Two-thirds of UK businesses not insured against information security breaches and data loss, according to NTT Security report

Only one third of senior executives in UK organisations admit their company insurance currently covers them for a security breach and for the financial impact of data loss, despite the fact that 81 per cent agree that it is ‘vital’ their organisation is insured against information security breaches. This is according to the latest Risk:Value report from NTT Security, the specialised security company of NTT Group, which also reveals that less than a third (29 per cent) of firms have dedicated cyber security insurance in place.

The 2018 report, which looks at the attitudes of 1,800 global senior decision makers from non-IT functions to risks to the business and the value of information security, reveals that UK businesses would have to spend on average £1 million to recover from a breach.

While the UK compares poorly to other markets like the US and Singapore (53 per cent) when it comes to insuring against both information security breaches and data loss, it still fares better than Benelux (27 per cent) and the Nordics (23 per cent in Sweden; 28 per cent in Norway). The UK also ranks second from last for having dedicated cyber insurance, alongside Germany (29 per cent) and just above Benelux (27 per cent).

Just six per cent of respondents in the UK say their company insurance covers only for information security breaches, while 11 per cent are covered only for data loss. However, the fact that nearly half (45 per cent) of those surveyed do not know if their company insurance covers either of these is a concern, given that it is the highest figure for any of the countries in the report and well above the global average of 23 per cent.

Kai Grunwitz, Senior VP EMEA, NTT Security, comments: “With estimated annual losses from cyber crime now topping $400bn (£291bn) according to the Center for Strategic and International Studies, you would hope more organisations would be beating a path to insurers’ doors. But while the insurance sector is certainly seeing growth in the number of policies being taken out to cover such losses, it’s an issue that many senior decision makers are not on top of."

According to figures, the number of insurers now offering cyber insurance via Lloyd's of London has leapt to more than 70, nearly double the number a few years ago, while insurance giant Allianz predicts that global cyber insurance premiums will grow to $20bn by 2025, up from around $3-4bn currently.

According to the 2018 Risk:Value report, half of respondents in UK organisations believe that the failure to maintain or apply updates to existing IT systems would or could invalidate their company insurance, while 37 per cent point to lack of compliance with industry regulations, including the General Data Protection Regulation (GDPR), which came into force in May. While 63 per cent of respondents in the UK say they have an incident response plan in place, and another 18 per cent are in the process of implementing one, 38 per cent agree that lack of an incident response plan could or would also invalidate their company insurance.

Incident response is a basic requirement of best practice security and is even more important with the GDPR mandating 72-hour notifications following a breach. The GDPR and NIS Directive both require organisations in one way or another to follow best practices in cybersecurity, threatening huge fines of up to £17 million or four per cent of global annual turnover for non-compliance.

NTT Security’s Kai Grunwitz adds: “While cyber risk insurance should be put in place to help mitigate the potential fallout of a data security breach, a policy must not be seen as a ‘get out of jail free' card. Cyber insurance must be complementary to an effective risk-based information security strategy, not a replacement for it. You wouldn't expect your house insurance provider to pay out if you were burgled when the doors and windows are left unlocked. So don't expect a payout – or indeed an insurance policy – if you haven't put in place the right processes and policies.”

For further information on NTT Security’s 2018 Risk:Value report and to download a copy, visit: https://www.nttsecurity.com/en-uk/risk-value-2018

Notes for editors:

For a PDF of the 2018 Risk:Value Report or a copy of the global/UK infographic, images or further information/stats, please contact: nttsecurity@origincomms.com.

Research demographics

Commissioned by NTT Security, the 2018 Risk:Value report research was conducted by Vanson Bourne, an independent specialist in market research for the technology sector, in Feb/March 2018. 1,800 non-IT business decision makers were surveyed in the US, UK, Germany, Austria, Switzerland, France, Benelux, Sweden, Norway, Hong Kong, Singapore and Australia. Predominately, organisations had more than 500 employees and were selected across a number of core industry sectors.

About NTT Security
NTT Security is the specialized security company and the center of excellence in security for NTT Group. With embedded security we enable NTT Group companies (NTT Communications, NTT DATA and Dimension Data) to deliver resilient business solutions for clients’ digital transformation needs. NTT Security has multiple SOCs, seven R&D centers, over 1,500 security experts and handles hundreds of thousands of security incidents annually across six continents.

NTT Security ensures that resources are used effectively by delivering the right mix of Managed Security Services, Security Consulting Services and Security Technology through NTT Group companies – making best use of local resources and leveraging our global capabilities. NTT Security is part of the NTT Group (Nippon Telegraph and Telephone Corporation), one of the largest ICT companies in the world. Visit nttsecurity.com to learn more about NTT Security or visit www.ntt.co.jp/index_e.html to learn more about NTT Group.

Media contact:

Amanda Hassall, Consultant
Origin Comms
T:+44 (0)1628 822741
M: +44 (0)7855 359889
E:amanda@origincomms.com
TW: @mandyhassall