I recently attended a general IT conference and saw some interesting vendors of various products and services. One of them was a company providing hacking insurance, and they said that there were two business models that they operate on:
- Liability insurance model: this is where they insure the providers of services such as penetration testing or data security against their clients suing them when there is a security breach. Apparently this is the main business in the US.
- Loss of data/asset model: this is where they insure small to medium businesses against loss of company productivity, assets or client information when there is a security breach.
I was wondering what the impact of these services on the information security industry. Is this going to make people more aware of information security, will it make people less vigilant because there is some insurance against bad events, or perhaps it won't change anything at all?
The interesting thing about the business model is that for the loss of data/asset model they don't assess the client for their level of security infrastructure and process, which is rather interesting because it means that they are happy to insure people regardless of the risk of having to make a pay-out (presumably because they are trying to attract customers and they are not going after large enterprise or corporate clients). I suppose once they get enough clients and lots of claims come through then they might have to have an internal assessment team or outsource this capability to other firms.