Developing strategies to bridge commercial & personal cyber risks

Many commercial and personal policyholders worry there are too many exclusions to make cyber insurance worthwhile. They fear any paid premiums could be wasted on inadequate coverage if they become the victim of a sophisticated attack that begins at a workplace and follows them home.

These feelings reflect the changing realities of intermingled cyber risks. The average individual may have several attack surfaces across personal, professional and lifestyle endeavors. Cybercriminals see no delineation—and cyber insurance coverage that does is missing a now-vast opportunity.

Take, for example, social engineering, the costliest exposure in 2024. If the personally identifiable information (PII) of employees is exposed in a commercial attack, it's likely that executives, board members, employees, and their family members will experience follow-on attacks and social engineering scams at home. Among insurance partners of Cyberscout, a TransUnion brand, social engineering accounted for 37% of all cyber loss payments. In 2023, the lack of commercial social engineering coverage constituted 92% of all commercial lines claim denials.

Trends like these serve as a rallying cry to the insurance community. To protect more consumers and businesses from one of the fastest-moving threats they face, insurers have an opportunity to expand cyber coverage beyond today's common limits.

Fortunately, there is a model for this strategy — blanket insurance policies.
Over decades, insurers have realized the numerous benefits of blanket policies, from competitive advantages and customer retention to enhanced risk management and increased premium revenue. In the realm of cyber insurance, a blanket policy would more completely address commercial and personal risks under a single limit. This more comprehensive policy would cover incidents currently excluded from traditional commercial policies, such as a cyberattack on a personal device, identity theft, fraud affecting personal accounts or credit cards, or cyber bullying or extortion, as examples.

Although several customer personas comprise a healthy marketplace for blanket cyber insurance, three in particular rise to the top — high net worth individuals and families, prominent executives and small business owners.

High net worth individuals and families

Wealthy people have long been a favorite target among scammers. Today, fraudsters increasingly target the children of wealthy people. New research from Javelin found that children from more affluent households are at greater risk of being targeted and compromised by cybercriminals. The researchers attribute this to the access that advantaged youth have to social media and other online accounts across multiple devices, as well as access to payment cards, online gaming and other e-commerce accounts targeted by cybercriminals. 

Blanket cyber policies that cover not only the policyowner, but also their dependents, would help reduce the risk of losses stemming from an attack on a family member.

Prominent executives

While many companies provide personal protection for executives, physical security has dominated much of the conversation. Yet the financial and digital security risks associated with holding a prominent executive position should also be considered by board members and executive compensation committees.

Spear phishing attacks, for example, target specific individuals using information that is readily available on corporate websites, social media profiles, conference speaker bios and corporate communications, such as annual reports. Providing comprehensive (i.e., blanket) cyber insurance as an executive benefit recognizes the personal risks these business leaders face and demonstrates the company's commitment to their security.

Small business owners

When looking at the cyber insurance market, policy ownership is nearly 80% among large enterprises. Among small businesses, however, adoption is drastically lower, with some estimates placing cyber insurance policy ownership below 10%.

For small businesses that live and die by an owner's reputation, a single personal cyber incident could threaten the health of the company. When a business owner's personal identity and/or accounts are compromised, it's not uncommon for criminals to access the business holdings of the victim. The rise in social engineering schemes makes businesses especially vulnerable to the risks of inadequate insurance coverage for their executives and owners.

By covering a broader attack surface, blanket cyber insurance policies can protect against the fallout of both personal and commercial attacks — reducing the risks of cyber spill over, while increasing penetration of the small business market along the way.

Putting the cart before the horse?

For blanket cyber insurance to achieve its full market potential, the industry must contend with a few key issues.

First, there's significant room for improvement when it comes to personal cyber insurance awareness and understanding. The category needs marketing help to boost recognition and stimulate demand. Are high net worth individuals, prominent executives and small business owners even aware such protection is available to them? Do they fully understand the risks — and prevalence — of social engineering scams, account takeovers or stolen personal and business identities?

Next, the unfortunate origins of cyber insurance as a homeowners policy rider must be addressed. As a rider, the product was unfortunately positioned as an afterthought with limited potential for profitability. Today, as insurers contend with big-ticket catastrophic claims, only those products with the potential to produce revenue are earning a second look. Blanket cyber has that potential, but the market won't recognize it without intentional and compelling campaigns designed to dislodge decades-old mindsets.

Third, cross-departmental collaboration should be encouraged. While many industries struggle with stubborn silos, the potential benefits of combining subject matter expertise and product innovation — such as integrating property casualty and employee benefits — are too significant to ignore. If teams within broker firms work together, they can scale market penetration for a jointly beneficial product capable of carving out a new and healthy revenue stream for the larger business.

A revolutionary way to deliver peace of mind

Some of the world's greatest innovations have taken inspiration from products and experiences already in existence. By mirroring successful umbrella policies from other categories, blanket cyber insurance stands to revolutionize delivery of this critical protection. With the right mix of strategic communication and collaboration, individuals at the highest risk of cyber exposure will obtain the peace of mind they need to continue running successful businesses and financially healthy lives.