Betterment cover (cyber)
An extension of a cyber policy that pays, beyond restoration, the cost of replacing compromised systems with more secure versions, which most policies exclude on principle.
The indemnity principle requires the insured to be put back where it was before the loss, neither better nor worse. Applied to cyber, it leads policies to exclude betterment of systems: the insurer pays to restore the compromised server to its prior state, not to replace it with more modern infrastructure. Yet after an attack, restoring like for like often means restoring the vulnerability through which the attacker got in: an outdated operating system, an end-of-support firewall, a flat architecture without segmentation. Incident responders then recommend rebuilding better, and the insured must fund the difference itself. Betterment cover pays all or part of this difference, usually under a modest sublimit and on condition that the improvement is recommended by the incident response provider to prevent recurrence. It remains an extension, not a core cover, because it funds spending the insured should have made anyway: the insurer partly pays off technical debt accumulated before inception. Its value is real for the insurer too: an insured rebuilt on secure infrastructure is a lower risk at renewal.
Textbook case: after ransomware entered through an end-of-support mail server, the responder recommends migrating to a modern hosted mail service. Like-for-like restoration would cost 40,000 euros; the migration 90,000. The betterment extension, sublimited to 50,000 euros, funds the difference.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.