Struggling with cyber insurance? Here’s how an MSSP can help

For years, we’ve insured our companies against fire, flood, and theft. Increasingly, we’re also insuring them against cyber-attacks too. The cyber insurance market is only around two decades old, though, and underwriters have struggled to cope with a rapidly evolving environment.

As threats evolve, cyber insurance is maturing. That carries big implications for clients. It’s getting more expensive and difficult to secure a policy. This is one area where a managed security service provider (MSSP) can help.

Good policies are hard to find

According to a report this summer by international insurance broker Howdens, cyber insurance premiums rose 32% in the year to June 2021, and this trend isn’t slowing. It stems from rising claim volumes and sizes, driven largely by ransomware attacks. Many companies still rely on insurers to pay ransomware fees.

Policies aren’t just more expensive; it’s getting harder to qualify for them at all. Howdens found seven in ten brokers reporting diminished capacity for cyber insurance coverage, up from one in ten during Q1 2020.

Those underwriters still prepared to shoulder the risk are more demanding. Gone are the days when they’d simply hand over a checklist for clients to tick. They now want more detailed information about your cybersecurity measures to assess your risk profile. Expect to see more questions in areas ranging from account authentication measures through to incident response.

Many companies will be bewildered by this new level of scrutiny and won’t know where to begin. They face challenges on all fronts, spanning technical, organizational, and legal.

On the technical side, cyber incidents now evolve faster than ever, and can hide more easily in a growing tide of network telemetry. It’s no longer acceptable to let your guard down for even a moment. Companies that used to stop monitoring their networks overnight, on weekends, or during statutory holidays no longer have that luxury. Monitoring must be constant and detailed to detect emerging problems.

Building the integrated tool sets to detect and respond to these attacks takes considerable time and money. Finding the people to operate them is difficult thanks to an industry-wide skills shortage.

Then, there’s the legal challenge. Companies must have the legal knowledge to navigate complex mandatory breach notification requirements from regulators, along with the technology and talent to satisfy them.

How an MSSP can help

An MSSP can help customers to prepare a robust approach to cybersecurity spanning all these areas. That will satisfy underwriters’ questions when negotiating an insurance policy. The best MSSPs offer a comprehensive range of cybersecurity services that provide end-to-end protection, along with documentation that will satisfy the most fastidious insurer.

A proactive approach to cybersecurity begins before attack detection and response. Insurers now look for evidence that clients are hardening their systems against attack from the beginning. An MSSP can satisfy this requirement with an end-to-end vulnerability management service. It should combine vulnerability scanning with a risk analysis to prioritize software patches. Look for a professional change management capability to apply those changes quickly and efficiently.

An MSSP will have the resources to apply those protections and then monitor client infrastructure around the clock. Nuspire’s detection and response service can handle incoming attacks at any time. We support real-time log monitoring to distill and organize information about events as they happen.

Your MSSP’s security operations center (SOC) should offer the technology, talent, and processes to handle emerging problems quickly. We have created response playbooks for different incident types. We have codified those rules into automated tool chains that give us an end-to-end view of emerging cybersecurity incidents. We can often mitigate them before clients are even aware that there’s a problem.

Modern MSSPs should be able to provide a full ecosystem of cybersecurity services that extends beyond technical solutions. On the strategy side, look for consulting services to help you define your cybersecurity road map. At a tactical and operational level, your MSSP should offer you a robust incident response service with talent at the ready in areas ranging from technical cybersecurity and forensics skills through to communication and legal advice.

A comprehensive MSSP will offer all these services in a convenient package that will deliver more robust cybersecurity than a client could cost-effectively create in-house. It will also help to satisfy underwriters that potential clients are taking security seriously, and answer many of their questions easily. That will often help to reduce your premium cost, and mitigate a rising set of contract restrictions ranging from deductible limits to coinsurance clauses.

This need for a solid and provable approach to cybersecurity will only increase as underwriters become more careful about cyber insurance. Already, we have seen AXA’s French business officially excluding ransomware fee payments from its policies. More robust protections are necessary not just to help secure policies at reasonable prices, but also to protect against those things that underwriters are less willing to cover.

It’s time to level up your cybersecurity protection. Talk to Nuspire about how our managed security services can help reassure your underwriter, your customers, and your managers.