More than half of Canadians are concerned about their online security, but only about one in five know they can purchase insurance to protect themselves against cyber-related incidents, according to James South (pictured), AVP of Specialty Personal Insurance at Aviva.
The findings of a survey Aviva did highlight an awareness gap in the personal cyber insurance market, where growing reliance on connected devices and online services has increased consumers' exposure to cybercrime, South told Insurance Business.
“We found that 51% of Canadians are concerned about their online security, but we also found that only about 22% of customers were really aware that they could purchase insurance coverage for this,” South said.
Read more: AI-assisted cyberattacks are the biggest wildcard for Canada's life insurers, analyst says
The results suggest that concern about cyber threats has not necessarily translated into awareness of the financial protection available through insurance. South said the industry has an opportunity to explain how personal cyber coverage works and why consumers might consider it as part of their broader insurance arrangements.
South said personal cyber protection has developed more slowly than commercial cyber insurance, partly because cybercriminals initially had stronger financial incentives to target organizations holding large volumes of data and substantial financial resources.
Businesses also had clearer reasons to respond to cyber threats, given the potential consequences of a breach affecting their operations, customers and systems. Individual consumers, by comparison, may find it harder to appreciate their exposure until they or someone close to them experiences an incident.
As cybercrime increasingly affects ordinary people through stolen personal information, fraud and scams, South said the personal lines market is catching up with a threat that has become more tangible in everyday life.
“100% it’s playing catch up,” South said of personal cyber insurance compared with commercial coverage.
The distinction between business and personal exposure is becoming less clear as consumers rely on online services for shopping, payments, deliveries and other routine activities. Connected household devices also mean that the amount of personal information and activity tied to online accounts continues to expand.
South said the public's understanding of cyber risk has evolved alongside this shift. Consumers may be aware of major data breaches reported in the news without necessarily recognizing how information stolen from an organization could subsequently be used to target them individually.
A breach affecting a school board, for example, can have consequences for parents who have provided payment details for school lunches, trips or other services. Information collected by an organization can become a source of exposure for individuals whose details were held in its systems.
South said cybercriminals can obtain information through attacks on organizations and then distribute it to other malicious actors, who may use it to target individuals. That connection between organizational breaches and personal fraud is one reason consumer awareness needs to improve.
South said personal cyber insurance should not be understood solely as a financial backstop after a consumer has suffered a cyberattack, fraud or theft. He described a role for preventative guidance, helping policyholders address questions about their security before an incident occurs.
For consumers unfamiliar with cyber protection, the ability to access advice could be an important part of understanding what the product offers.
“It's actually proactively improving your security, asking questions or doing the next additional steps that we can do and give advice through our partnership here and our approach to cyber,” South said.
That preventative element may also help address a problem facing insurers and brokers: cyber risk can feel abstract until a consumer has experienced a loss. Unlike some familiar insurance risks, online threats may be difficult for individuals to identify or assess, particularly when they do not know what information has been exposed or how a scammer might use it.
Read more: A rogue AI agent could hack your company, and some cyber policies may not cover it
South said consumers do not need to be cybersecurity experts to take basic precautions, but they may benefit from having a trusted resource to consult when questions arise.
South identified insurance brokers as an important link between the availability of personal cyber coverage and consumers' awareness of it.
Brokers already discuss home and auto insurance with clients, creating opportunities to introduce cyber protection during renewal conversations or broader reviews of a household's insurance needs. Because personal cyber insurance is relatively new within personal lines, some brokers may be less familiar with the product than with more established forms of coverage.
South said insurers can support distribution partners with training and educational materials to help them explain the coverage and its potential value.
“There's a huge role for brokers, and I think the biggest part about it is that advice element,” South said.
