Are companies helpless in the face of hacking? 83.6% of experts say insurance coverage is inadequate

[Financial News] Experts have voiced concern that domestic companies are not sufficiently prepared for the risks posed by cyberattacks. More than 80% said insurance coverage falls short of the level of cyber risk companies face, prompting calls to raise companies’ awareness of these risks and strengthen the institutional foundations of the insurance market to promote cyber insurance.
According to the 2026 Cyber Risk and Insurance Survey, conducted on the 15th by the Korea Fire Protection Association among 110 experts in fields including insurance and reinsurance, cybersecurity, financial institutions and academia, 83.6% of respondents said companies’ insurance coverage for cyber risks was inadequate.
A total of 82.7% of respondents also said South Korea’s cyber insurance market relies on legally mandated insurance. Experts say that although companies are exposed to cyber risks, they have not sufficiently prepared financially by purchasing insurance voluntarily.
Executives’ low awareness of cyber risks was cited as a key barrier to purchasing insurance. A total of 66.4% of respondents identified it as a major constraint on market growth. Just 10.0% cited the burden of insurance premiums. This suggests that the market is being held back less by the cost of premiums than by a failure to recognize cyber risks as a key business-level risk.
Companies’ cyber risk management frameworks were also found to need improvement. A total of 82.3% of respondents said companies’ cyber risk management is currently led by their information technology (IT) departments. By contrast, 91.7% said cyber risks should be managed as part of enterprise risk management (ERM), which encompasses financial losses, legal liabilities and business interruptions.
Cyberattacks can affect a company’s financial health and business continuity, not just lead to information leaks or system outages. This means companies need a framework in which executives identify and manage risks, going beyond technical responses at the security department level.
On the insurance supply side, standardizing products and risk assessment criteria was identified as a priority. A total of 94.1% of respondents said cyber insurance policy terms and risk assessment models need to be standardized. They said uncertainty over coverage and a lack of objective risk assessment criteria could constrain companies’ use of insurance and the market’s growth.
Some also said cyber insurance should not be limited to compensating for losses after an incident. The idea is to strengthen companies’ risk management capabilities by linking insurance with advance risk assessments and incident prevention services.
The need for the public and private sectors to jointly address large-scale cyber risks was also confirmed. A total of 89.4% of respondents said the government and private sector should share risks arising from threats that private insurance alone would struggle to cover, such as state-sponsored cyberattacks or the shutdown of critical infrastructure. The aim is to strengthen cooperation between the public and private sectors, as private insurance alone may have limitations in responding if cyber risks grow in scale.
A Korea Fire Protection Association official said, “Cyber risks can lead to financial losses and business interruptions for companies, so it is important to have a risk management framework that encompasses not only post-incident compensation but also prevention. We will work with the insurance industry to standardize cyber risk assessment frameworks and increase the use of insurance, while establishing the institutional foundations needed to promote South Korea’s cyber insurance market.”

[email protected] Hong Ye-ji Reporter