New research by Mimecast Limited into the growing cyber insurance industry and evolving email attack techniques revealed that almost half (45 percent) of firms with cyber insurance are unsure if their policy is up-to-date for covering new cyber social engineering attacks, and only 10 percent believe it is completely up-to-date. Just 43 percent of firms with cyber insurance are confident that their policies would pay out for whaling financial transactions. Nearly two-thirds (64 percent) of firms do not have any cyber insurance at all.

The rise of whaling has created an attack climate where many insured organizations may not be protected from fraudulent transactions because they fall outside of the coverage scope of when their policies were originally signed. While over half (58 percent) of organizations have seen an increase in untargeted phishing emails, 65 percent have seen targeted phishing attacks grow and 67 percent have seen a spike in whaling attacks, where a cybercriminal dupes employees into making fraudulent transactions on behalf of a chief executive officer or chief financial officer. Additionally, 50 percent said they have seen social engineering attacks that utilize malicious macros in attachments increase.

“Cyber insurance uptake is growing quickly but a lack of employee training on the latest email attacks is leaving organizations at great risk of breaking policy terms,” said Steven Malone, the director of security product management at Mimecast. ”While insurers often pay for clean-up fees after a breach, it is important that organizations check that their policies protect them if an employee is tricked into sending a large amount of money to a fraudulent account. Attacks where employees are tricked into sending personal data or intellectual property are even less likely to be fully covered.”