Cyber insurance helps cushion the financial impact of a data breach, but did you know that insurance carriers expect policyholders to meet them halfway? A company applying for a cyber insurance policy must demonstrate its effective cybersecurity policies and countermeasures. For example, many carriers require the applicant to prove that it is using an Endpoint Detection and Response (EDR) solution before issuing a policy.
Even when a company has a cyber insurance policy, its claims may still be denied if the carrier determines that it has not been diligent enough in risk mitigation, a problem known as “failure to maintain” an adequate security posture. This article explores why EDR is essential for getting cyber insurance and how the technology helps ensure that cyber insurance claims will not be rejected.
Why cyber insurance applications and claims get turned down
Insurance carriers are careful about whom they underwrite with cyber insurance. Just as the owner of an old car that lacks seatbelts will have trouble getting car insurance, so will companies with deficient cybersecurity policies and controls struggle to get cyber insurance. Reasons for rejecting an application for coverage include a lack of preventative security measures, poor security training and awareness, and inadequate endpoint security. Claims get turned down if the carrier determines that the policyholder has let its countermeasures lapse—a “failure to maintain” situation.
How endpoint security helps avoid breaches and claims
Cyber insurance carriers emphasize endpoint security, often requiring EDR, because almost all breaches begin at the endpoint. This should make intuitive sense because the endpoint is where end users encounter potential malware, and malicious actors can usually find a path into a target network. If endpoints are not well protected, the entire organization is exposed to the risk of breach. Additionally, with today’s hybrid workforces or work-from-anywhere business models, the endpoint is considered the new network edge—meaning security protections must reach every user and their devices.
How EDR protects from cyber insurance denials
The insurance requirement to run EDR comes from a consensus that traditional, simpler countermeasures are no longer sufficient to block today’s sophisticated attack vectors. For example, standard signature-based antivirus technologies will miss threats that lack a known signature. This is a common scenario today. EDR may use artificial intelligence (AI) to detect anomalous behavior at the endpoint that suggests an attack is taking place, even if no known signature is present.
After an EDR solution has detected an attack (the “D” in EDR), the “R” for response kicks in. EDR can facilitate an effective response to an attack. This reduces the overall cost of containing the breach and remediating the vulnerabilities that caused it.
For these reasons, cyber insurance carriers usually want to see EDR in place before they’ll issue a policy. The presence of EDR gives them some confidence that losses on the policy will be low in comparison to policies on companies that lack EDR. Having an actively functioning EDR solution in place also protects the policyholder from having a claim denied for a failure to maintain. The policyholder can say, in good faith, that they were being diligent in defending their endpoints.
Still, the best cyber insurance claim is the one never filed
Another compelling reason to consider EDR, even if one has cyber insurance, is that the best claim is often the one that never gets filed. Filing a cyber insurance claim means there’s been a breach. It’s far better to avoid being in that situation in the first place. Even though insurance covers some of the costs of dealing with a breach, it cannot make up for the disruption and loss of reputation that comes with a significant breach. EDR helps prevent those outcomes.
Cyber insurance is an essential element of an effective risk management strategy. The policies cover some of the high costs of handling a cyberattack. Getting approved for a policy means demonstrating satisfactory security, however. In many cases, carriers require EDR, because endpoints are critical to defending digital assets and preventing breaches. With EDR, an insured organization can detect attacks and mount a robust response. Insurance carriers like that, so they are insisting that their policyholders adopt the technology.
About Plow Networks
Plow Networks is a leading IT services provider, connecting businesses to technology since 2012. With deep expertise in network, cloud, and end user support services, we partner with clients to leverage technology in ways that simplify operations and fuel growth. Plow Networks is based in Brentwood, Tennessee.
