Cyber insurance comes to the rescue when security fails

More than half of small and mid-market businesses couldn’t remain profitable one month after a cyberattack.

No, we’re not talking about mom-and-pop shops or family-owned restaurants, but middle-market companies, which make up 97 percent of U.S. businesses, according to a report by the Better Business Bureau.  The cybersecurity business is $200 billion in size, but all that spending on protection doesn’t prevent every incident.

It may seem that these incidents could fall under the realm of liability insurance, but many of them don’t. And that leaves the affected companies to absorb the financial hit.

The cyber insurance market is looking to fix that. And investors are putting money into a new breed of insurtech companies that are focused on the cybersecurity industry.

Cyber insurance adds a defensive strategy to the more traditional offensive set of tools and monitoring services that the behemoth cybersecurity industry is known for, and the opportunity is ripe, according to investors.

Many of these startups were formed in the last five years and operate similar to a cybersecurity platform. Their customer companies can select different risk monitoring and overwatch services with the bonus option of a tailored insurance policy to take off some of the financial burden,  in case something squeaks by the defensive line.

“What is fascinating here is an opportunity to provide cyber insurance to small business for a platform that is essentially a LegalZoom for insurance,” said Howard Mergelkamp, a partner at Mosaik Partners. “It’s an outsourced chief security officer.”

Mosaik recently led an investment round in Zeguro, a cyber insurance platform. Mergelkamp said that Mosaik isn’t interested in investing in the cybersecurity industry, but saw the platform as more than that. He said it is also an opportunity to provide a needed solution for small businesses.

San Francisco-based Zeguro  joins other venture-backed startups, such as At-Bay and Coalition, which focus on similar cyber insurance strategies and business models.

Zeguro raised $5 million last year in a round led by Mosaik that also included QBE Ventures, and Munich RE/HSB Ventures, among others. Also last year, At-Bay closed on a $13 million Series A round co-led by Khosla Ventures and Lightspeed. Coalition has raised more than $50 million over the last two years through a $10 million Series A round in 2018 and a $40 million Series B earlier this year, which was led by Ribbit Capital.

Other startups in the space include CyberCube, BitSight and RedSeal.

“A lot of those startups are providing tools for small businesses, or medium-sized businesses, to improve their cyber defense,” said Matthew Wong, a managing analyst at CB Insights. “On the backstop, they also provide cyber insurance coverage.”

The majority of the startups have been taking care of the data and policy formation with insurance industry veterans like Munich Re and Hartford Steam Boiler and Travelers Insurance underwriting the tickets.

“Successful companies in the space bring a combo of genuine software and cybersecurity expertise and financial insurance expertise,” said David Weiden, a partner at Khosla Ventures. “I would say the insurance product is really built on top of the technology platform. It is a technology platform first that provides insurance.”

CB Insights predicts that the cybersecurity insurance market will grow to $9 billion by the end of 2020, a jump from the current market value of $2 billion in 2018. The industry increased by 37 percent year-over-year from 2016 to 2017, but grew only 8 percent heading into 2018.

Mergelkamp said that now is a good time to get involved with the industry while the barriers to entry aren’t too high. He predicts that will change as the threat and scale of cyberattacks continues to grow.

“Fortune 500 companies can suffer an attack and the consequences after. They can handle the cost of that,” Mergelkamp said. “Small businesses, they get hit and they are out of business. Eight out of 10 that are hit with cyber breach end up going out of business.”

The BBB report found that about 90 percent of the businesses surveyed had some form of cybersecurity, but 15 percent of the businesses surveyed had cyber insurance in 2017.

A study from the U.S. Chamber of Commerce and RSN found that in 2018, 15 percent of mid-market businesses experienced some kind of data breach that year, which is up 2 percent from 2017 and up 5 percent in the previous four years. Wong said that he expects growing risk will continue to push this market front and center.

“There is significant and increasing security and business risk from what people call cyber threats,” Weiden said. “This has gone from a remote theoretical possibility to a pretty mainstream problem that effects a lot of businesses and that problem is continuing to increase.”

Mergelkamp added that there isn’t really a plateau in sight for this market.

“Yes, it will be headed to the right with bumps in the road,” Mergelkamp said. “But we cannot see a situation where cybersecurity becomes less important of an issue.”