Last week Adam Myers, Sales Director at CyberLab, put your questions to Matt Norris, Head of International Distribution at Beazley, and Jack Scott-Bowden, Technical Head of FinTech and Venture at Capsule Insurance.
They covered what happens after a cyber attack, from the first call to your insurer to the day a claim is paid or refused. This article covers the points that matter most for a small or mid-sized business. You can also watch the full webinar.
What is hitting UK businesses
Attackers still get in mostly by breaching a network, and the fastest-growing route is through your suppliers. Around 27% of the incidents Beazley sees involve a vendor, and not only IT vendors. An attacker who wants an easy life breaches one supplier and uses its connections to reach every client.
Supply chain risk, meaning the risk that comes from your suppliers and the software they provide, is moving to the front. A payroll platform or payment processor makes an easy back door, and a weak third party can let an attacker slip past the defences of a much larger customer. Long-standing suppliers carry their own risk: you vetted them years ago, and they may run legacy systems nobody has reviewed since.
Phishing and stolen credentials account for roughly a quarter of the incidents the webinar guests see. Phishing means fake messages that trick someone into clicking a link or handing over details. Forgotten, unpatched software is another back door that attackers find easily.
Ransom payments are changing. On Beazley's figures, over half of ransom demands were paid at the peak during COVID, against roughly 20% now. The amounts have risen, though. Attackers now push harder, get further into the network and steal more data, so a business that does pay can expect to pay more.
AI sits on both sides. AI-built phishing copies brands and fonts well enough to fool more people. Defenders use AI too, to flag unusual behaviour, such as an urgent request from someone who has never sent one, instead of trying to spot a fake sender.
The first 72 hours
Attackers try to isolate one person and pile time and emotional pressure on them. The counter is a decision group assembled within a couple of hours: someone who understands the revenue impact, someone who understands your legal duties on a data breach, and someone with the authority to decide. Five or six people is normal. If nobody holds that authority, the whole response slows.
The group faces a hard trade-off straight away. Ransomware usually brings both business interruption and a data breach, and different organisations rank them differently. A manufacturer with a product launch tomorrow may put getting running first. A school holding children's records may delay recovery to protect that data.
Do not plan over email if it still works, because attackers may be reading it. Set up a communication channel they cannot see before you need it. Beazley can start incident calls within an hour or two, and the usual cause of delay is how prepared the client is to get the right people around the table.
What you need most is facts. How did they get in, where did they go, what did they reach, and do you still have working backups? What the criminals tell you may be false. Test your incident response plan before you need it, including who writes the press release and how the team talks when systems are down.
Staff communication does three jobs. It stops worried employees posting on social media, it gives everyone one consistent message when customers ring, and it avoids a silence that people fill with speculation. If you know little, saying you are actively investigating is a good start.
Then there is the ICO clock. The Information Commissioner's Office (ICO) is the UK's data protection regulator, and a reportable personal data breach has to reach it within 72 hours. If someone spots a problem on a Friday afternoon and tells nobody, 60 of those hours can pass before the weekend ends. Each hour you wait to tell your insurer adds to your regulatory and reputational exposure.
Regulators would rather hear early, even while you are still investigating, because it shows you are managing the incident. Tell the regulator at the same time as the press, never after. If the 72 hours pass and you still do not know the full picture, keep updating the regulator each day.
What your insurer brings to a breach
A good cyber policy buys you a response team as well as a payout. Expect to speak to a project manager within an hour or two of calling your insurer, someone who has run many incidents and works out who to deploy as the picture becomes clearer. Three specialists almost always follow.
- A forensic investigator. Your own IT team may feel able to investigate, but a professional does a different job, as a professional photographer does next to a snapshot. External parties such as regulators and major clients also prefer an investigator who is not marking your homework.
- A lawyer. Bring them in early, not at the end to approve a statement. They advise on who to notify, how often and when the 72 hours start, and they can sometimes ask a regulator whether notification is needed without naming you.
- A PR specialist who understands ransomware. When the press calls, you have to decide whether to reply, what to say and where to say it. One small business owner who went through an incident called it the best publicity opportunity he ever had, because he controlled the message and had the facts.
Without cover, the first 24 hours of a crisis go on searching for a data privacy lawyer, hiring forensic investigators at short notice and looking for a PR firm that knows extortion. Expect to pay far more than an insurer's route costs.
Ransom negotiation
A ransom negotiation needs a specialist. Beazley works with a firm that does nothing else. Its negotiators stay calm while the attackers try to raise the emotional pressure and stop you thinking clearly.
The specialist also brings information you cannot get alone. From the style of the messages, specialists can often identify which of the few hundred active groups is behind the attack. That tells you how often that group steals data, what it usually settles for, how much room there is to negotiate, and whether it publishes stolen data even after payment. Some groups will settle for a fraction of the first demand. A few come back later for a second payment.
Negotiating, even if you never intend to pay, also buys time. The negotiator speaks to the attackers as an employee of your business, then reports back so you decide. Each day of negotiation gives your technical and forensic teams another 24 to 48 hours to find the intruder, clean the network and check backups.
Whether to pay depends on who you are, who you are dealing with and whether your backups work. Schools, charities and healthcare organisations often weigh the risk to sensitive data most heavily. You must also check sanctions rules before any payment, so the decision should not rest with a CEO acting alone.
When insurance does not pay
Buying a cyber policy is relatively easy right now, because the market is soft. Getting a claim paid in full is harder, and the problem usually comes from a gap between what you told the underwriter and what runs in your business.
Take multi-factor authentication (MFA), the second proof of identity you give on top of a password. If your application says MFA covers your network and forensic investigators later find it switched off, the insurer could reduce or void the claim. That does not always happen, but the safe approach is to make sure what you tell insurers matches what you run today, and to keep it that way as you grow. The better reason to apply critical controls is that attackers use automated tools to find the gaps, with insurance a secondary reason.
Exclusions are the second area. Infrastructure and war exclusions are common across the market. The cause and motive of an attack are rarely confirmed, and an insurer needs facts to apply an exclusion, so there is some reassurance here. Read your own policy wording to see what yours says.
A good cyber policy also covers outcomes, such as a network security breach or a data breach, and says nothing about how the attack happened. Phishing, algorithms and AI are routes to the same results. Businesses now ask whether their policy responds to an attack with no human behind it, and many insurers are adding explicit AI wording to confirm cover. Check that your policy deals with outcomes, not methods, because that wording keeps working as attacks change.
What strong controls do to your premium
Capsule's ballpark for UK businesses with £1 million to £10 million in revenue is a standard premium from around £1,500, sometimes less, to £10,000 or more. Revenue, sector and claims history set the starting price. Your cyber posture, meaning the security controls you can show, decides whether you get proper cover at all. A business with weak controls may struggle to find an underwriter, or end up with a policy that is not worth the paper it is written on.
Beazley can load a risk by 10% or discount it by up to 25%, depending on the risk features it can verify. The shift is towards verification. Insurers used to rely on a business declaring that it had MFA. Now they increasingly look for third-party evidence, and one verified indicator can say a lot about your wider posture. A recognised certification is one example. Insurers can also see from outside whether risky ports, the doors into a network, are open to the public. Attackers use automated tools that find open ports without knowing who you are, and closing them is a baseline that costs little money and little effort.
Cyber Essentials, the UK government-backed baseline scheme, makes a good case for your posture and can help bring premiums down. It is also a valuable first step for building a security culture, and ISO 27001, the international information security standard, helps too. Neither solves everything, because one weakness can still bring the whole house down.
Two things to do this week
Ask for the first 24 hours. Ask whoever runs security in your business to walk you through the first 24 hours after a ransomware attack, step by step. Listen closely. If insurance is not a central part of the answer, review your response plan and put it at the heart.
Plan to outsource incident response. Start from the assumption that you will. Nobody does it every day except specialists, and a specialist team helps you recover faster. Insurance is one of the cheapest ways to get that service, because a policy provides the experts as well as paying the bill.
What to do next
- Write down your first 24 hours, name who can authorise decisions, and agree a way to communicate if email is down. Then test the plan.
- Check that what you told your insurer about MFA and other controls matches what runs in your business today.
- Close or restrict anything open to the public internet that does not need to be, and patch outdated software.
- Read your policy for exclusions, and for wording that covers outcomes rather than methods.
- See what attackers see. The free HackRisk Report shows your top risks from the outside, including exposed assets and vulnerabilities.
HackRisk subscribers can access up to 10% savings on cyber insurance.
Get your free HackRisk Report for a board-ready view of your external attack surface within 24 hours. It comes with a free 30-day HackRisk trial: 30 days of portal access, no card required and no sales call.
Or watch the full webinar to hear the guests in full.