Challenges in obtaining cyber insurance are forcing health care organizations to beef up their cyber defenses and invest in new security technologies, a top security firm expert told a webinar audience. ^[1]

Health care has a below-average rate of cyber insurance coverage, said Sally Adam, senior director at Sophos, with 78% of organizations surveyed reporting that they have coverage. That’s compared with 83% of organizations overall carrying cyber insurance. The data comes from a Sophos survey conducted earlier in 2022 of 5,600 information technology professionals in midsized organizations across 31 countries.

The market for cyber insurance has hardened considerably over the last year. Adam noted, “Overall, 93% of those who have cyber insurance coverage in health care said their experience of securing policies changed over the last year, and nearly half—48%—say fewer insurers are offering cyber coverage.” Some insurance providers have left the market because it’s become unprofitable for them, she said.

Around half of health care organizations reported in the Sophos survey that they needed a higher level of cyber security to obtain coverage, Adam said. “Similar numbers say policies are more complex and the process takes longer.” Only around one-third of respondents said cyber insurance was more expensive, but major price increases didn’t kick in until after most renewals last year, Adam said. “I think if we ran that study again now, we’d see a much higher percentage saying it’s more expensive.”^[2]

Therefore, cyber insurance is “a seller’s market,” Adam said. “They can call the shots, and they can be selective over which clients they cover. Having strong cyber defenses will significantly improve organizations’ ability to get the coverage they need.” This dynamic also is driving improvements in health care defenses, she said.

Some two-thirds of health care organizations responding to Sophos’ survey had invested in new technologies and services to help them improve their insurance position, Adam said. “I’ve heard multiple times that organizations who don’t have multi-factor authentication [MFA] in place are being denied cyber insurance flat-out—no questions. If you haven’t got MFA, you’re not getting coverage.”