CYBER LIABILITY INSURANCE

Cyber threats are now a daily reality for New Zealand organisations of all sizes and sectors. Ransomware, data breaches, and business email compromise can cause severe financial, operational, and reputational harm. The Delta Insurance white paper highlights that demand for cyber insurance is at an all-time high, but so are the requirements for robust risk management. Cyber Liability Insurance is a critical part of a modern risk strategy, providing financial protection and expert support when a cyber event occurs.

The Evolving Cyber Threat Landscape in New Zealand

• Attacks are increasing in frequency and severity. High-profile incidents (NZ Stock Exchange, Waikato DHB, Mercury IT) and countless smaller attacks on SMEs show that no organisation is immune.

• Human error remains the biggest vulnerability. Up to 82% of breaches involve a human element—staff training and awareness are essential.

• Ransomware and data exfiltration are common. Attackers often steal sensitive data before demanding ransom, compounding the impact.

• Supply chain risk is real. Attacks on IT providers can cascade to many clients.

• The cost of cybercrime is rising. The average cost of a breach for a NZ business is estimated at$159,000, with global averages much higher.

What Does Cyber Liability Insurance Cover?

A comprehensive cyber policy typically includes:

• Incident Response: Immediate access to IT forensics, legal, and PR experts to contain and manage a breach.

• Data Breach Costs: Notification, credit monitoring, and regulatory compliance costs.

• Ransomware and Cyber Extortion: Ransom payments (where legal), negotiation, and system restoration.

• Business Interruption: Loss of income and extra expenses due to system outages.

• Third-Party Liability: Claims from customers, partners, or regulators for data loss or privacy breaches.

• Digital Asset Restoration: Costs to restore or replace lost/corrupted data and software.

• Crisis Management: PR and reputation management support.

• Social Engineering Fraud: (Optional) Cover for losses from scams where staff are tricked into transferring funds.

What Insurers Now Expect: Risk Management as a Precondition

Due to the rising cost and frequency of claims, insurers are now highly selective. To secure cover, organisations must demonstrate a strong cyber risk posture, including:

• Multi-factor authentication for remote and privileged access

• Endpoint Detection and Response (EDR)

• Secured, encrypted, and tested backups

• Privileged Access Management (PAM)

• Email filtering and web security

• Patch and vulnerability management

• Incident response planning and testing

• Cybersecurity awareness training and phishing testing

• Hardening of remote access (e.g., RDP mitigation)

• Logging, monitoring, and network protections

• Replacement or protection of end-of-life systems

• Vendor/supply chain risk management

Insurer questionnaires are now detailed and technical. IT teams must be prepared to answer them and may need to remediate weaknesses before cover is offered.

Market Trends: Supply, Demand, and Premiums

• Demand for cyber insurance is surging as awareness of risk grows.

• Supply is tightening. Some insurers are withdrawing or reducing cover, especially for high-risk sectors or large organisations.

• Premiums are rising (up to 74% in 2021), and coverage terms are more restrictive.

• State-sponsored attacks are often excluded (e.g., Lloyd’s of London now requires exclusion of catastrophic nation-backed hacks).

Benefits Beyond Insurance

• The process of applying for cyber insurance is itself a risk management exercise. Even if you don’t purchase a policy, the assessment can highlight weaknesses and drive improvements.

• Having cyber insurance is a “badge of quality.” It signals to clients, partners, and regulators that your organisation meets a high standard of cyber hygiene.

Special Considerations for Incorporated Societies and Charities

• Member and donor data: Ensure all personal data is covered.

• Volunteer access: Confirm volunteers are included in the definition of “insured.”

• Multiple locations and remote work: Ensure all sites and users are covered.

Practical Steps for Organisations and Leaders

1. Review your current cyber security controls against insurer expectations.

2. Engage IT and cyber security specialists to address any gaps.

3. Prepare for detailed insurer questionnaires—start early, as the process can be time-consuming.

4. Develop and test an incident response plan.

5. Train all staff in cyber awareness and phishing prevention.

6. Maintain up-to-date records of systems, data, and security measures.

7. Notify your insurer promptly of any incident or suspected breach.

8. Seek professional advice to ensure your cover matches your risk profile and operations.

Summary

Cyber Liability Insurance is now a vital part of any organisation’s risk management toolkit. However, securing and maintaining cover requires a proactive, well-documented approach to cyber security. The insurance market is rewarding those who invest in robust controls and risk management—and is increasingly excluding those who do not.

If you have any questions about your Cyber Liability insurance, want to review your current policy, or need help preparing for the application process, please contact us. We are here to help you navigate these complex issues and ensure you have the right protection in place.