2025 Trends That May Effect Your Cyber Insurance Needs

Willis Towers Watson noted three major trends in its 2024 Cyber Liability Recap.  Here is a summary of the trends and what starter questions to ask your team of insurance, legal and IT professionals.

BIOMETRIC DATA- with more companies using face, palm or fingerprint technology as a “password” to their services, we have seen carriers adding exclusions to cyber insurance policies to specifically exclude any claim related to the wrongful use and collection of this data.  So, it is important to consider

• is my business collecting this data or a third party?  if a third party vendor is collecting, how does the risk transfer and indemnification provisions read in the contract with the third party?
• what changes do I need to make, if any, to any waiver language regarding this data?
• if this exclusion is currently on your policy?
• if it is excluded can that exclusion be removed for a price?
• if I need to move coverage to a different carrier that covers this data, what if any additional loss prevention policies, tools, and steps will be needed in order to get approved for coverage with that carrier?

3RD PARTY VENDOR- the claims data carriers are collecting is confirming what many suspected.  For many claims the beginning breach for these larger claims is often not a breach within the final target but with other vendors or customers.  So, it is important to consider

• doing a supply chain assessment to determine how a data breach of a customers and/or vendor may effect your organization and whether your current policy would respond;
• doing a contract assessment to determine your full obligations for data breaches outside of your organization as we are seeing this language added to insurance requirements in B2B organizations;
• ensuring part of contract renewals is a security assessment for any vendor who collects, maintains, or uses your data.

REGULATIONS- privacy and cyber security regulations are changing year after year.  Colorado, Illinois, and Europe expanding privacy protection for their citizens and laws related to the use of AI. So, it is important to consider

• does my current policy include reimbursement for any fines/regulations related to these breaches?  if so, is the language sufficiently broad to cover new laws as they are passed?
• is my business adhering to the loss prevention controls and/or reporting requirements for all the states where I am operating?