Mark Nance

So many folks in the cyber insurance ecosystem love to host webinars and events on "How to Sell Cyber Insurance." What I find interesting is that, 9 times out of 10, the person chosen to present has never once sat in the retail broker's seat. How the heck do you truly know how to sell cyber insurance? Don't get me wrong... there's plenty to be learned from folks who haven't actually sold cyber insurance that can be used to sell it. The problem is that when you've never sat in a retail broker's seat, you can't really speak to how insureds actually respond. Sure, the strategy of using unsolicited vulnerability scans on prospects sounds like a good idea. You visibly show them a report of vulnerabilities that might impact rating at a few insurtechs. You tell them to address these open ports or whatnot and offer to re-approach the market for potentially better pricing or coverage. Sounds like a great risk management-focused approach to selling cyber insurance. What someone couldn't tell you if they haven't actually done it is that a lot of your prospects are going to be heavily turned off by your strategy. They're going to respond with anger that you ran a vulnerability scan without their consent. Others are going to share the report with their IT people, who will inevitably have their own evidence on why the scan results are wrong or irrelevant. These are things that you won't find out until you actually try it. Unfortunately, there's a lot of people with a megaphone who haven't actually tried the things they're preaching. I'm guilty of this as well! I preached that inside-out underwriting was the silver bullet to cyber insurance underwriting. Once we actually started trying it, there were MAJOR flaws. Carriers couldn't ingest the data, the inside-out tech is geared towards vulnerabilities, so now we just gave underwriters more vulnerability data than they had previously. We were an insurance agency facilitating deep cybersecurity scanning, and we were holding that sensitive internal vulnerability data, etc. Real-world experience always beats theory. You see this with the scam that college has become. Kids graduate and expect great jobs, but no one wants to hire them because they don't know anything that actually provides value in the real world; all they know is theory. All this to say, let's give the megaphones to the retail brokers... the ones actually selling cyber insurance. The ones that have been there and done that! We can learn from lifelong carrier and wholesale folks, cybersecurity folks, etc., but when it comes to "How To Sell Cyber Insurance," the retail brokers like Mercy Komar, CIC, CyRM, MLIS, CCIS got this.

23

4 Comments

It'll be interesting to see what BI / Contingent BI claims start coming in as a result of the Microsoft / Crowdstrike outage. It has been emphasized that it was not a cyber attack or security failure. Will it then fall under coverages for system failure? Watch this space! #businessinterruption #cyberbi

19

2 Comments

This article highlights 10 essential cybersecurity controls to help manage cyber exposures.

5

1 Comment

Guidewire's Alex Ryckebusch and Ryan Park Grant will be hosting the National Association of Mutual Insurance Companies (NAMIC) Claims webinar on October 1, "Lowering Your Loss Ratio With Embedded Claim Analytics: Best Practices from Leading Insurers." They'll be discussing some of the most valuable use cases, how they were implemented, and the demonstrated returns on investment. Register here: https://lnkd.in/gUCFsw9w #GuidewireClaimCenter #insurance #insurtech #claims #claimsmanagement #analytics

1

I have a proposal for Cybersecurity Awareness Month... let's be real about cyber loss frequency and severity. So many folks in the cyber insurance and cybersecurity industry love to paint a picture of doom and gloom to the point that there's a subset of people that genuinely believe that cyber insurance will cease to exist because of how unprofitable it'll be! More often than not, the reality doesn't match the narrative. Don't get me wrong... cyber risks are real, and businesses need to be prepared, but we need to be accurate in how we depict these risks and exposures. I recently heard someone in the SME cyber insurance space say that their median claim was $4M. What?😂 According to the majority of claims studies out there, the median cost of a claim for an SME was ~$150,000. Yes, many businesses could be devastated by a ransomware event. But there are also many businesses that a ransomware event might not even clear their $25k retention. Plenty of businesses could be devastated by a dependent business interruption. There are also many businesses that wouldn't be affected much at all by a dependent business interruption. Same thing with a data breach where they can apparently expect it to cost $150+ per record. What a terrible way to measure data breach costs. You really think a data breach of 1M records costs $150M+? We just need to be accurate, and unfortunately, a lot of this boils down to a lack of a true source of truth for what the data actually looks like. All I know is that cyber is in a stupid soft market, and if you ask any one of your cyber carriers about their profitability, I would bet everything that if they were being honest, they'd tell you that they're making money hand over fist. For many carriers, cyber is probably the most profitable line they write. Regardless of suppositions, AM Best reported that cyber insurers as a whole are reporting strong growth and manageable loss ratios. All this to say, for Cybersecurity Awareness Month let's focus on providing real value based on real data. It's time we have an honest conversation about cyber risks without the exaggeration!

24

7 Comments

I'm fearful for risk managers who rely on AI as to transfer risk. Why? Here's what happened with me, and I didn't catch it right away. There are tools available that ask for onsey twosey data points about businesses looking to transfer cyber risk to third parties. Name, Website, Revenue, MFA (yes/no), etc...really simple stuff. These tools try to integrate AI to help automate the data entry. In this particular situation, I had a tech company who, based on their website, was classified by AI as something else. This resulted in drastically different premiums and a few exclusions on coverages. Thankful to have caught this - took a second set of eyes. These situations happen daily where misclassifications are submitted and risk is assumed that shouldn't be for costs that don't truly reflect what's at stake. These situations are the ones that lead to claim denials and the mistrust that gets placed in the incredible product that cyber liability & tech eo are. Please be careful out there 🙏 #coveryoursaas

5

2 Comments

An interesting read about the need to protect OS and system recorded data for securities sake

2

If you're attending the 38th Annual Farm Bureau Actuarial Conference in Park City, Utah next week, be sure not to miss the session by Guidewire's Christopher Cooksey, "Generative AI market/opportunities and governance needed." #GuidewirePredict #insurance #innovation #insuranceinnovation #insurtech #insurancetechnology #pandcinsurance #propertyandcasualtyinsurance #generativeartificialintelligence #generativeAI #GenAI #analytics #data #predictiveanalytics

7

1 Comment

Navigating the Gray Areas in Cyber Insurance Claims: Explore the complex landscape of cyber insurance claims as we dissect policy ambiguities and provide guidance on handling claims effectively. Learn how to interpret evolving cybersecurity threats and their implications on insurance coverage.

2

I'm really excited to share this research! Counterfactual analysis offers a way to think about catastrophic cyber risk in less theoretical, more concrete terms. We hope this paper helps (re)insurers better understand the different events at different points in the tail, and explore new ways of thinking about model validation. #cyber #insurance #catastrophe #risk #analytics

18

3 Comments

Our TC wind, storm surge and inland flood models are based on global sea surface temperature (SST). Climate variability included are a warm Atlantic SST as well as La Nina, both conditions that increase many risk measures in the US this year.

25

Coalition, Inc. just released their 2024 Cyber Claims Report, which details emerging cyber trends and the impact on their cyber policyholders in 2023. Ransomware grabs the spotlight. And understandably so. But there are certainly other significant cyber threats that businesses need to be aware of. Key Finding: Cyber claims originate in the email inbox - More than half of all cyber insurance claims (56%!) were the result of Funds Transfer Fraud or Business Email Compromise that originated in the email inbox. Email has proven to be an easy place for attackers to discover payment info and potentially intervene in payment processes to steal funds,” said Robert Jones, Coalition’s Head of Global Claims. Why is this important? Funds Transfer Fraud and Business Email Compromise will remain persistent threats since they’re relatively easy to execute for cybercriminals. Both can cause significant damage to businesses. The average loss from a Funds Transfer Fraud incident is more than $278,000. A well-structured cyber insurance policy can help businesses recover from these cyber threats. Cyber insurance extends far beyond addressing ransomware incidents. Cyber insurance isn't a replacement for strong network security. But in the event of a cyber breach, a comprehensive cyber insurance policy can help businesses protect their data, their network, their bank accounts & their reputation. #cyberinsurance #cyberattack #cybercrime https://lnkd.in/efS37rA5

11

CISO specific insurance coverage? With lawsuits against CISOs being in the news recently, the matter of how to protect security professionals from liability has become a topic of discussion. So it’s with interest that I read about Crum & Forster’s CISO specific offering, separate from their usual D&O coverage. As well as being a prime market opportunity for Crum, insurance specifically for CISOs does have some benefits: 🔒 It helps attract and retain talent when candidates might be hesitant about personal liability risks in a world where CISOs are being increasingly targeted or scapegoated 🔒 It can potentially reinforce risk management practices by adding an additional layer of scrutiny for incident history and cybersecurity posture, over and above a traditional cyber insurance policy 🔒 It acknowledges the growing risk landscape and the complexity of the CISO role, and the nuances specific to cybersecurity that might not be covered by a more general D&O policy What are your thoughts? Is this a viable market opportunity, and do you see other carriers entering the market with similar tailored products?

25

7 Comments

Navigating the Remote Tide: Actuaries' New Frontier 🏠💼 The work-from-home wave has swept across industries, and the actuarial realm is no exception. Once confined to office cubicles, actuaries are now unraveling complex data tapestries from the comfort of their homes. This seismic shift has brought an unprecedented level of work-life harmony. No more hustle through the morning traffic, no more clock-watching until the end of the day. Actuaries are now masters of their schedules, bending time to balance spreadsheets and personal needs with finesse. Yet, the home office is not without its snares. The line between work and rest blurs when the commute is just a hallway's journey. Over half of our number-crunching comrades report longer hours, tethered to their tasks beyond the usual clock-out time. This could be the unseen ripple of having no physical separation from the workplace or the allure of 'just one more calculation' before dinner. As we continue to adjust to this evolving work environment, it raises a crucial question: How do we safeguard the well-being of our actuaries, ensuring they leverage the benefits of remote work without succumbing to its pitfalls? Your thoughts and experiences matter. Share your insights on navigating this balance in the comments below. 👇 #Actuaries #RemoteWork #WorkLifeBalance

2