Cyber Insurance Take-up: Continental Europe vs. US & Canada

All Respondents Organizations offering products and services in the US and/or Canada purchase cyber insurance more than those offering products and services in Continental Europe. 44% of respondents from organizations that offer products and services in the US and/or Canada report their organizations currently have cyber insurance, while only 31% of respondents from organizations that offer products and services in Continental Europe report having cyber insurance. What is your organization’s status with regard to cyber insurance? (select all that apply) Organizations Offering Products/Services in Continental Europe* N= 645 Organizations Offering Products/Services in United States & Canada* N= 620 * Not where organization’s operations are based; this depicts where organization offers products and/or services. * Not where organization’s operations are based; this depicts where organization offers products and/or services. Note: This data does not include the UK & Ireland, which are also currently part of the EU (see separate data for UK & Ireland). Since respondents could pick more than one region, we cannot easily identify who selected *both* Continental Europe and the UK so that we could accurately calculate the percentage of the total. As long as the data is referred to as “Continental Europe,” it will not be misleading.

GDPR-Subject Respondents Organizations offering products and services in the US and/or Canada purchase cyber insurance more than those offering products and services in Continental Europe. 38% of respondents from organizations that offer products and services in the US and/or Canada report their organizations currently have cyber insurance, while only 32% of respondents from organizations that offer products and services in Continental Europe report having cyber insurance. What is your organization’s status with regard to cyber insurance? (select all that apply) Organizations Offering Products/Services in Continental Europe* N= 414 Organizations Offering Products/Services in United States & Canada* N= 261 * Not where organization’s operations are based; this depicts where organization offers products and/or services. * Not where organization’s operations are based; this depicts where organization offers products and/or services. Note: This data does not include the UK & Ireland, which are also currently part of the EU (see separate data for UK & Ireland). Since respondents could pick more than one region, we cannot easily identify who selected *both* Continental Europe and the UK so that we could accurately calculate the percentage of the total. As long as the data is referred to as “Continental Europe,” it will not be misleading.

All Respondents Those offering product/services in the US/Canada and Pacific report having cyber insurance at a rate higher than the average response (average is 35%). What is your organization’s status with regard to cyber insurance? BY GEOGRAPHY WHERE ORGANIZATION OFFERS PRODUCTS/SERVICES (NOT WHERE LOCATED) Above Average Below Average Organizations Offering Products/Services in Latin America & Caribbean N= 342 Organizations Offering Products/Services in Continental Europe N= 645 Organizations Offering Products/Services in Asia N= 474 Organizations Offering Products/Services in United States & Canada N= 620 Organizations Offering Products/Services in Pacific N= 359 Organizations Offering Products/Services in Africa N= 224 Organizations Offering Products/Services in Middle East N= 287 Organizations Offering Products/Services in UK & Ireland N= 468

UK & Ireland* N= 468 UK & Ireland* Note: Since respondents could pick more than one region where their organization offers products and/or services, we cannot easily identify who selected *both* Continental Europe and the UK so that we could accurately calculate the percentage of the total. As long we say “Continental Europe” when we refer to the data and we do not say “EU,” our statements will be accurate. The data on this slide is for informational background only. What is your organization’s status with regard to cyber insurance? All Respondents GDPR-Subject Respondents Organizations Offering Products/Services in UK & Ireland* N= 468 Organizations Offering Products/Services in UK & Ireland* N= 336 * Not where organization’s operations are based; this depicts where organization offers products and/or services. * Not where organization’s operations are based; this depicts where organization offers products and/or services.

Additional reference

35% of all respondents reported their organizations currently had cyber insurance. What is your organization’s status with regard to cyber insurance? All Responses N= 1,312 Organizations Not Subject to GDPR N= 635 GDPR-Subject Organizations N= 537 Average Above Average Below Average (Only viewing responses for “Currently has cyber insurance”)

All Respondents Manufacturing & Infrastructure industries report having cyber insurance at a rate lower than the average response. What is your organization’s status with regard to cyber insurance? BY INDUSTRY – Manufacturing & Infrastructure Industries Manufacturing N= 176 Infrastructure N= 36 Retail/Wholesale N= 93 Below Average Below Average Below Average Chemical N= 37 Energy N= 88 Power & Utilities N= 17 Below Average Below Average Below Average

All Respondents Manufacturing & Infrastructure industries report having cyber insurance at a rate lower than the average response. What is your organization’s status with regard to cyber insurance? BY INDUSTRY – Manufacturing & Infrastructure Industries (cont.) Transportation and Rail N= 80 Construction N= 103 Automotive N= 46 Below Average Below Average Below Average Mining, Metals & Minerals N= 44 Aerospace & Aviation N= 34 Below Average Below Average

All Respondents Traditionally data-reliant industries report having cyber insurance at a rate higher than the average response. What is your organization’s status with regard to cyber insurance? BY INDUSTRY – Traditionally Data-Reliant Industries Finance N= 132 Health Care N= 101 Professional Services N= 136 Above Average Above Average Above Average Communications, Media, Tech. N= 104 Life Sciences N= 26 Above Average Above Average

What is your organization’s status with regard to cyber insurance? All Respondents What is your organization’s status with regard to cyber insurance? BY INDUSTRY – Other Industries Marine N= 26 Food & Beverage N= 58 Hospitality & Gaming N= 37 Below Average Below Average Below Average Public Entity / Nonprofit N= 82 Sports & Entertainment N= 24 Real Estate N= 60 Education N= 69 Average Above Average Above Average Above Average

Does your organization conduct activities that would be subject to the EU GDPR? BY GEOGRAPHY WHERE ORGANIZATION OFFERS PRODUCTS/SERVICES (NOT WHERE LOCATED) By order of most subject to least subject: Organizations Offering Products/Services in UK & Ireland N= 468 Organizations Offering Products/Services in Africa N= 224 Organizations Offering Products/Services in Middle East N= 287 Organizations Offering Products/Services in Continental Europe N= 645 Organizations Offering Products/Services in Latin America & Caribbean N= 342 Organizations Offering Products/Services in Asia N= 474 Organizations Offering Products/Services in Pacific N= 359 Organizations Offering Products/Services in United States & Canada N= 620