A company’s employees are the “weakest link” in protecting against cybersecurity breaches that need to be covered by insurance, according to Mike Grant, the director of Aliso Viejo-based Marsh & McLennan Agency’s technology practice group.
“They’re the ones connected to the internet,” Grant told the Business Journal. “You can set up the best security you want but all it takes is one person clicking on one email and now they have just let somebody in. They can sit in there undetected for quite some time.”
The insurance brokerage expert said big businesses understand the security risks “by and large” and the need for cyber insurance, including which business bears the responsibility in the event of a breach. Small businesses present a different challenge.
“It’s an education process,” Grant said. “The Chinese government’s probably not targeting your business, but there are a lot of other people money-motivated that can take your data and make some money for it. Or they can drop a virus into your business and hold you hostage until you pay them.
“Most of the small businesses don’t have the budget or the manpower to properly secure their networks,” according to Grant.
One in five organizations does not currently have or plan to purchase cyber insurance, according to a 2017 Marsh & McLennan study.
$450B Cost
When it comes to budgeting, small businesses may decide whether to spend money on insurance or in other areas, such as marketing, according to Grant.
Even large businesses will buy some insurance, “but they’re not going to buy like if Armageddon happens from a cyber situation,” he said.
More and more people in the insurance field are becoming better educated to have the conversation about security and the need for specific cyber insurance coverage. “I believe you should have a separate stand-alone limit with a quality company and product,” he said.
“There is still an oversupply of insurers willing to write this business, especially for the small to midsize market,” Grant said, with prices going down.
The Marsh & McLennan risk and insurance brokerage unit estimates that cyber risk costs businesses nearly $450 billion a year.
