Cyber insurance gains momentum in India; set to witness exponential growth: Deloitte’s report

National, 5 October 2023: Deloitte's recent report, "Cyber Insurance in India," identifies industries heavily involved in digitisation, such as IT, pharma, and
manufacturing, as well as those integrated with broader economic sectors like supply chain, retail, critical industries, and finance, to be the prime targets
of cybercriminals. These sectors are typically early adopters of cyber insurance.

The report indicates that the current Indian cyber insurance market is valued at US$ 50–60 million, maintaining a steady 27–30 percent CAGR in the past three years. This growth is expected to continue for the next 3–5 years, driven by an increased awareness of the need for cyber insurance.

The report included a survey of several Chief Information Security Officers (CISO), with 70 percent of respondents expressing willingness to increase spending on securing their digital infrastructure over the next three years. Notably, willingness was most prominent among mid-sized firms. Conversely, certain leading companies in the consumer sector overseeing substantial consumer databases exhibited a cautious approach when expanding their digital infrastructure budgets. However, they expressed an interest in boosting their insurance coverage.

About 60 percent of respondents wanted to increase insurance coverage without wanting to invest much in improving their digital infrastructure security.

The survey suggests that the cyber insurance market will experience modest growth in the short term, expecting exponential acceleration with momentum. In India, the cyber insurance market trajectory will be influenced by three key factors:

1. The pace at which firms achieve digital maturity
2. Government initiatives to digitise and enforce stringent cyber laws
3. The evolving landscape with non-traditional players—including technology  giants and MNCs—entering the cyber insurance domain, intensifying competition

Debashish Banerjee, Partner and Insurance sector leader, Deloitte India, said, "It is crucial to shift the perception that cyber insurance isn't merely an expense; it is a strategic investment. The dynamic cyber insurance market caters to rising demand to counter cybercrime losses. In this era of rapid digitisation, businesses must see proper coverage of cyber insurance as indispensable.”

“As organisations embrace the digital realm, they must prepare to tackle surging cyber threats. The boards and CEOs of organisations need to elevate their cybersecurity knowledge, acknowledging that cyber risks are now central to comprehensive risk management," he added.

Anand Venkatraman, Partner, Risk Advisory, Deloitte India, said, "Despite the current market fluctuations and uncertainties, we anticipate significant growth in cyber insurance in the next decade, making cyber insurance products more common and valuable for businesses of all sizes. To achieve this successfully, we need appropriate products that cater to both buyers and sellers. Technological advancements and government support are imperative in making this transformation happen."

Cyber insurance represents a specialised market, and its prospects hinge
on the following three critical aspects:     

Buyers must understand their cyber insurance needs and conduct thorough risk assessments to ascertain the required level of protection and coverage.·      

Sellers must prioritise simplifying insurance policies and educate their clientele on diverse coverage types to underscore the importance of these risk management tools.    

The government must play a pivotal role in establishing an effective data protection framework that ensures citizens' privacy. Additionally, facilitating data exchange through a centralised agency for cyberattacks can be leveraged to build risk models for cyber insurance, enhancing risk evaluation.

Other key highlights from the survey:·      

Cyber insurance coverage: Three-fourths of respondents possessed cyber
insurance coverage of INR 100 crore or less, with over 50 percent having less
than INR 10 crore of coverage. Finance and banking along with IT firms
emerged as major investors, while consumer firms exhibited lower spending. However, no respondents expressed a desire to discontinue their existing policies.   

Value for money: 30 percent of respondents believed purchasing cyber insurance provides value for money while 15 percent considered it costly.      

Insurance premium and coverage: Approximately 45 percent of respondents noted a substantial mismatch between the premium paid and the insurance coverage received. Most of these firms belonged to the consumer sector.      

Need for prompt implementation of the Digital Personal Data Protection
(DPDP) Act 2023: As organisations face increasing accountability an regulatory scrutiny in personal data protection, they are motivated to proactively address cyber risks and data breaches. Cyber insurance can provide financial protection, aiding in DPDP Act compliance. 

_____________________________________________________________________________________________

About the survey

This report shares a top-down view of cybersecurity and the need for insurance in the Indian market. The insights in the report are based on Deloitte’s survey. Several Chief Information Security Officers (CISOs)
participated in the survey, to help us understand the perceived importance of
cybersecurity and cyber insurance as a risk mitigation strategy. The
insurance-related questions revolved around the investment in coverage and
premiums and business perception and understanding of both. These gave us
insights into India’s pace of adoption, how CISOs allocate budgets towards
cyber insurance, and their concerns and asks.

We captured responses from select respondents across industries and sectors of different sizes. Respondents were from India-based companies, as we wanted to maintain a similar economic and cultural environment.

This press release has been issued by Deloitte Touche Tohmatsu India LLP.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about for a more detailed description of DTTL and its member firms.