E72 - When Insurance Becomes a Security Tool

By FIR Risk Advisory | Cybersecurity Fraud Intelligence

Weekly Risk Intelligence Brief  

Source: Economics of Cyber Policies for Critical Care (CLTC White Paper, August 2025)

The 30-Second Brief  

UC Berkeley’s Center for Long-Term Cybersecurity examined cyber insurance economics in healthcare — and the findings apply far beyond hospitals. The core insight: insurance isn’t just a balance sheet tool. It’s driving security behavior. 80% of respondents added controls, staff, or audits specifically to qualify for coverage or reduce premiums.

But here’s the catch: typical policy caps cover “average” events, not catastrophic ones. When a sector-wide incident hits, you’re on your own.

The Economics That Matter  

Smaller Orgs Pay More  

The data is stark: smaller organizations pay approximately $818 per hospital bed in premiums versus $369–$645 for larger peers. Scale effects favor the big players. If you’re a mid-market company in any sector, you’re paying a disproportionate premium for the same risk.

INTEL [TREND]: Cyber insurance pricing penalizes smaller organizations. This creates a perverse incentive — the organizations least able to absorb a breach also pay the most for protection. CFOs and risk managers should benchmark premium-per-exposure against industry peers.

Insurance as a Behavior Lever  

This is the most important finding in the report. 8 of 10 respondents implemented security best practices specifically because underwriters required them. Insurance isn’t just transferring risk — it’s raising the floor.

Underwriters increasingly demand:

• MFA for privileged, remote, and email access
• Timely patching with SLOs (critical vulnerabilities within 30 days)
• Network segmentation (IT/OT/critical systems)
• Immutable, offline backups with restore drills
• Baseline framework (CIS/NIST) with third-party audit evidence
• Vendor risk contract clauses (notification, SBOM/attestations, audit rights)

INTEL [REGULATORY]: Underwriter control requirements are becoming a de facto compliance framework. Organizations meeting these requirements are simultaneously satisfying most regulatory expectations — treat your insurance application as a security maturity assessment.

The Catastrophe Gap  

Average breach cost in healthcare: $9.77 million. Roughly 80% of surveyed entities have caps below $40 million. That sounds like headroom — until a sector-wide event hits.

Some policies exclude nation-state incidents. Systemic events can overwhelm caps. The Change Healthcare attack demonstrated what happens when a single point of failure cascades across an entire sector.

INTEL [SECTOR ALERT]: Policy caps and exclusions create a false sense of security. Scenario-plan beyond your cap. Review exclusions for nation-state, systemic event, and widespread outage carve-outs — these are the exact scenarios most likely to exceed your coverage.

Beyond Healthcare — Universal Lessons  

The economics apply to any fragmented sector with thin margins and cascading risk potential: manufacturing, logistics, retail, education, utilities.

Three universal truths:

1. Better hygiene = better underwriting = better affordability. The math works. Modest improvements (5–10% breach probability reduction) generate savings exceeding basic control spend.
2. Policy caps plus exclusions don’t cover catastrophic or state-linked events. Plan for the tail.
3. Collective models outperform individual approaches. Pooled insurance with government backstops — where strong members sponsor weaker ones — aligns incentives across an entire sector.

INTEL [GLOBAL RECOMMENDATION]: The CLTC’s proposed public-private pool model (lower premiums for small players, better catastrophe protection for large ones, all tied to control requirements) is the most promising framework for systemic cyber risk. Watch for policy movement here.

What to Track  

Insurance KPIs:

• Premium per exposure unit
• Limit-to-loss ratio
• Exclusion inventory (what’s NOT covered)

Control KPIs:

• MFA coverage %
• Critical patch SLO attainment
• Backup RTO/RPO compliance
• Segmentation scope
• High-risk vendor count

Outcome KPIs:

• Mean containment and restore time
• Incident cost vs. policy cap
• Supply-chain spillover costs

The Bottom Line  

Insurance alone won’t save you. But insurance requirements might be the most effective security lever we have. When underwriters demand MFA, patching SLOs, and segmentation — and 80% of organizations comply — that’s not risk transfer. That’s risk reduction at scale.

The question isn’t whether you can afford cyber insurance. It’s whether you can afford not to let the underwriting process improve your security posture.

Find all editions on FIR Risk Tuesday | GitHub