Why businesses need more than just insurance in their cybersecurity strategy

Alarm bells should be ringing for companies that rely on insurance as their cyber defence strategy after a decision in the Federal Court earlier this month.

The court ruled that an insurance firm was not liable for costs incurred in the clean-up and recovery process from a ransomware attack suffered by a client.

The case revolved around the definition of ‘direct financial loss’ and legal experts believe it may have a broader impact on the interpretation of claimable costs under cyber insurance policies.

The question of cyber insurance is one that has perplexed many people and organisations.

Cyber insurance can provide financial help to companies who have been targeted by a cyber attack, in the same way that building and contents insurance provides relief in the event of fire or flood.

This is the mindset behind insurance as a concept — a backstop if the worst should occur, a mechanism to help a person or an organisation to return to normal as soon as possible. 

Few organisations would gamble on business insurance, knowing the potential impact on business continuity should a natural or other disaster affect their operations.