Cyber Insurance, Unfiltered

All right, thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

I'm Cody Rivers.

And today we're joined by Violet Sullivan, AVP and Cyber Solutions Team Lead at Crum Forrester. And we wanted to have her on the show, one, Bronwyn, uh, who's our, our, our fearless coordinator and director, is joining us for this talk as well, and you'll see her more in the future. But Violet has some really interesting experiences and perspectives because she really works at the intersection of cyber law as an attorney and cyber insurance, which we all have questions about, and then incident response, which probably means she didn't sleep through many nights at a period in her career. So without further ado, Violet, I'll let you introduce yourself, give a little bit of background on how you worked your way into cyber. And then we want to go deep on a topic or two, probably around cyber insurance and incident, where we really want to try to get into some meaty topics or learnings that you've had that our listeners can learn from and maybe do something different preventatively or in the midst of an incident.

Well, thank you for having me. I feel like you already introduced me well with that kind of triangle of cyber law, cyber insurance, and incident response. I did start on the breach notification side. So when I came into cyber, I really saw that there was a bigger picture operationally than just the legal side. So that's when I thought, I don't want to just go into privacy and be a breach coach. I want to understand the technical. So I went from breach notification, I did pre-post breach, and then I went to pre-breach and learned all of that risk management stuff, pen testing, vulnerability scanning, all of the, all of the compliance frameworks that you have to think about and weigh and compare. Remember back when they did all this? Yeah, all the spreadsheets that would compare because you didn't have any compliance frameworks. And now, and then I decided to go to the forensic side because I really wanted to be on the front line. I wanted to understand what happened on the scoping call and the big decisions that happened. And all of that collective experience operationally, technically, legally helped me to get where I am at, which is leading risk solutions for Crum Forrester, an insurance company as part of a bigger brand of insurance companies called Fairfax. And I love working with a team in cyber insurance, and I get to work with not only the people on the insurance side, but I actually get to work with all the vendors that I used to be a part of, right? So from Breach Counsel, Forensics Notification, all of those colleagues that I've been friends with over the years are now the people that I get to work with every day.

You must have really developed some good relationships through all those incidents because I've never heard anybody say, I love hanging out with lawyers, vendors, and for—

Cyber people.

Yeah, exactly. You know, it's funny because in group chats at one point I was like calling them my cyber friends and they're like, "Violet, you can call us your real friends now." You've gone past that point. We do truly get to that level of connection and nerdiness.

Yeah. So, who's easier to work with or who's more difficult to work with, lawyers or security people?

Or insurers. Well, let's just put the full hat trick in there.

Neither one, neither one can hold back the face that they get, the know-it-all face that they get whenever there's an MSP on the phone. Neither one can hold back. And I've had to coach so many technical people, and I say that is like telling their baby, their baby's ugly. Do not tell them their baby's ugly. Take a step back. Don't roll your eyes. Um, so I think—

what if it's horribly— if it's horribly ugly, Violet, what do we do there?

On the first introduction, why would—

oh, this is on the intro. It's like they're not part of the friend circle.

God, I would say I get along with the technical probably more just because there's so much, um, if there's so much neurodiversity, and I'm really attracted to a lot of the neurodiversity in our field. And I think some, I love a lot of the attorneys, but sometimes you get those attorneys that give us a bad name. Hmm.

So, okay. So, you've been in a lot of rooms. I was talking with you earlier in the little prep. I heard a lot of great, cool names and, you know, security firms, insurance folks, all speaking different languages. Give us a story without names. What's like the most chaotic miscommunication you've witnessed where everyone thought someone else was handling it.

Cody did not prep any of us for this question, but I love it.

It just came to me. I was like thinking like, man, this is, this is a, this is a wild, wild west here. So I just want to hear from the—

so this is— so I think some of the terminology on what the different players are called, and I think I take for— take this for granted that I know these things because we speak in this language. But internally the playbook might only have a word for, okay, there's a breach counsel and then there's privacy counsel and they might call all things the same, the same name. But what I usually like to say, like when we're on a call is we have, we're going to have legal help you and technical help you. And there might be people under those two, but those are like the two top ones first. Then we'll go operational, right? Like how do you print out 1 million letters? Well, we can't do that in our print shop over here. So you have to sit there and I think bring it back to like function and workflow and not just using terminology that you think is like it. I was actually just on a call today and someone's like, oh yeah, we're the recovery vendor. We're going to help the DFIR vendor do this. Why are you saying DFIR? Nobody else knows that. And internally you may have the one security person that knows what DFIR stands for, right? Digital Forensics Incident Response. For everyone. It's, it's something that we use all the time, but if it's the, if it's their first time and think about who you have on the call, you might have the superintendent of a school, you might have the head of the board, you might have people that don't understand the language. So I think that the biggest misconception that creates problems is not knowing who has the ball and not knowing what we're calling the different players, because this is a big team sport. It's a marathon, not a sprint. So all of, all of the idioms at once. It is important to know who you're tossing the ball to. And I think that that also comes a lot with the difference between when you have a different technical vendor doing forensics and looking back at what happened versus the recovery, which is of course getting things back online. And you can do so much simultaneously that I think people kind of forget that we got to get up and running it too. We can't just technically, it's so interesting to do forensics and look back, but you're not going to make money until you start getting things back online.

Yeah. I wanna double-click on who's got the ball, cuz that, that would be my chaos item that I've seen on all sides of the table really. And sometimes it's a little bit of, especially in tabletops where life and death and outages are not on the line. And you know, I've seen everything from like legal, privacy, cyber, and the CIO all thinking that they're the person making the decisions? One, probably because it's not that well worked out in the playbook and there's not a RACI that clearly defines it. But how often are you seeing that when live fire is happening?

Or calling, who's, who is taking the, what would you call it? Like the fore— like taking the forefront and calling law enforcement. Right? Is like, there's always someone rogue that's called law enforcement, and you're sure, or you're walking back from communicating to employees, or like, oh, we already did this. So that's when I hear, when I'm on an initial call, I really like when I hear the breach counsel, the attorney that's leading, say, how have you already communicated? Almost like assuming, like, can you just tell me, have you done anything yet before we jump into the basics? What have you already said so we can clean up whatever, whatever was already laid down? Um, I think another mistake that I've seen is just confusing, you know, okay, uh, news for today: breach coach term is trademarked. I know because I got a cease and desist when I made it, when I made a sticker one time. But that word breach coach has been used to reference the technical and the legal. And when you say it from the technical side and you give someone a decision, you're, and you're not being clear and your, your plan isn't clear. And I've seen plans that basically define it and then people jump in and think another thing. You can't have the word breach coach and not say this is counsel or this is legal, this is technical. You can't have these same words overlap.

Attorneys that are going to be super busy because I just Googled Breach Coach and I'm seeing trademarked services by 3 different vendors that are in the recommended hit results.

No, I definitely got to, I definitely got to do not use. So that's why I just write beach coach every time instead, intentionally.

No.

Yeah. I like, I spell it wrong because I'm. I'm trying not to.

Good loophole. That's a good loophole.

Poking fun at the trademark. Yeah.

Awesome.

Yeah. You know, you mentioned some great things there and I do, we do a lot of incident response. I think another thing I see a lot is to your point, comms, like you've always got legal, you've always got the cyber folks, you've got the, um, overaggressive executive that wants to be in all the different rooms and make all the decisions. And you're like, in reality, it doesn't happen, but comms to your point. Rarely gets brought in, if not late. And you're like, you've got internal communications, you've got external. And, and the point you brought up that I really like is by the time the counsel gets there, what has already been said? Because oftentimes, to your point, and that's a, that's a, I, I didn't think about that. It's like they're trying to do some cleanup cuz it's kind of pulling back and say, okay, well, I gotta work from here. I don't get to start fresh with the new template. I gotta say what's been said, then how do I come over top of that? Or how do I come around? So that, that's a really good point to think about.

Well, and I got it from Breach Counsel. That's, that's where I heard it first. And I also like from, I've learned a lot from crisis communications firms that specialize in cyber are so good at this and they're so on top of it. Um, that I think sometimes we downplay, usually we only see that money spent when there's a big, huge-scale event, but I learned so much from the PR side of the house because we don't, technical people don't think about facts, facts, facts, logic. So when I've sat in on sessions and learned from the PR side, they will organize the communication in audiences. So they'll have a communication, it'll all be similar in case it gets copied for the wrong place, but it will be like, okay, you have way you communicate to the board, way you communicate to these customers, way you communicate to your internal teams, your sales teams. All of that is something that can also be in that crisis communications plan. And what I find too is that there's already probably a crisis comms plan for hurricanes, active shooters, some other type of disaster that can usually be linked into cyber. And you can push marketing to go ahead and look at the plan and see, do we have any new audiences? And then I always usually tell them about security researchers. I'm like, hey, there's a whole different media that asks different questions. And if you get a call from, you know, you know, Brian Krebs, then you have a different response than you do.

Tell them everything. Don't hold back.

No, just do it.

Yep, do it. So a lot of people in cyber end up staying in one lane and you've had the chance to, you know, kind of branch across law and cyber and insurance, which probably helps with some of that friction of kind of who's got the ball and language miscommunication or translation issues. What drove you across the three and how has that helped you? Be a better communicator or bridge that communication divide across those functions?

That's a, that's a great question. I think that it was always about learning new skill sets. When I went to, from when I started, I was on the operational side and then I knew that I had just gone through some of the largest breaches of 2014 and 2015. Um, and I knew that I could take that learning and learn how to give effective tabletops from the operational side. We felt like, you know, the company I worked for, we had the first operational retainer, whereas you have these technical retainers. Well, we had operational retainers for retailers that needed call centers stood up, that needed, you know, the notifications within 3 days. We could guarantee, right? Those, those pieces were very formative for me. but then I needed to go learn risk management. So I learned the front end pre-breach and then post-breach, I wanted to go back and learn technical. So that's where I went. And I think insurance was like that final piece where I was like, wait a second, the entire economic structure of this entire crisis response very much depends on a bunch of paragraphs. And those paragraphs are in the insurance policy. And I really wanted to learn how it all worked together. And I feel like that's kind of the central hub because it is the place where you can, you can try to be right as a security professional 100% of the time, and you can't be right 100% of the time or else we wouldn't see these headlines. And so having this, it's really just another, just like you have contracts in place with all of your security vendors, an insurance policy is just another contract. It's another risk transfer mechanism to balance out and be part of your total cybersecurity view. And I just like to debunk any myth that it's like admitting defeat or any kind of like, oh, we'll never use that because it's another part of the way that they, that a CISO or CIO or anyone in that security leadership, they balance risk. I have to jump in with my question because you're, I think I want to, I'm going to double-click on this too, because, and I think this is an opinion question. You're at the intersection of all of these fields, which means that you speak all languages simultaneously. Simultaneously. What's your opinion on how we communicate in an accessible way to all of those audiences? Like, do we have a responsibility to be defining our acronyms and our terms all the time? How are you doing that? Well, one, Simplifying Cyber, right? This whole podcast is focused on simplifying. I think that this is the way you should— we should have terms and ways that we can break this down where we don't have to sound important or special, and we don't have to also do so repetition. How many times do people repeat the same phrases over and over again? I think that there's a lot that you can also do. I went to— I actually got this from RSA last year. It's a kid's book, Chief Information Security Officer. I can't remember what company this was for, but which should be marketing. I go to career day for my kids' school and I talk about— and I realize the best way that I've been able to explain it is I tell these kids, I said, think about your diary. And think about you put all your secrets in the diary, and someone took your diary, they put all your secrets out everywhere. And they locked you out of your diary so you can't have it anymore. And then I kind of explain, hey, when you have data, and you let go of that data, it could be really personal to you, and you could be really frustrated about it. And then I talked through, you know, how we prevent that and how we can lock the diary up and put it in a safe and put it on you know, all of those things. So I think that there's ways that you can make it accessible. And I think you could start thinking about this not just for the board level and exec, 'cause everyone focuses so much on translate to board, translate to board. Yeah, but board people are also fathers and mothers. So just translate to humans.

And grandparents.

Yeah. And Valarie, do you still adjunct profess, teach profess at Baylor University?

Yes, I love it.

Okay, 'cause I kind of thought about this. You know, your point is like, asking questions is a big thing. Sometimes people are too proud or the ego's there, they don't ask the right questions, but students typically usually ask more questions. And I kind of think of like, what's the question your students ask that you secretly think more executives should be asking?

Oh, the biggest question is just who, like, what makes it a breach? The simple question, right? And the thing that I come down to, which you might miss— you might think I'm going one way, switch the other way. You might think I'm going to the whole breach has a definition in different states, blah, blah, blah, blah, blah. Instead, I'm just going to say every company would have a plan and you would look at the plan first because before you make a decision on notification, you have to decide whether or not your company needs to escalate the incident. So I try to go back to I like that question because it kind of says, okay, it's not just a— while it is a legal determination and we don't want you to say the B word before you, you know, need to, you need to also think about how it's escalated within your internal company and how it gets to you as, like, once the counsel is brought in, there's already been a bunch of kerfuffle that's happened at the incident, you know, level. And think about all of that time that there is an escalation pathway internally that we don't really explain again to the board or to the executive team what that escalation pathway looks like. So like when I do tabletops, I usually say that to me, that's the most important part is the escalation pathways, because you've got to show how someone in help desk connects the dots with someone in networking. Because if you can't show that those dots are connecting, these things could be happening and two different bells going off that you're not you're not seeing in real life.

100% agree.

So let's talk a little bit about AI and, you know, kind of in, we can stay in the incident related topic or we can talk about more in the prevention side of it. How is AI reshaping what you're doing from a legal standpoint, as well as risks that you're seeing with clients as they're trying to either get in front of or catch up with what's going on in their organizations?

Well, I think the biggest thing legally recently within the past month has been that big change in the fact that you divulging things to AI, if it's legal advice, putting it in there is going to basically remove attorney-client privilege. That's the biggest huge bomb that's hit the legal side from AI because it really, it really jeopardizes that, that defense that you use with your, you know, with your client and your lawyer when that thing gets exposed, when the content that you have created with your attorney gets exposed to AI, which you think you might be cleaning up commas and it's exposing it to losing privilege.

How does that play out on like AI recorded meetings? Like if you're recording a meeting with a counsel in Teams and it's doing a transcription, is that the same risk as putting it into Gemini and asking it to some, you know, to Friends that have written up all these articles for LinkedIn on this that I have all saved. Yeah.

So I'm gonna have to ask. I don't know.

Nice.

I, I mean, this is within the last month that this stuff has developed.

Yeah.

Yeah.

I think from a cyber side though, this is just the social engineering fact for us has been we've, we've seen so many more believable social engineering attempts.

Yeah. There's obviously a lot of going on with AI that we're not even gonna get into on this conversation, but what's kind of like your biggest eye-roll moment right now when people are like, well, I have AI, I'm good to go, don't worry about this. And you're like, ah, it's just like, it's like, it's like, you know, knives to your ears is when you're like, that's not a solution, but, you know, they leverage AI, so they're, they're in a good spot.

Oh, I don't know. Can I say cloud instead? Because it's like that, that myth of cloud security. I put everything in the cloud. No, I don't need MFA.

Aaron just put one out, had a good article of the day about the entire, you know, Delve thing right now online, the compliance and a lot of that. But I think to your point, you see a lot of fallacy of like, there's marketing and AI and people kind of say, oh, I'm good to go. But in your area where you're solely on the incident and like the post side of things and you see, hey, like that was a false sense of security or here's the reality of it. So. A lot of times I hear those stories.

Automation, like I will stop meetings sometimes and say, you know, you mentioned AI, but really we're talking about process automation. And they'll be like, yes. I'm like, just, we don't have to make it shiny. We can just talk about what you, what it, what the outcome is.

Yeah, I totally agree. One thing to kind of pivot here too, I always, and this was not prepped at all, so by the way, I don't wanna surprise you, but every time on every episode I kind of say, Give the audience, the first time they're meeting Violet Sullivan, give them like a fun fact. What does someone who may even, who may even know you currently for a couple years doesn't know? What's like a fun fact? Could be a cool hobby, a fun experience you had. That's a good story that we can share with the audience.

Well, I, in high school, I was a Heart of Texas Rodeo Sweetheart.

That's phenomenal. Please share more, elaborate. What does that entail?

How do you get that title? Do you ride a bull or—

No, you get to wear a sash and you get to give out trophies to the bull riders.

Okay. All right.

That's awesome. Very nice.

All right. So let's, while we're on the personal topic, what do you do from a nonprofit give back? Like, where do you spend your time kind of adjacent to profession that you're passionate about?

Well, I am a very big contributor and love of all things that empower women in cybersecurity. And I know there's so many amazing groups like YCs and WIS, but in the insurance world, about 3 years ago, we realized that there wasn't really a business risk-focused cyber organization that we could all connect with. We, as a kind of cohesive group, the insurance market, along with the vendors and the law firms that we work with, we created International Women's Cyber Risk Alliance. And so that's iwcra.org. I serve as CEO of IWCA or IWcRA. And we have a great group of, I think we're, we have over like 1,700 members in 18 different countries because this is a, insurance is a very global business market, right? And it funds a lot of the cyber events and responses that you see. And there's a lot of women that really want to connect and I think too want to be mentored and mentee'd. And I think that it's a great way for women to connect, right? Cyber is already something that there's a heavy male population in cyber technology, but in cyber, when it comes to the insurance world, it's also very much was a traditional boys club. And I think that having that connection with women in the insurance market, we've asked each other questions like, How do you ask for a raise or how do you get on these speaking panels? How do you get podcasts, right? How do you, how do you learn from each other? And that's really what we're trying to do is network and learn from each other in the industry.

Awesome. How do member or prospective members get involved? And it sounds like it's, you got to be in the industry. It's international. So probably geography doesn't matter. But if we have listeners that are playing in this space, how do they reach out and get get plugged in?

You just go to iwcra.org and there's a become— get involved tab. You click it and you put your name in to become a member. So you'll get newsletters, there's events, um, all around. There's actually an event in London in a couple weeks, and from then— oh, Toronto actually tonight, but it's, it's gonna be past then for taping. So we have events all over the place, um, and a lot of virtual events that you can join from anywhere.

Awesome. Well, that's really cool.

Shifting back to the work side, maybe one last question. Cody, if you want to tee one up as well, that's cool as well. Um, but if you, if you were able to call yourself, let's say, 10, 15 years ago and give yourself some advice specific to career in cyber, what would you, what would you say on that call?

Easily, easily, I would say just because you went to law school doesn't mean you have to go to a big law firm. That the ego of being a lawyer is something that you, as soon as you drop it, as soon as you put it out the wayside, you can follow your skills and passions. I think being a lawyer and getting practice in law is so helpful, but I think that law school actually feeds that ego of, well, I just spent a lot of money on my degree, I need to go work for this law school and kind of lose my— I mean, big law firm and lose my soul. And I think dropping the ego, and I think that's probably for any, any, any know-it-all type profession. When you can drop that know-it-all ego, I think you're, you're going to be happier. And I feel like that the moment that I realized I didn't have to apologize for not being at a law firm and realize how I could be used in different ways, it was so freeing. And so I would have just told myself sooner.

I think you're right. That is applicable. Elsewhere and probably in almost every profession. If somebody feels entitled to that, they should be at the next level or that they're, you know, outperforming everyone else. So why not me? Why not me? And I think that gets in the way of learning and progress.

Well, and this is for baby lawyers out there. It's like you, you get this, this mindset of going, you're not a real lawyer unless you're at a law firm. That's almost like a thing you would tell yourself or you, you kind of like, I don't know if people say it out there, but that's like the, the internal monologue that I've heard a lot of other lawyers say, oh, oh, well you don't really practice. I'm like, but you hold the bar in two states, right? Or you, you know, you, you have these experiences and it's like, you don't, you gotta throw that away, that whole idea of you're not a real lawyer unless you do it this way. Yeah.

On the, on the last thing, Thea, it's like some, most of us at some point in life or in work are involved in a breach or, or hear about something. But for those who have been blessed not to have, You know, and if, if I think if cyber insurance existed for like everyday life and you could file a claim for, you got phished into a bad relationship. Yeah, well, you could, you know, you got phished into a bad relationship, you hit a sketchy Amazon deal, or whatever, whatever it could be. What would be the most common claim that you think would be if it's on the personal side?

Account takeovers.

Yeah.

I guess that would be more the most scary claim to me, maybe not most common, but to me, that's where I think privacy is heading is instead of worrying about, You know, I think the financial institutions have really good compliance frameworks, but I think that account takeovers with, you know, airline miles and rewards, you know, all of these things that we have logins for and social media, I think identity is more important than just what we define PII as right now. I think that the burden of privacy is going to change.

Yep. And not even talking yet about deepfakes and audio deepfakes and all of that. We've, Seen quite a bit of that through the last year. It is, it is for sure. Well, Violet, thanks for coming on the show today. Good to get to know you in the virtual world and maybe perhaps at some point we'll all get to meet in the real world.

Well, thank you for having me.

Have a great day. You too.

Thanks, Violet.