Newsletters
Risk Central
Digital EditionCorrelating Cybersecurity Details with Cyber Claims Provides Risk Insights
Cyber insurers can significantly reduce their loss ratios by identifying cyber data and company characteristics that are more predictive of claims, according to a study by Gallagher Re.
The study found that the worst 20% of companies in terms of weak cybersecurity controls were almost seven times more likely to suffer a claim than the best 20%, underscoring the importance of analyzing data that correlates with these profiles in the evolving cyber risk landscape.
Since the early 2010s, cybersecurity firms have been developing technographic data by remotely scanning and assessing companies’ resilience to hacking attacks, amassing large databases of valuable information in the process.
Cyber insurers also have firmographic data on companies, which is company information like revenues or number of employees. The challenge is identifying which data points are most predictive of cyber risk, according to Gallagher Re.
In early 2024, Gallagher Re compared third-party assessments of cyber security provided by Bitsight with the broker’s insurance claims data to identify risk factors. One of the key findings is that the number of IP addresses a company maintains, its so-called cyber footprint, is a strong predictor of claims.
“This is significant, as IP count is not a widely used metric even among cyber insurers at present,” the report noted. “Despite being a strong indicator for company attack surface size, it also has surprisingly little correlation to company revenue, a metric that is commonly used.”
As the cyber threat landscape continues to evolve, the specific cyber risk features driving claim frequency are also shifting. Factors related to hybrid working and cloud identity management, such as mobile application security, have grown in importance. Meanwhile, factors associated with traditional on-premises security, like port security, have decreased in their predictive power, the report noted.
Another promising area explored in the study is Single Point of Failure (SPoF) data provided by Bitsight, which focuses on the dependencies a company has to third party systems and services, such as cloud services, VPNs and email security systems.
“SPoF data goes by many names in the world of cybersecurity. Some external scanning vendors refer to it as ‘footprint data; others call it ‘fourth-party data’ or ‘threat intelligence data’. Nonetheless, these terms all refer to the same concept: identifying the external software and services that an organization is dependent upon,” the report explained.
While still at an earlier stage of development compared to other scanning data, SPoF data shows potential for proactively identifying companies susceptible to emerging threats, such as the July 2024 CrowdStrike incident. Cyber risk modeling firms like CyberCube, RMS, and Guidewire are already incorporating SPoF data into their models, according to the report.
Gallagher Re’s analysis of six SPoF categories yielded some counterintuitive results. For example, companies using a certain email security gateway provider — which scans incoming and outgoing emails for cybersecurity threats — were found to have an increased likelihood of insurance claims, possibly due to misconfigurations or failing security controls, the report noted. The report did not identify the provider.
While rapid advancements in scanning technology are enabling cybersecurity firms to generate valuable new insights, the cybersecurity industry faces challenges in fully leveraging this external scanning data. For example, there is a lack of standardization in how different vendors capture and process data on companies’ SPoF risks, leading to inconsistencies in findings across providers. Some weight a company’s reliance on an external service differently based on whether it is on-premises or cloud-based, the report noted.
Despite these challenges, cyber insurance claims data is helping to fill critical gaps left by the shortcomings in incident reporting.
“In cyber insurance, there is a common misconception that we ‘don’t have enough data’. On the contrary, cyber is rich in data, but many of these datasets are complex and will require long-term cross-industry initiatives and dialogue to fully realize their potential,” the report concluded.
View the full report here. &
