Majority of U.S. risk professionals considering purchasing cyber insurance within two years: RIMS survey

Three-quarters (74%) of risk professionals in the United States without cyber insurance are considering purchasing it within two years, according to the first RIMS Cyber Survey 2015, released on Monday.

The survey from RIMS, the risk management society, features input from 284 of RIMS’ professional members in the U.S., with more than half of respondents representing a wide range of organizations with excess of US$1 billion in revenue (58%). The survey explored strategies implemented by risk professionals, including insurance investments, exposures, cyber security ownership, government involvement, as well as identification methods and response procedures. [click image below to enlarge]

The survey found that only 51% of respondents purchased stand-alone cyber insurance policies, with 58% carrying less than US$20 million in cyber coverage. In addition, 49% of those with less than US$20 million in coverage are paying more than US$100,000 in premiums.

The top three reported first party cyber exposures were reputational harm (79%), followed closely by business interruption (78%) and data breach response and notification (73%). For third party cyber exposure, the number one reported exposure was the disclosure of personal information (88%). [click image below to enlarge]

The top three reported first party cyber exposures were reputational harm (79%), business interruption (78%) and data breach response and notification (73%).

Enterprise risk management (ERM) was credited by 77% of respondents for identifying cyber risk. When asked how much the company will spend to protect cyber security exposures in 2015, 28% said less than US$100,000, 25% said more than US$1 million, 17% said US$100,000 to US$250,000, about 15% said US$250,000 to US$500,000, about 9% said US$500,000 to US$750,000 and about 6% said US$750,000 to US$1 million.

“It seems like every day risk professionals are confronted by new cyber-attacks and forced to take immediate action to protect their organizations before it is too late,” RIMS President Rick Roberts said in a press release. “The key to successfully mitigating the impact of a cyber-breach – or even preventing one in the first place – is knowledge.”