Insuring Cyber Podcast - Insurance Journal

What is the biggest lesson that cyber insurers should carry into 2021 after a year in which the COVID-19 pandemic took center stage?

In the first Insuring Cyber podcast episode of the new year, Tim Zeilman, vice president and global cyber product owner at Hartford Steam Boiler (HSB), discusses how lessons learned from the coronavirus pandemic and from recent significant cyber attacks are more related than insurers may think.

“I think the lesson is pay attention and learn the lessons of the close calls,” he says. “So when you think about the COVID-19 pandemic that we’re in the midst of right now, it’s not the first one. We had inklings that things like this might happen.”

Indeed, over the last decade, disease outbreaks such as Ebola and H5N1, or the avian flu, hit the news, although these outbreaks never amounted to the same global scale as the COVID-19 pandemic, he explains.

“I think you can make an analogy to cyber attacks,” he says. “We haven’t seen the big one yet. We haven’t seen the massive cyber hurricane that everybody worries about and models, but we have seen some smaller events. In particular in 2017, we saw NotPetya and WannaCry.”

He says the message to be taken away from this pandemic as well as the cyber attacks seen in the past few years is don’t ignore the near misses.

“Don’t expect that the future is going to look like that – that we’re always going to have these small, somewhat contained events that might be big but are not the massive big one,” he says. “I think that the bottom line there is really to keep your focus in cyber insurance on accumulation, to plan for that big one that might look like a WannaCry or a NotPetya event but on a much larger scale and much greater impact, and plan for what that would mean to your cyber insurance business.”

Also in this episode, Lauren Winchester, vice president of Smart Breach Response at Corvus – a provider of artificial intelligence driven commercial insurance products – takes a look back at some of the big trends in cyber insurance in 2020 and discusses what cyber insurers should be paying attention to in the new year.

“I think visibility into vulnerabilities is going to be really key – how cyber insurers manage to partner with other vendors or build in-house capabilities in order to get a better sense of their risk pool and the vulnerabilities among their policy holders,” Winchester says.

She adds that going forward into 2021, it will be important for cyber insurers and their clients to establish a greater partnership in order to better understand how they can work together.

“I think insurance buyers in working with their brokers should really be considering what else their cyber insurance company can be doing for them,” she says. “It’s really so much more than just risk transfer at this point, and they should and can ask more of their cyber insurer.”

Thanks for listening and be sure to check back for new episodes every other Wednesday published together with Insurance Journal’s Insuring Cyber newsletter.

The post EP. 5: Expecting the Unexpected: Cyber Lessons from 2020 appeared first on Insurance Journal TV.

As the COVID-19 pandemic and the switch to remote work have highlighted cyber risks and drawn attention to the various methods cyber attackers are using, ransomware has continued to steal the spotlight.

Ransomware is a type of malicious software that is designed to block access to a computer system until a ransom is paid, and these attacks have increased in severity and frequency in the past year alone.

Just this October, the U.S. Treasury Department issued a warning that individuals or businesses, including cyber insurers, that help facilitate ransomware payments could be violating anti-money laundering and sanctions regulations.

The warnings came in a pair of advisories, one from the Financial Crimes Enforcement Network (finCEN) and the other from the Office of Foreign Assets Control (OFAC). The advisories came as the FBI and Homeland Security officials also warned in October that Eastern European criminals are increasingly targeting U.S. hospitals with ransomware and urged healthcare facilities to beef up their preparations.

“[The advisories] are going to create potential exposures and potential costs that arguably were not there before,” said Josh Mooney, chief privacy officer at Philadelphia-headquartered law firm White and Williams LLP, in this episode of the Insuring Cyber Podcast. “Cyber carriers are now going to have to take a look at what are some additional liabilities out there? And are they going to run afoul with U.S. law if they honor the obligations they have under their policies to help pay for a ransom caused by a ransomware attack?”

In particular, he added that these advisories will almost certainly add an additional layer of cost and potential liability with carriers in forensic firms – a layer that only adds to the already increased proliferation and sophistication of these attacks.

“Ransomware attacks that we’re dealing with today are very different than the ransomware attacks that we addressed and saw even as recent as 12, 14 months ago,” he said. “Before, again, as recent as a year, year and a half ago, the typical ransomware demand would be maybe in the five or six figures. Now, many of them start in seven or even eight figures.”

Ransomware has become so common that it’s actually turned into somewhat of a business model, according to Michael Carr, head of underwriting at insurance provider Coalition. He explains in this Insuring Cyber Podcast episode that there are groups – sometimes referred to as Ransomware as a Service, or RaaS – that establish footholds on companies’ networks and periodically sell that access to other groups who will drop malicious software on those networks and seek a ransom.

“So it is a situation where there’s the potential that you can be a victim more than once if you don’t properly recover from the first attack,” Carr said.

With this in mind, Carr urged victims of ransomware attacks to act quickly and work with their cyber insurers to respond.
“This is a situation where the first thing I would say is for Ghostbusters fans, who are you going to call if the incident occurs?” he said. “So is your cyber insurer going to have somebody on the other end of the phone line who can actually quickly engage all of the right resources, legal forensics, etc., to respond to the attack? Because generally speaking, the longer it takes to respond, the more expensive these things can become.”

Check out this latest episode of the Insuring Cyber Podcast to see what else Michael and Josh had to say and be sure to tune in every other Wednesday for new episodes published along with the Insuring Cyber newsletter.

The post EP. 4: What Cyber Insurers Should Know About the Federal Ransomware Advisories appeared first on Insurance Journal TV.

“Insurance is a technology industry now.”
That’s according to Todd Lukens, chief information security officer at Nationwide.
“You think about the entire workflow of how insurance works, everything from creating a quote to binding to utilizing artificial intelligence and machine learning and our claims processes and our fraud processes, it’s a technology industry,” he adds.
In the first episode of Insurance Journal’s bi-monthly Insuring Cyber Podcast, Lukens speaks with host Elizabeth Blosfield about what Nationwide is learning from its transition to a hybrid operating model with 98% of its workforce being remote – a move the company announced in April as the coronavirus pandemic was ramping up.
Also in this episode, Pete Arterburn, digital transformation lead at Aon Affinity, discusses how the insurance industry is being pushed to embrace tech with COVID-19 at its heels. He explains what this means for a relationship-driven industry in terms of connecting with its customer base and attracting top talent.
“I think ultimately we’re going to start to see tectonic shift,” he says. “You’re going to start to see a number of agencies maximize that technology capability to really move to that virtual environment...I really do think that will continue to be the new norm.”
Thanks for listening. Check back twice a month for new episodes of the Insuring Cyber Podcast every other Wednesday.

The post EP. 1: Insurance’s Digital Transformation in the COVID-19 Era appeared first on Insurance Journal TV.

As museums and cultural institutions are increasingly relying on technology to display digital works and manage internal systems and documents, they could be opening themselves up to growing cyber risks. John Farley, managing director of the cyber practice at Gallagher, Anthony Dolce, head of professional liability and cyber at The Hartford, and Joshua Morin, director of IT and application services at The American Alliance of Museums, spoke on this episode of The Insuring Cyber Podcast about the biggest risks facing museums and how cyber insurance can provide needed resources.

The post EP. 79: The Art of Managing Cyber Risk for Museums appeared first on Insurance Journal TV.

As the InsurTech industry approaches the next wave of innovation, experts say this could mean navigating rough waters.

“I believe what you’re going to see is that you’re going to have Insurtechs, the cream of the crop, are going to survive and thrive, and a lot of them are going to have to deliver on the promises they made to their investors and to their partners,” Upasana Unni, chief commercial officer at Sayata, said in this episode of The Insuring Cyber Podcast. “It’s going to be a little bit rough seas, I think, out there in the next quarter to three quarters.”

Unni said that she believes the next phase of InsurTech – InsurTech 3.0 – will be largely focused on the ways InsurTechs and insurance carriers can serve each other, and this could result in a more active acquisition landscape as the industry faces consolidation.

“They’re not trying to disrupt, they’re trying to support or improve, basically helping insurance companies evolve,” she said. “And then a few players, I think, will have business models that actually prove out to be truly profitable at scale.”

Jeff Radke, CEO and co-founder of Accelerant, added earlier in the episode that while InsurTech 1.0 focused on the consumer insurance space, the next phase – InsurTech 2.0 – moved toward business-to-business and commercial products.

“3.0, at least as I’ve heard it described and the way we tend to think about it at Accelerant, is a little more broad in that, I think, it’s focused very much on accessing high quality data and making it available across all the players,” he said. “I guess the fancy word for that would be transparency.”

Unni said that the challenge in navigating a wealth of data is analyzing which data points to actually utilize.

“Even though there is a wealth of information ... which data points actually make sense to include, which data points do you train your model on?” she said.

Radke said that as InsurTech works to navigate some of these new challenges, it’s important to remember that it’s a fairly new space with plenty of risk as well as opportunity.

“I don’t think it’s even close to maturing,” he said. “While it’s been around since 2010 in one form or another, or at least talked about since then, I would say ... we have a long way to go. I view that as a really exciting thing. That’s good news to me.”

He said this means there are plenty of “green fields of opportunity” in InsurTech to help modernize traditional insurance company functions and capture, catalog, manage and understand the quality and the province of the data that’s available.

“Making that available throughout the value chain is really becoming a powerful force, at least in our corner of the market. It’s drawing in much more demand for insurance policies. At the same time, it’s drawing in significantly increased capital supply to back those insurance policies,” he said. “The operations of the typical insurance company, I think, might have more upside from modernization than perhaps distribution, but I’m not sure how much we’ve even begun to scrape those opportunities.”

Unni added that although InsurTech is still a fairly new space, it has seen a shift in thinking among traditional insurers from being a disruptor to a welcome addition to the industry in many cases.

“I think 10 years ago, you would’ve had a lot of insurance executives dismissing the new kids on the block, which is how they thought of a lot of InsurTechs,” she said. “And now, frankly, half of the introductions I get to InsurTechs come from traditional carriers, or executives I know there, introducing me to an InsurTech partner that they’d love for me to meet. It’s a huge turnaround from dismissing them as a fad even a couple of years ago.”

Check out this episode of The Insuring Cyber Podcast to find out what else Jeff and Upasana had to say, and be sure to check back for new episodes publishing every other Wednesday along with the Insuring Cyber newsletter. Thanks for listening.

The post EP. 37: Riding the Wave of InsurTech 3.0: What It Takes to Not Just Survive, But Thrive appeared first on Insurance Journal TV.