Within the past few years, cybersecurity has grown into a field of significant concern for businesses worldwide. This increased concern is not without reason; as digital technology advances, so do the threats posed by cybercriminals. High-profile cases such as the recent CrowdStrike’s losses have particularly underlined the gravity and potential consequences of these threats. The losses faced by CrowdStrike may be an indication of a larger concern that experts, including famed investor Warren Buffett, have been warning about for years – namely, the increasing risk associated with cybersecurity insurance.
Cyber insurance is a service that companies, like CrowdStrike, use as a safeguard against potential cyber-attacks or data breaches. This insurance often covers expenses incurred due to the cyber incident, such as investigation, business loss, privacy and notification, and lawsuits and extortions. Given the increasing prevalence of cyber threats, the demand for these policies is also steadily growing. However, with the rise in cyber-criminal activity, it has become a double-edged sword for many insurers.
CrowdStrike, a Californian cybersecurity technology company, experienced substantial losses and became a case study illuminating the risks of this growing industry. The company reported a significant breach incident that incurred losses amounting to millions, testing cybersecurity insurance’s efficacy. The substantial costs related to rectifying the infrastructural damages, paying ransoms if any, dealing with business interruption costs, legal proceedings, and reputation management far exceeded the limits of their insurance coverage. This led to the company bearing an overwhelming amount of the costs tied to the attack, revealing a clear gap between the potential damage of cyber attacks and the coverage provided by current cyber insurance policies.
Warren Buffett has previously expressed his concern about the murky waters of cybersecurity insurance. According to Buffett, cyber-attacks pose significant unknowns in the insurance industry and are progressions of the digital age that are difficult to quantify in risk and cost. He believes that while most insurance risks can be calculated and priced with a considerable degree of accuracy, cybersecurity risks pose an anomaly due to their continually evolving nature that insurance companies and underwriters find challenging to predict and evaluate. This uncertainty makes the coverage limits of cyber insurance policies critically low compared to the costs involved in mitigating cyber-attacks, leaving companies like CrowdStrike in a precarious position.
As evidenced by CrowdStrike’s losses, the business world is facing a new era where cyber threats are not only damaging to digital and physical infrastructures but can drain resources and financial reserves. These attacks can force companies to bear significant costs that exceed their premiums and coverage limits, leading to substantial losses.
Buffett has long warned about the potential pitfalls of underinsured cyber risk, and CrowdStrike’s ordeal may be the biggest example yet of what that can entail. It underscores the urgent need for insurance companies to reassess their cyber risk evaluation strategies, broaden the scope of their coverage, and adequately price their products to cover the true cost of potential cyber-attacks. As the digital landscape continues to evolve, so should the strategies of those offering protection against its inherent risks, for the consequences of inaction could be severe.
