Budding Trouble: The Cyber Insurance Gap Threatening the Cannabis Industry

A report released in April by Risk & Insurance found that a staggering 80% of companies with cyber insurance do not have sufficient coverage to meet the cost of a data breach; most companies’ coverage falls short of meeting the true cost of a cyber attack.

The report found that the average coverage gap between insurance coverage and costs incurred in a data breach was 350% — meaning the costs were over three times higher than what the policy covered. The average loss size identified by the report was an astounding $27.3 million dollars.

Inadequate cyber insurance poses a particular risk for small companies. With less money coming in, losses due to a cyber attack represent a higher amount of profit.

• Companies with less than $1 million in annual revenue lost an average of 90% of revenue
• Companies with $1 – $10 million lost an average of 180% in revenue

For bootstrapped businesses, these figures can be devastating. Having a cyber policy that falls short versus one that gives you enough coverage could be the difference between continuing on or shutting your doors.

Many policies fall short because of cost. Cheap cyber insurance policies offer smaller coverage amounts, and paying less upfront for insurance could cost you your business in the long run.

The report noted that high-risk sectors like fintech, technology, and manufacturing are at higher risk because they tend to have more digital assets. Low-tech sectors (the report noted construction and transportation) tend to have fewer digital assets, making a data breach less expensive and smaller coverage amounts more adequate.

The cannabis industry is usually considered a high-risk section, as many emerging industries are. Despite the fact that the industry is not as high-tech as something like (SaaS), many cannabis companies rely heavily on digital assets. Track and trace systems, Metrc, and scanning customer IDs are all done digitally, holding a wealth of private information that is a goldmine to scammers and phishers.

This necessitates higher amounts of coverage for cannabis cyber insurance policies because a data breach can rob your business and your customers of sensitive information. The more data involved in a cyber attack, the higher the cost of the losses.

How do you know if your cannabis cyber insurance policy provides enough coverage?

Work with a cannabis insurance provider

While you can get insurance coverage from a general provider, working with someone who specializes in cannabis means you get expert eyes on your business, helping you to identify gaps in coverage and possible exposures. Cannabis is a volatile, fast-moving industry and you want to work with someone who spends as much time in this industry as they do in insurance.

Understand your limit of liability

Your limit of liability is the maximum amount of money an insurer will pay for a particular claim and is outlined in your policy terms. Cyber insurance is typically a stand-alone policy so your general umbrella of coverage may not cover cyber-attacks.

Read your insurance policies

Having cannabis insurance is well and good, but it doesn’t help much if you don’t know what you have. Read your current insurance policy and take note if you have a separate cyber policy. If you do, find your limit of liability and compare it to your annual revenue.

Ensure your umbrella of coverage is adequate

Each insurance policy covers one piece of the business puzzle. Together, they form a solid safety net that can help your business weather trying times and turbulent storms. Explore your limit of liability for all policies and read the terms well.

Additionally, don’t shy away from investing in cyber protection. This could mean spending more on your cybersecurity insurance premium, but it also means spending more on cyber hygiene and safety features. The best defense is a good offense, and there are many steps you can take to better secure your digital assets.

Insurers often have prerequisites to bind cyber liability policy, such as:

• Security and control measures: including endpoint detection and response (EDR), security awareness training, and regular vulnerability assessments.
• Data security practices: such as data encryption, data loss prevention (DLP), access controls, changing passwords on a schedule, and tiered user permissions.
• System uptime and security: including routine software maintenance, vulnerability management, and following security best practices.
• Incident response plans/procedures: following industry or regulatory requirements, building out your risk profile, and knowing your claims history.

Operating in a digital space helps us streamline processes and make businesses more efficient. But it also opens the door to a new world of risk, and unfortunately, cyber crime can be quite profitable. To best protect your business, follow cyber security best practices, keep up with your insurance policies, and work with a trusted partner for cannabis cyber insurance.

Protecting your cannabis company can seem confusing; however, we’re a full-service insurance brokerage working with carriers worldwide to offer you the best coverage possible. We’re here to help! Please reach out to us today by email [email protected] or calling 646-854-1093 for a customized letter or learning more about your cannabis insurance options.