How cyber insurance shapes risk: Ascension and the limits of lessons learned

• The Ascension ransomware attack highlights the role of cyber insurance in shaping incident response. Still, the disparity in handling insurance cases can lead to confusion for CISOs assessing their own risk needs.
• Cyber insurance policies, though evolving, may not uniformly mitigate risk across industries, as payouts and response norms often cater to larger organizations like healthcare networks, leaving gaps for smaller firms.
• CISOs should push for standardization in cyber insurance policies, ensure clarity on coverage, and work closely with insurers and government partners to better align insurance expectations with real-world cyber risks.

In May 2024, Ascension, a nonprofit healthcare system, suffered a ransomware attack that disrupted medical services and forced ambulance diversions across several states. Though attributed to the Black Basta cybercriminal group, the attack also highlighted the significant role that cyber insurance plays in managing such crises. As insurers increasingly dictate incident response through rapid payouts and collaboration with federal authorities, CISOs must carefully evaluate how these insurance-driven approaches fit their risk models.

Cyber insurance has grown rapidly since the mid-2010s, shaping industry risk management strategies. However, insurers’ singular focus on quick payouts for major organizations, such as healthcare networks, does not necessarily align with the needs of smaller firms or those outside critical infrastructure sectors. This disparity raises concerns about how insurers calculate cyber risk and what lessons are truly applicable to businesses outside high-profile targets like healthcare.

To navigate this complex landscape, CISOs should advocate for standardized cyber insurance policies that clearly define coverage without context-specific exceptions. By securing underlying risk data from insurers, CISOs can bridge the gap between risk expectations and claim outcomes. Moreover, collaborating with government agencies to limit criminal payouts can reduce the incentives for ransomware attacks. Standardizing cyber insurance will better equip CISOs to manage risk across industries and draw meaningful lessons from incidents like the Ascension hack.

Read the full article