need to bring in external support or purchase new equipment. Full remediation, restoration, and recovery can take a significant amount of time, when possible, and may require new software, systems, and consultants to rebuild the network.
CYBER INSURANCE BUYER’S GUIDE
Choosing the right cyber coverage for your business
Cyber insurance is an essential aspect of modern risk management, offering coverage for the losses associated with data breaches, cyber extortion, business interruption, and other cyber-related incidents.
Coalition created a Cyber Insurance Buyer's Guide to help businesses navigate the complex cyber insurance market and confidently select the right coverage for their business.
Already a policyholder?
Log in or activate your Coalition Control account, our policyholder risk management platform, to manage your business’s risk profile.
Coalition’s products are underwritten by certain underwriters at Lloyd’s of London (A.M. Best A+ rating) and Arch Insurance Canada Ltd. (A.M. Best A+ rating).
