UK Cyber-Insurance Payouts Surge 230%
▼ Summary
– UK cyber insurance payouts surged 230% to £197m last year compared to the previous 12 months, while policies issued increased by 17%.
– Malware and ransomware accounted for 51% of all claims, a significant increase from 32% in 2023.
– The ABI emphasized that cyber insurance provides both financial protection and preventative support through expert advice and threat monitoring.
– Insurers are tightening policy requirements, demanding baseline security practices from organizations seeking coverage.
– Critics argue that cyber insurance may incentivize attacks if not paired with robust security standards, and ransom payments fuel organized cybercrime.
The UK’s cyber insurance market witnessed a dramatic surge in payouts last year, with insurers disbursing £197 million to policyholders, a staggering 230% increase compared to the previous twelve months. This sharp rise, documented in a recent industry study, reflects a £138 million jump in compensation paid out during the period. At the same time, the number of active policies grew by 17%, indicating that more businesses are seeking this form of protection.
Malicious software and ransomware attacks were responsible for over half of all claims, accounting for 51% of incidents. This marks a significant climb from the 32% recorded just a year earlier. Industry experts point to increasingly advanced and damaging threats as the primary driver behind these larger financial settlements.
Jonathan Fong, Head of General Insurance Policy at the relevant industry body, emphasized that cyber insurance provides more than just financial recovery. He explained, “A comprehensive policy doesn’t only offer support after an incident occurs. It also assists in preventing attacks by providing expert guidance, continuous threat monitoring, and assistance with incident response planning. Given the escalating scale and sophistication of cyber threats, this type of coverage has become an essential element of any modern organizational risk management strategy.”
Some critics have previously suggested that the availability of insurance payouts might be fueling the rise in ransomware incidents, on the theory that attackers expect victim organizations to receive compensation. In response, the insurance sector has started enforcing stricter requirements for policyholders. Insurers now commonly mandate that businesses demonstrate a foundational level of security best practices before granting coverage.
A mid-2024 analysis from broker Howden noted that cyber insurance premiums actually saw double-digit decreases over the past year, even as attack volumes grew. The report credited widespread adoption of strong risk management controls for this counterintuitive trend. Looking ahead, a potential government prohibition on ransom payments for public sector and critical national infrastructure organizations could lead insurers to further tighten their criteria, pushing policyholders toward greater resilience.
Lydia Zhang of Ridge Security Technology highlighted a potential paradox, stating, “There’s a certain irony in cyber insurance becoming a practical solution. When insurance terms are set without thorough security testing or a universally accepted industry standard, it can inadvertently signal to hackers which organizations carry the most extensive coverage.”
Ilia Kolochenko, CEO of ImmuniWeb and a British Computer Society fellow, added that certain ransomware syndicates now coach their victims on circumventing mandatory disclosure rules and payment bans. He observed, “Illicit funds continue to pour into the well-funded operations of organized cybercrime. Meanwhile, victims often hesitate to report breaches for a variety of reasons. In numerous situations, meeting ransom demands appears to be the only viable option for maintaining business continuity and averting financial collapse.”
These findings are partly supported by a separate study from Marsh in May, which indicated that UK businesses submitted more cyber insurance claims last year than in any period except the previous one.
(Source: InfoSecurity Magazine)
