The issue at the heart of ransomware insurance will be familiar to most parents of young children: rewarding bad behavior only invites more of the same, so it’s generally not a good idea. But critics of the ransomware insurance industry argue that’s exactly what the practice does.<\/p>\n\n\n\n
Ransomware insurance has by now long been suspected of excusing lax security practices and inspiring confidence among cybercriminals that they’ll receive a timely payment following a successful breach.<\/p>\n\n\n\n
Exactly how widespread ransomware claims by businesses are is difficult to determine since companies don\u2019t exactly jump at the chance to discuss their run-ins with ransomware publicly. But it\u2019s safe to assume that claims have risen alongside an undeniable surge<\/a> in ransomware attacks.<\/p>\n\n\n\n Another issue with the cyber insurance industry stems from the fact that paying a ransom is no guarantee that data will be returned. In our recent report on the hidden costs of ransomware<\/a>, nearly 20 percent of respondents were not able to recover their data even after making an extortion payment.<\/p>\n\n\n\n The Paris-based insurance giant AXA broke new ground this year by announcing<\/a> it would stop insuring against cyberattacks, citing a lack of guidance from French regulators about the practice. It\u2019s worth remembering that the FBI<\/a> \u201cdoes not support paying a ransom in response to a ransomware attack.\u201d<\/p>\n\n\n\n So, if U.S.-based insurers were to follow AXA\u2019s logic, they too would stop covering ransomware payments. So far, few have. For now.<\/p>\n\n\n\n Doomed to be a short-lived sector?<\/strong><\/p>\n\n\n\n The industry publication InsuranceJournal.com<\/a> recently wrote in a post on its site that “pressure is building on the industry to stop reimbursing for ransoms.\u201d Before ransomware went rampant, the article notes, cybersecurity insurance was a profitable sub-category of the insurance business as a whole. But those days may be numbered. The sector is now \u201cteetering on the edge of profitability\u201d according to the post\u2019s author.<\/p>\n\n\n\n It\u2019s well-known within cybersecurity circles that ransomware actors will conduct advanced research to determine if a potential target is insured. If so, it\u2019s hardly a deterrent since it increases the likelihood a payment will be made.<\/p>\n\n\n\n It winds up being a self-reinforcing cycle. As ProPublica wrot<\/a>e<\/a> in its study of the industry, \u201cby rewarding hackers, it encourages more ransomware attacks, which in turn frighten more businesses and government agencies into buying policies.\u201d<\/p>\n\n\n\n A commonly cited defense of ransomware insurance is that they not only protect against the cost of the ransom, but also against knock-on expenses from ransomware like downtime, reallocation of tech resources and reputational damage. We know from our own research<\/a> that these costs can be significant, so there\u2019s some validity to this argument.<\/p>\n\n\n\n