Is a high cyber insurance premium about your risk, or your insurer’s?

A sky-high premium may not always reflect your company’s security posture

08 Aug 2025
 • 
,
3 min. read

When a cyber risk insurance quote lands on your desk and the premium is sky high, it’s natural to assume that the insurer is judging your environment to be high risk. So, when the next quote lands and is more acceptable, does it mean they viewed your risk differently?

According to one of the many cyber insurance presentations at Black Hat USA 2025, the reason may not be so obvious: it may be that the insurer is limiting its risk exposure to a product or service you use, rather than finding a risk within your environment.

To be more specific, an insurer may wish to limit its exposure to a certain vendor in your supply chain. For example, imagine they decide that acceptable risk is for only 60% of their policyholders to use product X. If your business were to push them over this limit, they may just price themselves out of your business with a high quote, rather than declining you.

The risk, therefore, is not with your environment – it’s with the supplier. In fact, there may not even be a specific risk with them. It could just be that a risk limit set by the insurer has been reached.

As consumers, we can see this in practice. When I use a car insurance comparison site, the premium amounts vary by as much as 200%. Yet my risk is the same to all insurers, and it’s likely that some insurers are capping their risk exposure to certain car manufacturers by pricing themselves out of the market.

As the cyber insurance and cybersecurity industries become further entwined, the data-based insights from insurers’ claims can – and should – improve cybersecurity posture for everyone involved, not just the insured. As a cybersecurity professional, I assume that multi-factor-authentication is default ‘ON’ for any company providing their employees remote access via an SSL VPN.

My assumption, though, is far from correct. A statistic shared during a presentation revealed that in the first six months of 2025, 45% of new cyber claims were a result of an SSL VPN lacking MFA. This is shocking for two reasons: firstly, why do insurers provide policies to companies that have no MFA given the risk of a claim, and secondly, why would any company not secure their SSL VPN with MFA?

What claims data reveals

According to data presented by Coalition, 55% of all ransomware attacks are initiated through a perimeter security device. And in claims where the method used is known, there is a clear winner: credential theft.

While ransomware dominates the discussion, there was good news presented. Coalition’s efforts to claw back funds from fraudulent transfers do have some success. In 2024, they managed to recover $31 million, using various methods that include alerting government contacts, obtaining injunctions to freeze funds and engaging specialized crisis response experts. This claw-back averages at $278,000 per event, with 24% of all events gaining some claw-back and 12% of events getting the whole amount back.

The cyber insurance industry continues its efforts to reduce its exposure to claims, and the presentations from various insurers demonstrate that they are going to new lengths to achieve this. Depending on their policy, the insured can now benefit from various services provided by the insurer, including customized cyber threat intelligence based on the insured’s specific environment. This is complemented by monitoring and alerting their clients when a new vulnerability is posted to the CVE database; specifically, the insurer will alert the insured where they know the software or hardware is in use and provide guidance on the expected patching timeline.

This proactive approach to reduce risk even extends on to the dark web, where insurers may purchase compromised credentials or, in some instances, acquire zero-day vulnerabilities to protect their insured clients and, even more importantly, reduce the insurer’s financial risk.

As the insurance and cybersecurity industries continue to overlap, the question for me is: just how far will the overlap go?

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!