As part of a presentation titled “Don’t Go It Alone: The Power of Partnerships for Cybersecurity Success” at the International Society for Technology in Education (ISTE) annual conference in Philadelphia, panelists shared concerns noted by K-12 schools districts they serve.
Keith Krueger, CEO of the nonprofit Consortium for School Networking (CoSN), said school administrators have complained of price hikes between 30 percent and 100 percent in recent years — “and that’s if you can get it,” he said. Some administrators told him insurance providers are also requiring multifactor authentication, which can be difficult for elementary schools where younger students don’t have phones, or where policy prohibits personal phones in classrooms.
According to a 2023 report released in June by AM Best insurance rating agency, between 2015 and 2020 the cost of cyber insurance doubled, and then the following year it went up another 75 percent. Public and private entities globally spent more than $4 billion on cyber insurance coverage in 2021 alone.
Doug Levin, co-founder and national director of the nonprofit K12 Security Information eXchange (K12 SIX), said changes in the insurance industry prompted steep price hikes. Cyber coverage began as riders on existing policies that covered multiple facets of liabilities at schools. Carriers “lost their shirts,” he said, after a series of ransomware attacks, paying out $4 for every $1 they collected in premiums. The market of cyber insurance providers saw a massive consolidation, leading to less competition, and the rates are going up.
The other problem, Levin said, is that school leaders view insurance policies as the solution to their cybersecurity problem, when it should be seen as “the backstop of an extraordinary issue.” He equates requests for extensive coverage to someone who is seeking an auto insurance policy for life when they drive a vehicle with bucket seats, no seat belts and a whole host of other safety concerns.
Panel members did not estimate the cost of a school cyber insurance policy, but in K12 SIX's annual cybersecurity report last year, Levin noted that in 2020 an unnamed school district in Pennsylvania paid about $19,000 for $2 million worth of coverage for one academic year.
According to the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency website, the agency has allotted $1 billion in funding from 2022 through 2025 to help state and local governments, tribal groups and school districts establish cybersecurity plans and systems, but cyber insurance is not an allowed expenditure.
Bonnie Chelette, education technology director for the Louisiana Department of Education, who participated in the panel discussion, equated the frustrations of obtaining a cyber insurance policy to flood insurance requirements for property owners in some southern states.
The panel members encouraged school districts to collaborate on cybersecurity initiatives and to join peer organizations like CoSN and K12 SIX.
“Cybersecurity is now a ‘we’ issue,” Chelette said.
According to the AM Best report, the cyber insurance market is starting to soften because cryptocurrency, the form of payment typically demanded in ransomware attacks, has decreased in value.
“With cryptocurrency being worthless, hacking is worthless,” Christopher Graham, AM Best senior industry analyst, said in the report. “Whereas a year ago there was some concern about the war in Ukraine and what might spread from that, it seems like hackers have been going at each other more than going at the rest of the world. Those things have softened the cyber market a little bit. When I say soften, it’s not that rates are coming down — they’re just not going up as fast as they were.”
