Hacker News Reader

Which is not surprising given the scale of recent ransomware attacks.

Let's hope that insurers will start with requiring better security from their clients.

The purpose of insurance is to transfer risk. Compliance with underwriting requirements or audits is not the same as security. If it’s cheaper to just check checkboxes, pay the ransom, and then hike next year’s premiums then they’ll do that.

But it’s not. Most of the insured damages in cyber insurance are not for paying the ransom, but reputation also damage, liability, etc.

The ransom is nothing.

Do they also insure against reputation damage? How would that work and could they measure it?

Yes. How they measure damage depends on what specifically is insured.

For example, a policy might cover the cost of a crisis management PR team. Or it might cover the cost of rebranding, including corporate reorganization.

A wide ranging reputational risk policy can become very expensive, very fast.

https://advisorsmith.com/what-is-reputational-risk-insurance...

Or that management will begin listening to their SME's about security once they see non-compliance raising their costs...one can dream

Reply on news.ycombinator.com