Best Cyber Insurance Providers in Australia |
5-Star Cyber

• 12% increase in cyber claims in the first six months of 2023
   

• ransomware claims frequency rose by 27% from the second half of 2022
   

• claims severity reached a record high, increasing by 61% from the previous half and 117% over the past year

This chimes with data gathered by Rubrik Zero Labs, which found that 82% of Australian organisations experienced a cyberattack in 2023.

Data breaches were the most prevalent attack, making up 54% of incidents, higher than the global average of 38%. Business email compromise attacks were the second most common, seen in 45% of incidents. Cloud environments were the most targeted in Australia, with 75% of local respondents reporting malicious activity. SaaS recorded the second most malicious activity, reported by 60% of respondents, followed by on-premise infrastructure with 46%.

“Australia is a mature market and an early adopter of cloud and many enterprise security technologies,” says Rubrik vice president Antoine Le Tard. “As such, local organisations have been investing heavily in perimeter security for the past decade, yet Australia holds the unenviable title of leading the world in data breaches. The cloud is a powerful business enabler, but it comes with inherent risk, particularly with vulnerable, sensitive data.”

The OAIC recorded the most common sectors that notify them that their data has been breached. Health service providers had a 35% share of the yearly total, while the second most common finance sector had 22%.

Insurance broker and risk adviser Laura Meyer of MeyerInsure underscores the need for Australian businesses to be vigilant.

“There is a perception that these attacks only happen to the big guys, and this leads to a false sense of security and a general laxity,” she says. “A lot of clients have basic cybersecurity knowledge, but there is still a big gap between that knowledge and the real-world application. I spend a lot of time talking to clients about assessing their risks and what could go wrong.”

This message is echoed by Mark Luckin, national manager of Lockton’s cyber and technology practice, who warns of an “ongoing disconnect with respect to the communication of the relevance, quantification and consequences of cyber and technology risks for Australian organisations.”

He adds, “This leads to a slower than required focus from organisations on being cyber resilient. Comparing our pace of adoption of technology, the regulatory environment in Australia – up until recently  – has arguably been slow to adopt in ensuring the consequences of not being cyber resilient are aligned with the potential for breaches.”

Luckin also feels providers need to face all their responsibilities to clients.

“The insurance industry does have an obligation – to a point – to assist society or, in this case, organisations, to better improve their risk management and mitigation posture,” he says. “Tangibly and realistically, it can do this by sharing loss and claim relevant data.”

The variables suggested by Luckin to share include:

• the cause of events, noting that this is already indirectly done by changes in posture expectations from insurers
   

• effective claim/loss mitigants they have identified within their portfolio that have been shown to mitigate losses occurring in the first place
   

• effective claim/loss claim severity mitigants that have been shown to effectively “shorten” the life cycle of an event

Meyer would also like to see more resources offered industry-wide to enable clients to be more aware of the risks, particularly with Australia being such a hotbed for attacks. For a client, she approached six insurers, and only one had anything outside of FAQs and claims examples.

“There needs to be a concerted effort from insurers to provide resources and opportunities for prospective clients to learn more so their cybersecurity and awareness become a proactive part of their business. I also think better support services (access to experts, rapid response planning, etc.) and cyber awareness training available for clients could be a fantastic selling point,” she explains.

Another initiative Meyer would like to see implemented is the standardisation of terminology.

“It’s getting better than it was several years ago, but I certainly find as a broker trying to compare different cyber policies that it can be complex,” she adds. “If it’s complex for us, imagine how the client feels. Standardised terminology at minimum would go a long way to supporting brokers so they feel confident in discussing and explaining cyber to their clients.”

In IB’s 2024 survey, the nationwide brokering community rated the performance of cyber insurance providers they’ve worked with across nine areas identified as most crucial.

The companies that ranked highest overall distinguished themselves based on the strength of their products as well as their effectiveness in: 

• coverage
   

• flexibility
   

• ability to handle claims
   

• pricing
   

This year, brokers prioritised coverage, claims, underwriting expertise and breach response as among their top considerations when placing a cyber policy, consistent with 2023’s results. 

The rise of policy education from sixth place to fifth suggests that brokers increasingly value insurers who invest in their knowledge and understanding to serve clients better. 

The 5-Star Cyber insurance provider has earned repeated recognition as a genuine specialist, driven by its singular focus.

The company’s senior leaders acknowledge that offering more than just insurance is more important than ever to remain at the leading edge of the niche market.

“What we are doing, to the extent possible without living in someone’s system, is providing a real-time risk management threat intelligence service,” COO Colin Pausey says. “We’re trying to keep one step ahead of the threat or at least be in equal step in sync with the threat.”

Brokers rated Emergence highly across time-tested performance metrics and awarded top marks for its exemplary execution of:

• broker policy education
   

• coverage
   

• claims payment/processing
   

• breach response
   

• external scanning

“It’s the two-way communication that’s absolutely key; we listen to the brokers, ask them what they want and then we try and deliver”
Colin PauseyEmergence Insurance

Pausey asserts that the company’s incident response and claims handling teams are “the jewel” in their crown. Their expertise and dedication to excellence can help their insured customers quickly shut the door on an attack, particularly when every second counts.

“We are incredibly consistent, which is reflected in the feedback we get from others and our own internal observations,” he says. “We’re large enough now to handle all aspects under the same roof, including distribution, underwriting, incident response, claims and technology.”

That business model affords Emergence a significant advantage as it doesn’t rely on external incident response or claims handlers, enabling it to remain at the forefront with a commitment to:

• 24/7 incident response, often within 30 minutes, helping to minimise any damage 
   

• highly specialised cyber claims team that guides customers through the process, learns from incidents and becomes better prepared for future cyber attacks
   

• team collaboration, ensuring a seamless customer experience

The in-house teams are so operationally efficient and effective in assisting customers to take better risks that Pausey credits them with ensuring Emergence’s underwriting profitability by addressing vulnerabilities sooner rather than later.

Emergence is well positioned to help small and medium-sized businesses with its leading comprehensive policy known as Cyber Event Protection (CEP005), which it took to the next level by consulting brokers on how to enhance before releasing the latest version in February 2024. 

For example, CEP005 policy wording was simplified to aid broker and client understanding, D&O liability was added as an optional cover, and the company prioritised being more affirmative based on claims seen in recent years.

In addition, its broker education and information campaign on the policy included: 

• a webinar attended by over 3,000 brokers
   

• a planned webinar on claims examples

“We are all about empowering brokers to sell cyber insurance,” says Pausey. “We’ve always gone out and asked the brokers what they wanted. We can have that conversation with the brokers that tells us what more we can do to help them sell the policy and advise their clients.”
 

Given the dynamic nature of risk, Pausey emphasises that identifying and managing risk has been a challenge over the past five years.

He says that new threats are constantly emerging, and the threat actors are becoming more sophisticated, forming business empires within themselves, and using AI with learning capabilities more effectively than they were previously.

At the same time, AI can be deployed as a defensive tool. But he notes that the main issues for businesses of all sizes are:

• getting the basics right
   

• avoiding complacency
   

• planning for when a breach happens, not if

 “One of the biggest keys is that threat actors are now better and more capable of identifying the low-hanging fruit, the easier challenges, because they’re using the same technology we’re using,” he explains. “They can identify where there are exploits or potential exploits, and it’s easier for them to get into systems.”

Key revelations in the OAIC’s Notifiable Data Breaches Report for July to December 2023 underscore the persistent and evolving nature of cyber threats: 

• 483 breaches reported, up 19% from 407 breaches in January to June 2023 
   

• malicious or criminal attacks remained the leading cause (67%) of data breaches
   

• health and finance sectors remained the top reporters of data breaches. Health reported 104 breaches (22% of all notifications), and finance reported 49 breaches (10%)
   

• the majority of breaches (65%) affected 100 or fewer people
   

• additionally, of the 483 primary notifications, the agency received 121 secondary notifications, a marked increase from 29 secondary notifications in January to June 2023

Lockton’s Luckin underscores what makes a cyber insurance policy stand out in the Australian market.

He says, “It should have clear, defined, purposeful policy language that plainly outlines the intention of cover and endorsements that provide coverage ’enhancements’ are great, but not at the expense of foundational cover.”

Other key features he pinpoints include:

• immediate, local claims authority
   

• an industry-leading panel of incident response experts
   

• add value by way of insured-specific risk monitoring and notification services
   

• facilitation of discounted, easily accessible cyber security solutions or third-party assistance
   

Best Cyber Insurance Providers in Australia |
5-Star Cyber

• 
  Emergence Insurance
   
  

• ATC Insurance Solutions
• CFC
• Chubb
• DUAL Australia