Mactavish, the UK’s leading expert on insurance governance, has launched a new Cyber Risk Consulting Practice for corporates as it warns the majority of off-the-shelf cyber specialist insurance policies have major flaws, and that some companies need entirely different cover.  Given this, it is concerned that some organisations could be ‘mis-sold’ policies.

The new practice will first help businesses identify their cyber risks, and this should include looking at current contingency plans for cyber events and the potential liabilities and penalties their business could face.  It will also help clients develop business-specific loss scenarios documenting more nuanced insurance needs.

Furthermore, for those who do identify a specific need for a cyber policy,  the practice can then help clients find and negotiate appropriate cover.

Mactavish says cyber cover is not necessary for some organisations, or that the configuration of cover is often wrong, but it fears they may face strong sales tactics and scaremongering from brokers and insurers to buy cover. 

Bruce Hepburn, CEO, Mactavish said: “For businesses that hold limited personal data and can operate with manual processes following systems interruption, most additional cyber cover may be of very limited value. Specific exposures can also often be effectively and economically covered via amendment of existing insurance policies. For example, Professional Indemnity insurance can sometimes cover damages payable to third parties for data breaches, and Business Interruption insurance can cover aspects of network interruption.  However, traditional policies often only respond to  potential cyber events through careful amendments to their wording.”

Commenting on the proliferation of specialist cyber insurance, Hepburn added: “Cyber insurance is a new and untested financial product, and in many cases it is complex and incomplete, and in need of major adaptation to provide reliable protection for a specific business’s exposures.”