Korva is a scroll of the internet’s best ideas.
Save lives or serve customers
Why insurers matter
Cyber insurance sits at the center of any attack response. A company that gets hit usually calls its insurer first, and the policy unlocks the money to hire defenders, lawyers, and incident responders. That is why a cyber war game involving China invited the leaders of insurance companies to play.
The dilemma
The crux came when the players, all insurance executives, were asked where they would send their money first. They could remediate hospital towns to save human lives, or focus on their biggest customers, whom they were bound by contract and law to help first. Military officials in the game told them they had to help military bases first, for national security.
The room turns sober
At first, every executive committed to saving human lives. Then one raised his hand and questioned whether that was realistic: the company had legal obligations to its customers, and he did not know whether it could ignore what the government and the military demanded in the national strategic interest. Honoring those priorities could mean sacrificing American lives, and the room turned sober.
How does cyber insurance unlock incident response?
Cyber policies typically cover the costs of a breach response, including forensic investigators, lawyers, customer notification, and ransom negotiation. Insurers commonly maintain panels of pre-approved response firms and law firms, and a policyholder usually has to notify the insurer promptly after discovering an attack. The policy therefore decides who gets hired and how fast the work can start.
Why do insurers exclude acts of war?
War exclusions are a long-standing feature of insurance, because wars can create losses far larger than a company can price or cover. Applying one to cyberattacks was tested in court after the 2017 NotPetya attack, when insurer ACE invoked the exclusion against pharmaceutical company Merck, and a New Jersey appeals court ruled in 2023 that it did not apply. Lloyd's of London told its syndicates in 2022 that, from March 2023, standalone cyber policies had to exclude losses from state-backed attacks.
Why can one attack overwhelm many insurers?
Insurers call it accumulation risk: a single event can strike many policyholders at once, so claims arrive together instead of spread over time. Malware can spread across companies that share the same software or suppliers. The White House assessed in 2018 that NotPetya caused more than $10 billion in damage worldwide.
More from Fresh Air
