Cyber Insurance Hot Cakes: You put THAT on my Cyber App?

That is such a pleasant intro song.

Too pleasant.

It was not expected. I just picked a random one, um, and it was just so calm, and I was like, oh, I feel like I'm going to the spa now. I need a massage. What's going on, everybody? Um, good to connect with you today. We've got these two wonderful looking gentlemen in glasses today. Uh, Wes Spencer from Empath is joining us, and Andy Runyan, our MSP partner success manager, but also in a suit. And you want to let us know why you're all dressed up for the call today?

I mean, you sent me a text about an hour ago that said, hotcakes at 1 with Wes Spencer, dress nice and don't say anything stupid. So I mean, I dress nice and here are the hotcakes. I mean, is it—

are they good? They look delicious.

Did you make those fresh?

Oh wow, here's the real question. Are you wearing suit pants? Uh, 50 bucks says you're not.

We'll have to stand up.

That may be, that may be the reveal at the end.

Yeah, okay, keep people just trying.

Listen, I just wanted, I just wanted to make you proud, Dad. I mean, well, that's, uh, you know, awesome.

Oh, that's so good. Well Everyone who's joining in today, I don't, honestly, I don't even know anymore if it's— oh, it shows YouTube viewer count now, but it doesn't show LinkedIn viewer count.

And it's never right. The viewer count on LinkedIn is never right. They have the worst API.

I think they got rid of it. I think they pulled the LinkedIn viewer count.

It was so terrible.

It was always, it always said zero, made you feel real special. Um, so if you are in the chat today, I'm actually gonna, gonna pull the, uh, the chat overlay in for now just because it's fun. Um, say hi, let us know where you're tuning in from, and, um, We are really pumped here to take some time to talk about, well, an application, which is always fun to talk about. Cyber insurance applications. One of the things we always are talking about and saying is that these cyber insurance applications are changing on the fly. They are consistently asking new questions, consistently taking time to confuse us, I think, say, to put it lightly. And part of the, part of the conversation here, reason I'm bringing in Andy and Wes is we want to take a look at this from the insurance perspective, from the, hey, I'm an agent, I can look at these things. And, and I know, of course, thanks Wes Spencer. Um, but, um, also Heath put a comment in there like a split second too soon, right before I opened the chat, and he was really pumped to see that Andy, uh, I don't even understand, but I love it. Um, and he needs to eat meat apparently, so put some bacon on this pancake.

I think it was in, in comment to, yeah, to the hotcakes.

Anyway, I'm bringing in Andy and Wes here because from the agency perspective, I also see Travis is on here, which is awesome. And that's going to be, you know, if you have anything to input on this too, it's really good to look at this from the insurance perspective, but then also from the MSP kind of channel space of when you look at these applications, MSPs are getting inundated with them. I talk with MSPs probably 2 or 3 times a day about how annoying these forms are. And Wilson, who's actually commenting in here about Andy's style as well, brought a, a form to us this morning from Coalition that he got as a response from an underwriter that needed to be filled out in order to provide terms. So we wanted to take a look at that because it is a little different from the one we saw last year, but at the same time We want to kind of just dive in and talk about it a little bit. But before I get into all that, uh, Wes, Andy, what's the weather like by you guys? Because here it's snowing and freezing and beautiful all at the same time.

How do you— can't use those words together, dude.

You can when the snow doesn't stick. So it's just snowing and it's like soft and slow, and then it hits the ground, it's like not ruining anything, not even your car.

Well, I will tell you, yeah, Tampa is in the middle of an emergency. It is also a freeze here. I don't know if it's so frozen your phone screen is white. I had to prove it to you, but apparently it's not gonna— yeah, it's not gonna render, but it's, it's a balmy 73 degrees, so it's getting— wow, wow.

Yeah, we're, we're cruising in at 30 today, which is an uptick from where it has been in Arkansas. I woke up to 3 the other day, and, uh, my children have been out of school for 4 days in a row until today. It's our Friday, is our, our first day, uh, back. I think they went home for lunch, and I think their mother is, uh Breathing a little bit easier today after—

you should have to work through the week, you know, just to make up for it.

Yeah, well, uh, our state legislature is making sure that they go to school well into June. No comment.

It's wonderful, isn't it? Yeah.

Oh, I love it. Are, are you—

are your kids— your kids have been— were out of school for 4 days straight?

For— yes, we had, we had the holiday on Monday.

When was the last time you had snow days?

Yeah, notice we actually the last couple years we've caught them, but we did have— honestly, we had about a 6-year drought where there wasn't more than just a dusting. But we've— last couple years we've caught some decent snow.

Nice. Well, exciting stuff. Um, I'm gonna bring up this thing. Obviously, if you've got comments on the side too, feel free to drop some comments in here to what you're seeing. But we're gonna, we're gonna bring up the There's got to be an easier way. I'm going to bring the— I'm going to take the chat away because you can't see anything with that on. And we're going to kind of talk through what we see here. Um, now obviously the Coalition, the Coalition form is pretty decent to begin with, but as I've had conversations along the lines with a lot of, a lot of MSPs, a lot of times it feels like a, a check yes or no form, right? So you're, you're basically going through, do you have this? Yeah, I have this. Do you have this? No, I don't. You have this, like It's almost, it's almost as if security is black and white. Well, Wes, I know you've talked about this before when it comes to like the security control questionnaires and things like that. Why do we kind of see this, this black and white question approach to carriers? But then MSPs often get so confused about why they can't just like, I can't put yes for this. That doesn't make sense. Have you— what do you see there?

I think there's a few reasons. One is the mind of the underwriter is not the same as the practitioner. Right? So sometimes they ask questions that they just don't know how to ask, um, in a, um, in a way that makes sense. There's just so many yeah-buts or exceptions to things when you're a practitioner, right? Um, you know, well, yeah, I do it here but not there. Um, well, sort of, I do this but not exactly how you're asking, right? And so I know the carriers want to have some absolutes, they want to have some like guaranteed sort of like dictates that they can use in their data science, and it's just It never comes across that way from the practitioner's point of view, right? So that's one of the most common questions we get. They've gotten better at it, but a lot of times, to your point, these yes or nos, you know, they would just love for them to be finite, black and white, you know, absolutes. And it's just very rarely that way when the metal hits the meat, so to speak, right? When the practitioner is actually deploying this, it just is not that way. And so I think that's one of the main reasons. But also, I think the carriers too are still starting to learn what exactly should they ask. They're, they're still not exactly where they need to be in terms of like, well, what's a good question? What should I actually be asking? And I think any practitioner would look at any application from a carrier and say, man, I can't believe they're not asking this and this and this when they ought to be. Well, they don't, they don't know yet. They're still learning.

No, that's—

and that's— I mean, we're, we're only, you know, I mean, if you think about 5 years or a 5-year time period in the history of insurance, that's a blip, right? Like, it's it's a very, very small blip in time. We're 5 years away from cyber insurance applications saying, are you in the marijuana industry, adult film, or casino? No. Uh, have you had a breach in the last 2 years? No. Oh great, what's your revenue? What— how many employees you got? Here's your quote, right? Like, I mean, that literally is where we were at 2019 heading into 2020, you know, before, uh, everything blew up. So I mean, yes, Wes Spencer, 100%. I think there's still, you know, some grabbing at straws. What do we— I mean, we're better than we were, right? We're asking better questions. Uh, we're giving, uh, the applicants more space to tell their best story, and we are sliding away from that binary yes/no in spots. But I mean, we're not too far removed from almost no underwriting whatsoever in the small to medium-sized business space. Yeah.

Um, that's, that's a good point. And kind of one of the things I've observed— and there's kind of two good comments in the chat I want to bring up in a second here— but One thing I've observed, when you think of insurance in like the traditional space, I think auto insurance for a second, right? I always like to kind of come back to that because everyone has auto insurance, or at least has experienced the application process. You don't say, I sort of have daytime running lights, I kind of have airbags. I, you know, it's like either do or you don't. Either they work or they don't work, right? And that's, that is, I mean, even applying for homeowners coverage, like the things are more absolute. You don't run into these, well, it sometimes is this, but it it doesn't apply in this situation. It's usually a lot more black and white. And so this is probably one of those issues where you're seeing the insurance industry butt up against a type of industry that is not black and white, and they're trying to put, um, parameters on it. Um, I like what Travis said here, so I'm bringing this up. Travis says PDF editors make all apps gray. Do you guys mark up default apps and send in explanations of the yes, kind of And yeah, I mean, that's, that's exactly what we always are advising our MSP partners to do too, right? Is either use a PDF editor or open up a text doc or something and just say, hey, you know what, with this is not a black and white question. You need to provide some clarity to the conversation because the underwriters will read it. The challenge is I think a lot of us look at these things and say, that's a form, I have to fill out the form, I'm just gonna I don't know what to do. So it almost like falls apart, right? And this is where the Coalition form is actually interesting to me and why I wanted— one of the reasons I wanted to bring it up is to my count. And I mean, I'm not gonna— we'll look through some of these specifically in a minute, but you can see there's a lot of fill-in-the-blanks here, right? And some like this, number 2, is— is this showing up? Is multi-factor authentication enabled and required for all remote access, VPN, etc.? In the past, questions like this have been check yes or no boxes, just like, do you— back when they first—

do you have MFA?

The question was, do you have MFA? Like, it was this all-encompassing solution that you just turn on and it's just there, right? And one of the things we've started seeing is here— oh wait, this isn't a black and white answer, but they've actually added in a string that the ability to type in a string as opposed to— or in text as opposed to just checking yes or no, right? And this, to my count, there are 18 fields on this app, which is big because that's up from, I think, 11 last year. So there are 18 fields on this app where you can input text as an answer. So this just shows me in one way that carriers are moving in a direction where it says, oh, We're recognizing based on prior feedback, because this is how insurance works, it's all data collection anyway. So based on prior feedback, prior answers, the fact that every time we ask this yes or no question, we get text with it in some text doc, we're going to add this as a text field now, right? So this is, this is moving. Now, I don't know if there's a character capacity or limit on these forms, but at the same time, it's, it's a step in the right direction. What are your thoughts on that, guys?

Yeah, we need, we need this, right? I think one thing that probably makes it a little more difficult for the carriers is now they hear— the reason why I know we all like yes and nos from a carrier perspective is it's the input they get is absolute black and white. Is it yes or is it no? So it makes it way easier to probably do automated, handle the automation of underwriting, right? It makes it much quicker. But now I think their hand has been forced. They've realized the ambiguity that does not allow for a yes or no forces more of these fill fields. But that means somebody's got to actually be reading these and actually interpreting what it means. Right. So what happens if someone on this one, on question 2, says yes for VPN, but we do have some cloud, you know, stuff and one of our vendor line of business applications can just remote right in. You know, we have no control over it. That's valuable. But now an underwriter actually has to read that and figure out, well, what does that mean? What level of risk does this present? How do we actually affect and what do we do about that? So I have to imagine, Will, it raises their administrative costs quite, quite a bit. But the question is, does that reduce the loss ratios overall? Because now they're getting better data coming in since they're forcing you to form field in, right? So, so, you know, it's sort of a tradeoff here between the two. I still think, you know, we'll probably get to this later in the livestream. This still is not the right answer from the carriers. Like, this is probably better than hard black and white yes or nos that are ambiguous from the get-go. But I think a better way to do this is being able to read into a lot of data inside the network so you don't have to ask so many questions. So, yeah.

Yeah.

And the thing that I like about it, having been in the retail or on the retail side of insurance, you know, for 5 years, and, and starting to specialize in cyber back in 2019. I was kind of at the ground level as this stuff was, was evolving, right? Um, you know, there was a day as these apps started evolving from those 2 or 3 questions where we started getting a list of 8 to 10, right? And there was this checkbox, yes or no. And I personally never did, but I know my competitors did, you know, uh, where, you know, the, the onus was on the agent, and, and the agent could just go through and go, yes, yes, yes, yes, yes, yep, we do all this stuff, absolutely, here's your quote, right? And I mean, I sat in consultations with, you know, $40 million manufacturers that needed, you know, really, really refined coverage. And I mean, I asked them, who did you fill this app out? What do you mean? Well, this quote that, you know, this competitive, this competitive, you know, quote that we're talking about here, you've attested to some things here and said that your network is in this position Who filled that out? You know, so as we move to more detailed questions, um, like I said, it's not pro— it's not perfect. I think, Wes, I think that's a, a great point. I mean, I think there is maturity and I think there is room to grow, right? Um, but being able— asking more detailed questions that beg more detailed answers kind of takes the power away from the, the lazy agent who's sitting on the retail end and wants to just click through and submit for the for the client.

Yeah, that's a good word. And what— here's a— sorry to block you out there for a second, Andy, on the livestream, but Travis takes over your face. Um, Travis says, do you think underwriters actually understand what the heck your MSPs are putting in those blanks? And I would say no, and that's the point as to what Wes Spencer was bringing up before, right? Now, this is not to dig at underwriters. Actually, one of my best friends is an underwriter at at a cyber— I'm just gonna say a cyber insurance carrier. That's all I'm going to say. And he has actually personally taken a ton of time to understand what these security controls mean. So he's not just like looking at these black and white forms and saying this is what they are. At the same time, to your point, Wes Spencer, this is where I think the evolution of the cyber insurance industry needs to go, is that when you start to have that internal data reading, they need to start put— the carriers need to start putting things in place that base policy underwriting off of what that data says, not off of some form, black, black and white, check yes or no box or some comment fill-in-the-blank form, but actually real hard data that says this is what this is. Right. And I think— and then they have to have— this is, this is the challenge, right? We can, we can create the software that shows the, the data and what's going on inside, but it's on the carriers to adapt it and create their to build their, their underwriting guidelines and standards around that data and what that data actually says, not off of the old outdated insurance industry. And that's the, the challenge I think here that we're seeing in the evolution of the cyber insurance space. But it has to be moving that way.

Yeah. The reason we, we need to shift towards automated underwriting that doesn't— that does require input from the human, but much less than we currently have is Let me make an analogy to auto. Let's say from the carrier's perspective, they were dealing with auto insurance and you could choose to turn off the backup camera. You could choose to say, well, I have lane departure, but I'm actually just going to turn that off completely. And I forgot that I turned it off. What if I have blind spot monitoring and anti-theft and all these things that I have in my car, but I can actually turn those things off or they just stop working and I don't really know about it. If that had happened, you know, 10 years ago when a lot of this technology is really becoming standardized, carriers would say, well, we need a way to know when that happens because now that vastly changes. If you're not using all this great technology that we have built in, how do we know that this car is as safe as we think it is? Well, that doesn't really happen in auto. That doesn't really happen in, for example, as I insure my home and wind rated, that doesn't change. My roof was built in a certain year. That doesn't change. But cyber by nature can change the day after. And so this is where I think the carriers are recognizing, wait, cyber is just in a different bucket than a lot of other things. And I do think we need to have some ability to be able to understand what's changing within the year of coverage. And we just— that right there, I think, has been the wake-up call for carriers to really see over the past few years.

It's huge. And to that end, right, you have— you effectively have carriers who are looking at something that they're trying to, trying to understand just from information that they've recently— I'm trying to— I'm verbally processing all over the place right now. Pause. So when you have carrier apps, right, this is what I've seen is because the insurance industry— and this isn't going to change— but because the insurance industry is based on data collection, so previous data, past data tells us future results, it can't keep up with the cyber industry, right? And so unless they can implement a solution that says real-time data is pouring in here to tell us what's going on, then it's just— when we see tech, tech is exponentially changing, right? So you, you could maybe keep up for a year or two, but eventually the tech industry, cyber industry is going to get here, and insurance is only going to be about here because it's not— it's trying to scale linearly where tech is and cyber is scaling exponentially. So I'm running— I'm seeing those problems there. Now, this goes back. Now, if we take a step back, because I think this is where we can— because we're kind of speculating into the future here. What about on— and if this blocks Andy, I'm going to take the question away in a second. But this question says, yeah, it does. What's with this?

There we go.

What's with the specific product question? So I'll take the question away and I'll just kind of scan it on the form here. Um, here's on the first one, they ask, do you have EDR? And they give you a couple examples, but then they say, if you do, which EDR tool do you use? Right? And they're asking other questions on how many endpoints are being used, um, are being covered with EDR. Um, then they have another one, do you have— question 4, what processes or controls do you have in place to ensure that all endpoints in your network are updated with critical security patches? What software is used to perform this function? Right. So, and it has that on other questions here too. So I guess that's what I want to talk about here, Andy. So we have questions that are asking about specific products. Now, do carriers really care about what specific product you're using? Because a lot of MSPs come to me and they say, Will, can you vet my stack and tell me if my controls are good enough for the carriers?

Yeah. And the honest answer, the quick answer to that is no. The more detailed answer is no, not yet. And I think, I mean, we talked about this yesterday when we were on the fireside chat with Huntress. You know, I think that where we're moving towards, and I think that's a toe-in-the-water question, right? Like we went from, do you have MFA, yes or no, to where is MFA implemented, right? To where is MFA implemented and which MFA are you using?, right? And I think that's a toe in the water question, um, that we're gonna start seeing carriers prefer. Uh, Travis popped in and said, @Bay is legit declining due to certain brands of EDR. Um, you know, that, that's something that I think that we're gonna see more, um, of this year, right? Um, we haven't seen that as much in the past, um, and I think you're going to start seeing some delineation between either premium breaks or declinations like Travis brought up, that you're gonna— they are gonna start caring. It hasn't been historically that big of a deal, but I think 2024 is the year where you're gonna see, like I said, I mean, Heath is in the chat quite a bit, you know, is there a difference between, you know, Microsoft Authenticator, Okta Duo, or a passwordless solution? Like what Heath and his team offer at Tradeware, right? Like, does— is, is a carrier going to step up and say, hey, the CISA recommendation is passwordless phishing free, you know, we're going to give more credit, or we're going to say that this type of solution is more preferred than the more basic? Um, you know, we can't speak on behalf of the carriers, but I do definitely see— to, um, uh, to Travis's point there, I do definitely see a direction where, uh, we're moving from no, they don't care, to they're starting to give us more feedback.

It's fair. Now, there have been instances— to Travis's point— now, there have been instances where we've seen declinations and we've been able to reach out to underwriting and actually explain about the EDR solution and the platform and have actually been able to turn that declination into an acceptance. Now, I don't know how— to Andy's point— I don't know how long that's going to be a reality, um, right? But It has happened. So a lot of times carriers are declining because they have like, I know at Bay, for example, they have their list and they're like, these are the carriers that are not carriers. So these are the EDR providers that we want to see. And if we don't see them, especially for certain risks, we're not going to accept this option. Right. And here's the, here's the challenge, right? Because you have— and Wes, maybe I can toss this one to you a little bit. We have so many MSPs who are asking us to tell them whether or not their, their solutions are good enough for insurance. And that kind of creates this weird, like, recommending vendors versus other vendors, and it makes the space very interesting. And we kind of try to stay away from that and say, hey, you, you bring the solutions, we're going to try and get you the options we can. Now, again, because you have so many carriers out there, just because AppBay is declining something doesn't mean that every carrier is declining it. And it's just those conversations too, but What are your thoughts there on specifics?

Yeah, I think there's always been a question in our industry around what we call control effectiveness, you know, which, which vendors are better than others. Now, that's a nuanced question, but the reality is there are some vendors that are better than others. I'll just give an example that won't, won't step on any toes. Huntress is better than Norton Antivirus, period. Right. You know, Black Point is better than McAfee, right? Everyone would agree with that. The question is that sometimes people want to know is, well, who, who is the actual best? Right. And unfortunately, that question can never really be answered. And nor, I think, should it be answered because there's too many nuances that go into play there. I could have a top-shelf, you know, enterprise-grade EDR and still leave it on detect mode only. And there's no kind of automated prevention at all. And I could still get hosed. I could have an awesome third-party SOC that's looking over and send something my way and I choose to ignore or mishandle. So there's a lot of nuances that go into it. But I do think over time, one thing that is valuable is the carriers coming back saying, look, you know what, we've had 28%— I'm making numbers up— 28% of losses that were in EDR was involved and could have been effective. And we noticed that 28% of those was XYZ vendor, not so good. I actually welcome that. If the vendor themselves is going to say you should pay me money to do this thing, there should be a control effectiveness there. I'd love to see a day in which some of that data is actually passed forward, and I'd love to see the carriers wash their hands of it and say, we're not saying this vendor is better than others. We're just saying from our perspective, we've seen less control effectiveness by Vendor A than Vendors B, C, and D. And this is, I think, what Travis is getting at is some EDRs may just sort of be like, no, we're just not going to— we're not going to be in that habit, right? We're just not going to accept these because we've seen too much risk on our end. And ultimately, at the end of the day, can you blame the carrier if the carrier is the one that's shelling out money out of their own— out of their own policy to handle this? I mean, it's their prerogative. So, so I think I understand where we're coming from. And we've been asking for control effectiveness from the beginning of time. The last thing I'll say, I've got a friend that's a— was a red teamer. So that's like someone that actually like plays the part of a bad guy, so to speak. It's sort of an offensive look inside a really, really, really, really big household name company based in New York, New York that might own an exchange of stock. And he had a job where he was basically testing EDRs and he's like, I can bypass every one of them. But absolutely there are some that are better than others and I won't say which ones are which. No, that's But there are. And so we want to know those things. And unfortunately, we don't get a look into it because we're limited to what marketing tells us. We're limited to what everyone blasts Reddit for, you know, and that's, that's not what we want. That's not what we need.

I think you said something in there, too, that I want to circle back to. You could have an EDR solution where the solution implemented is not taking full advantage of the solution offered. In the sense that, oh well, you could do this, but also this EDR platform actually has the ability to do all of this and you're only doing this, right? And so even from the— from— I see kind of two pieces here. You could have skewed data because a solution isn't being implemented to the extent it can be. But also on the other side of that, this is an opportunity just for the MSP side. If you're an MSP listening in, in terms of maturity, Like, this could actually affect your client's ability to be accepted by insurance carriers if you are not taking EDR to the fullest. I mean, Travis put another comment in here. Travis, you're just throwing all the, the hot takes at the hot cakes, uh, this, this afternoon. But you had a client switch from Huntress to AVG Free, right? And if all you were using Huntress for was their antivirus and you're switching over to AVG and that's just the next-gen antivirus piece, This is, this is the thing though. If you're leaving the security in the hands of a client who doesn't truly understand the security themselves, you could run into issues. Oh, I was using Huntress for antivirus, I'll just use AVG for antivirus, it's free, I'm good now. Um, that doesn't necessarily mean that they're getting the best option out there for the, the security maturity piece. And that's one of the things we always want to bring together here, is that cyber insurance is an overall part of the cybersecurity strategy. So to see cyber insurance as you just need to check these things and you're good, versus are you actively taking a stance where you are fully protecting yourself across the board? That's where the difference lies, right? And I always like to circle back around that because I do think it's important that we touch on that. So to that end, there's, there's something else on here that I'm gonna bring up. Not gonna say it's, it's like trying not to muddy the waters, but Wes is here so he can do it for me. Uh, there's a question on here specifically under Network Admin: Do you have any endpoint management software exposed to the internet? Kaseya, etc.? Lots of options there. Um, so yeah, Wes, what's with the, uh, what's with the Kaseya question? And does that mean EDR? Does that mean RMM? What, what are we looking at there?

Right, this is an example of, you know, if the carriers want to reach out to me for like proofing, um, I'll charge them, you know, a very low price of $100,000 per review or something because this is a great example of some ambiguity that's their fault. So I would tell the underwriter who wrote this, you know that Kaseya is a company, not a product, right? And Kaseya, by nature of them being a $6 billion to $8 billion business, does not just sell Kaseya. They sell a bunch of stuff, right? A whole bunch of things. They even acquired this public publicly traded company called Datto who has a number of products themselves. So like, you can't just say Kaseya, like you can't just say Microsoft. So there's a problem right out of the get-go. But what they're referring to is Kaseya VSA, and VSA is their RMM, and baked into the RMM is Remote Connect, remote control, all that kind of stuff. Um, all the other companies have the same things, right? Like ConnectWise has Screen Connect, it's separate from their RMMs, but many of them have some kind of screen connect, and that's really what they're, they're talking about here is like endpoint management. So it could be the RMM, It could be the ScreenConnect type of tool. It's anything that can affect the endpoint that you can access from the outside world. Heck, you could even argue Roost is in this bucket, PIA, others, right? Like anything that has the ability, you could make the argument that many EDRs have this capability. There was a while back, if I remember right, it might've been Webroot, but one of them actually had a big compromise because they were able to leverage scripts being written from the EDR, from a response capability. A bad guy got access to the panel. So where they're coming back with Kaseya in particular was, you know, the big attack that had happened on July 4th a few years ago. That's why they're mentioning Kaseya by default. But I don't think they're selecting and singling Kaseya out, nor do I think they're saying that Kaseya is no-go. I don't think they're saying that at all. I want everyone to hear me saying that, that no one on this webinar is like, you know, it's only Kaseya. No, no, no, no. I just think the underwriters didn't do a great job. What they should have written was, do you have any endpoint management software exposed to the internet, such as an RMM or a screen connect utility? And then they could say such as Kaseya VSA, ConnectWise Screen Connect. You know, they could do something like that, right? But that, that's where this is coming from in particular, this question. I'm sure of it. It just really wasn't well-worded. And I've seen a number of questions in this, in this application have not been really well-worded. So there you have it.

That from the IT, from the cybersecurity mouth, right? And then Andy, on your side, because that's really helpful, Wes. On your side though, is this Coalition's way of saying, hey, if you do have anything like, like what Wes just brought up, is this is talking about a massively broad range of products based on how they're asking this question. So based on that, are you seeing carriers say, hey, if you have anything that is exposed to the internet, we're not going to provide coverage? Like, what's going on here?

Um, you know, first of all, the folks listening need to understand that the carriers all kind of have their own autonomy to do their own thing, right? So don't want to paint with a super broad brush, right? But what we, what we're seeing is, is not just— I mean, yes, to Travis's point earlier, I mean, we, we will see denials at times, straight up denials, but more than that, sublimits on certain lines of coverage, right? You may see, if they get something that they don't like, you may see a ransomware sublimit. Right? If you aren't, for example, if you aren't doing security awareness training— I know I'm shifting a little bit here, right— with phishing simulation, you're going to have some limited coverage for crime, right? So it's part of it, yes, can be we're not going to accept this risk. More of it is becoming, I feel like, we'll accept it, but we're going to accept it under these terms. Right? We're gonna, we're gonna write our own playbook on what we'll cover, what we won't. And, you know, uh, we're going to cover, uh, you know, our tail, uh, by sublimiting or excluding these certain coverage. But you still have, you still have cyber insurance. So that's where it becomes extremely key to have somebody like Wilson on our team who's sitting there calling that out and not going, here's your quote, do you want it, right? It's like, okay guys, um, here's a quote from X carrier. And by the way, because you aren't doing phishing training right now, you don't have cybercrime coverage, right? Because you don't have multi-factor authentication on, you only have $250,000 of ransomware coverage when the average ransomware claim in Q4 of 2023 was $840,000, right? Um, it becomes extremely key to have somebody who's fluent, um, in, in both the controls and the coverage to link those two things together.

That's huge. Um, and, and you mentioned something there that, um, I want to make sure we circle back to, um, that you have carriers who are asking these questions, right? They're going, they're going through these conversation points. They're, they're looking at, um, their past data. I'm going— always coming back to the past data, right? And my mind goes to kind of what we talked about on the Huntress webinar we did yesterday, remember? Like where Reid was bringing up, um, he, he mentioned that, and I think Becky asked a question where she said, so is there, is there kind of continuity across all the carrier recommendations and requirements? Like, is it, is it, is there like a, and we had that whole joke about like the secret society of insurance carriers who get together, the cobble, cobble of insurance, cabal. Yeah. Um, so But this is a good example, right, where you could have a declination from one carrier where another carrier won't mind. Um, when you look at the data across the board, the data at some level is going to be consistent because the experience and the way that these different security controls interact and work, theoretically carriers should come to similar conclusions, which we have seen. But you're going to have different appetites across the board, just as you have different appetites with industries. You have some carriers say we're never touching schools, we're never touching municipalities, You have other ones who say, bring on the municipalities, we love them, right? So, well, love might be a strong word, but we, we'll take them.

And so it's like, I think anybody loves municipalities right now.

My dad does, but that's because he works for the government. But anyway, um, local government, we like them. Um, but anyway, it's that mindset where carriers— I love what you said, carriers have different appetites. So you can't look at what one carrier does, even a coalition app, you can't look at the coalition app and now paint that as the reality for every carrier. But one of the things I love about seeing here is they are at least evolving the applications. We're not looking at an application from 2020 still, right? So we see kind of movement forward. Um, Wes, before, before we wrap up, because I think this is— there's actually two things I still want to talk about. This question 5, because we get a lot of concerns from MSPs, a lot says Briefly describe, briefly describe your— this isn't highlighting right— your IT support organization and divide— identify any MSPs or MSSPs you use. If outsourced IT vendors are used, describe the vendor types, functions performed, yearly cost approximations. If IT staff in-house, describe the organization structure. So now they're asking more and more specifics about MSPs too. And there was this point where MSPs were like, I don't want my name attached to this application. Like, what What's the— what's, what's going on here?

Yeah, uh, again, I, I really think this one is a data gathering question. I think Coalition's really trying to figure out what's the nature and scope of MSPs, MSSPs, and the relationship. I don't think that at any point they're saying that's a bad idea. In fact, if they think that, they're making a mega colossal huge mistake because if it's not for awesome MSPs and MSSPs serving the SMB industry, they're hopeless. You might as well just give up. So I think, and if I'm wrong on this, then the carriers are even more wrong, that I don't think that Coalition is against MSPs and MSSPs. They're just trying to understand the nature of the relationship. And I think what's the natural evolution, what's going to come out of this is that not all MSPs are the same. Carriers tend— I think over the years they've tended to think all EDRs are the same, all firewalls are the same, all log retention is the same, all BDR is the same. They've learned that's not the case, which is why they're asking what EDR are you using, right? They're also learning and going to learn that not all MSPs are the same. If you guys don't know Kyle Christiansen, go look at his LinkedIn. Yesterday, last night, he had a post. He was working with an MSP friend of his. It got popped. And the reason it got popped was the line of business application provider there. I think their SQL password got busted by a bad guy. And they got in through that. And that's an example of like that. I'll just say it, that's a known issue that should not have happened. Default passwords are covered in CIS controls, which, by the way, Heath way down mentioned that. I want to get to that before.

I know. I want to bring that up before we wrap up.

Yeah. So, so those are things that should not happen. So there's not— MSPs are not the same. I've never met two MSPs of the thousands I've met over the years that are the same. And so, so I think they're asking that question, Will, to really gauge Who is the MSP? What's the nature of this MSP? How much are they covering? And let's get an idea of what all is in the tool stack at a high level. But again, it's a very ambiguous question. And once again, another example of a question that shouldn't be asked. It's a question that should be ascertained. You could do something as simple as a vulnerability scan and if some API connections and really actually gather all of this data without even having to go ask the question and risk mistakes, risk omissions. So this is again another question that I think is good in the heart of it, but poorly implemented. But I think the other thing they're trying to figure out too is what's the structure here, right? If you're saying, oh, we're doing this all internal and you're a $45 million business and you've got an IT headcount of 2 people, I'm sorry, that's not a real good— I'm just not real excited about that from a carrier perspective. Andy, what do you think?

No, no, that's— I mean, that's where I was going with it. And I appreciate your, your you know, standpoint and your angle, because it's 100% valid. But I'm sitting here as a southerner that knows what large revenue businesses are doing in Arkansas and Texas and Mississippi, and I'm going— I'm reading that question a little bit differently. I think I'm reading this as lowest hanging fruit, right? Are you, are you an $80 million car dealership that has 5 rooftops that has no MSP, and your internal alt-IT is also in the back you know, working on engines part of the time, right? Like, I— because I've seen that, right? Like, I mean, that's, that's not a hypothetical. That's a, that's a case study with names being protected, you know, or names being withdrawn to protect the innocent. So I read that as they're looking at revenue sector, and if you're high revenue, very, very commonly attacked sector, and you say, yeah, we don't have an MSP or an MSSP, we just do this internally, and we do it with 2 people or 3 people or 1 person right? That's an immediate denial for me. I'm walking away from that right out of the gate. So no, I think, I think everything that you said, Wes, I think— I mean, yes, 100%. I think they're trying to gather data. I think they're trying to get an idea of what's going on out there. But I think that's also one where they're looking at, uh, revenue sector and some of the, the larger questions and going, are they properly addressing this with the right amount of people and the right professional relationships?

Yeah, that's, you know, I, I like this because it— to, to be fair, the question, and you both brought this up, the question doesn't just ask about MSP. It basically is a question that says, describe your, describe your cybersecurity services, right? I mean, that's, that's literally what it's asking. Do you use outsourced? Do you use internal? It doesn't matter. They're asking the question. They want to know what's going on. So there is the data collection, but I think there is the, the teachable moment here we always want to come back to. Um, and Wes, you said it, not all MSPs are the same, right? So what are you doing as an MSP to establish yourself as one of the greats, right? Because, and this comes back to that point I made, that cyber insurance is not a box to be checked. It is part of that overall cybersecurity strategy. And carriers are even looking at it now and they're saying, oh well, cybersecurity is really important and we're not even gonna provide a policy unless the security itself is not just good, it needs to be optimal, like optimal in our eyes, right, in the carrier's eyes. So that's, that's just this piece where are you establishing yourself as an MSP who does not, you know, the bare minimum and these pieces of flair, right? Um, are you doing the bare minimum? Are you doing things to actively mature your clients? Are you doing things to make your clients more secure, help them understand what the security thing's all about, help them identify exposures and gaps, make them aware of what's going on? We had a whole conversation yesterday about— in, in our webinar we did where one of the MSPs on, he's like, look, as a professor and as an MSP, I can tell you not everyone wants to be educated. But at the same time, I pushed back and I said, look, I was a math teacher, I was an algebra teacher. My students 100% did not want to be educated, but guess what? They had to be. And we had to work through it and we had to teach it and communicate. And here's the key: communicate the subject matter in a way that they will understand and they'll be able to consume. Assume, not in the way that you learned in, in your licensing course or in your books or whatever it is that you— your approach to, to the business was. We got to learn to translate that, and that's, that's the challenge and stepping up to the plate. I don't know, Wes, do you know anybody who can help with that kind of stuff? I don't, I don't know if anyone— if there's any businesses out there that help MSPs become educators.

But anyway, yeah, I mean, if only there's some elephant company out there that was making their mission to literally survive or die on that mission —means would be, would be super helpful. Yeah, it'd be great. Someone ought to think about that. Yeah, yeah.

So we have about 15 minutes here. Um, the Coalition— we want to go over that Coalition form, but there's a couple of other things that came up, questions and comments in the chat I want to make sure we get to. Um, so I'm gonna hit Heath's here, and then Wes, you said you had one, and then we'll come back around. Um, but Heath brought up— he said— and Andy's not blocked, hooray! All right, what is the thoughts of— this is actually really long, so I'm going to read it from the actual thing. What is the thoughts of underwriters using frameworks like the CIS Controls to make their applications too. So, I mean, he's going into some other content here, but specifically Matt Lee is working to help validate solutions that map to those controls, which would help underwriters and clients map how businesses meet the application. But frameworks and cyber insurance underwriters, where do we see that merge happening? What are your thoughts there? Because I have some comments, but I'll let you speak first.

I'll jump in first. I don't know who this Matt Lee character is. He sounds real shady. Yeah, just kidding. Matt's a great friend.

Great hair though. He does.

He sounds like he's probably a guy that has a great beard too, is what I would guess. So Matt's a real good friend of mine. We've talked about this many, many times, and I'm glad he's taken the leadership. He's basically said, I'm sick and tired of this, grab the bull by the horns. And I'm so glad he has because no one else has taken the leadership and initiative like he has. So it's sort of this idea of we have the CIS Controls, which are very control-focused, hence the name CIS Controls. When we say controls, we're dealing with like some kind of thing that exists in your organization that functions in some way. It doesn't have to be like a paid vendor product. It could be things that are like native inside of Microsoft, right? But basically it's this effect of like, what are these controls that exist that can, can formulate best practice in an organization? Well, if vendors have something to sell that's valuable to us in security, it should align to those controls somewhere. Otherwise it's sort of like, well, why am I buying this thing? Thing. It sounds like it's vaporware or snake oil. And so Matt's taking this idea of, I'm going to talk to all these vendors and I'm going to really work deeply and hard to understand what do you do, vendor, and where do you meet. And it might be that the vendor does a little bit of this, a little bit of this, a little bit of that. So like you take Cyberfox, for example, very heavily involved in CIS Control 5, but there's a couple snippets of Control 4 they help with. And so Matt's kind of like, I'm going to take a vendor, I'm going to understand what you really solve for and where do you solve it, and then How do you solve it? There's a lot more that goes into this, like the Cyber Defense Matrix. If you guys have never seen that book, I always just have it right here. But you can also bring in the Cyber Defense Matrix to kind of understand like where does that control help? Is it on the network? Is it for users? Is it more application focused? So it can ask those questions too. But that's what Matt's doing. He's building basically a catalog of all of this. Now, that brings up the question that Heath asked, though, is Can't underwriters just take that and say, check the box now that we know once the sort of the Rosetta Stone that Matt Lee is creating has been complete? Unfortunately, no, because the thing we're still looking for is control effectiveness. You may say you have MFA, but how do we know it's rolled out everywhere? You may have an EDR, but how do I know you have the competency to respond to an incident that comes up? And so this is where I'm not hating. We need, we need what Matt's doing. We need the CIS controls., but we also need some input into control effectiveness because the carriers still don't have that answer. So enter, in my mind, this is why I think what CompTIA is doing with, um, uh, check, uh, what's it called? Um, the Trustmark. Why Trustmark is so valuable, because Trustmark actually has an audited pathway coming across, and we've had someone actually look at this. It's CIS-aligned. To get Trustmark, you have to do these things, and then an auditor is going to come in and check. Does that mean that it's guaranteed certified? No., but it does mean we've actually looked over this and we've assessed that control effectiveness is in place. And so that to me is the gold standard. It just in terms of maybe setting the minimum. And so I would love to see a carrier one day come out and say, you hand me a Trustmark certification, I'll hand you back attestation, and I'm happy to work through, you know, that basically handles almost everything. There's still some things we got to ask, but largely it handles everything. That's where we need to get in this industry. Plus, the idea of underwritten, uh, automated underwriting. We can send a couple APIs in and really gather what's going on behind the firewall.

Yeah, I think that's the perfect standardized language. Let's throw that in there too while we're doing our, our, uh, Christmas. That'd be nice. Yeah, where 5 carriers don't call the same coverage 5 different things.

Yes. Can I make a super quick point on that? That's been the poison of technology. And, and one of the best— when we deliver rapid growth in, in, in, in an area of technology. It's one of the reasons because we've standardized the taxonomy of the language, right? Like, IT is good at this. If I say I want a GPU and you give me, you know, a hard drive, I'm going to say no. I know what all GPUs are. I— because it means something. The language means something. We've done a terrible job of that in cybersecurity. Really terrible job. You know, an EDR, I think, means something, and XDR a lot less. And now vendors are coming out with ADR, advanced detection. It's like, quit, just quit, just stop it. When I'm like voted dictator, I will throw you off the helicopter if you use a term that has no meaning that you just made up to go sell something. That's not okay.

Yeah, no, it's— yeah, you see it with, uh, I mean, EDR is a really good example. You see it with— I mean, we love to talk even, even in the practices. This isn't even a product you're buying. Just QBRs, and then you have XBRs, and you have TBRs, and MBRs, and like, just don't have to come up with your— like, everyone wants to be creative and come with their own acronyms and all that fancy stuff. But, um, you know, to, to that, I want to go back to the CIS real quick before we jump into another question. One of the things we're seeing, and because carriers are basing— and I bring it up every time— but because carriers are basing so much of their underwriting requirements on past data There have actually been— there are carriers who are requiring more often than what is actually required by another compliance framework because they're adapting quarterly, monthly, what they're— and it's not, it's not crazy more, but I mean, my example I always come back to is CMMC, how CMMC Level 3 is an insane amount of controls, but their requirement on— their requirement on backups isn't less defined than a carrier's. Their requirements on patching solutions is less defined than a carrier's. So you could be Level 3 compliant for CMMC and a carrier might look at your particular risk and say, no, it's not good enough. And that causes a lot of chaos, right? So Keith— or sorry, Heath, to your, to your point, I would love to see more kind of synergism between one of these frameworks and carriers. But there's a lot in the cyber insurance industry that needs to kind of adjust and continue to shift before we start to see that alignment. And part of it does come from what Wes was saying about having the right, the right terms. And Andy saying, you know, having kind of synonymous— not even synonymous, the same usage, standardized terms across the industry, it's going to be really helpful. So Wes, you said there was a question that's not popping up in the chat here.

Yeah, Greg asked a really good question. And I think, Andy, you'd be best to answer this. Is it a myth that businesses can get a premium reduction for implementation of good cybersecurity controls? I've watched over the years as my clients move from no MFA, no EDR, no privilege management to good clean practices that are monitored and enforced. But I've never seen a premium reduction for it, not personally. Is there any recommendation for how to approach the carriers for requesting that type of premium discount?

So, um, and I'll try to be brief and, and not talk for 30 minutes on this, right? Um, the short answer is yes, 100%, there should be. Um, there's a lot that goes into that, but particularly around multi-factor authentication, right? There are other things that can get you premium cuts, but I mean, Wes, let's, let's use an example. Like, I know you're a Kentucky boy, so you're familiar with rural hospital systems, right? We worked on a rural hospital that they came in with no MFA anywhere, no security training, nothing. And we ran them through loss quantification and we were like, guys, we really think that you need somewhere between $4 and $8 million of insurance. And they were like, how about $5, right? So with no MFA, we took them out to the market. The only quote— there was one quote, one market— it was $141,000. And major sticker shock to the organization, right? They come back and they're like Andy, there's no way we can afford this. So we set a plan for the next year, and it was, okay, we're going to take $2 mil to bring down the premium. We're going to raise the deductible to bring down the premium to get you in the door. Let's get— within a year, let's get MFA on. Let's, uh, develop an incident response plan. Let's start training our people. Let's have a year without losses, and let's take clean Rosser runs and all of this stuff back out to the market next year and see what we can do, right? The next year With all those things implemented, the same $5 million in coverage costs $54,000, because that is an $87,000 reduction in premium. So to his point— yeah, I mean, to the question, yes, it can happen. Why is it not? And this is where— I mean, Wes Spencer got a little testy earlier with one of his responses. I'm going to get a little testy here. Let me tell you why it's not: greedy retail agents. Period, end of story, right? They— what is the incentive? If I am incentivized, if I'm paid based on commission, what's my incentive to keep you at 54 when I can get you to pay 141? That's a few less rounds of golf that I can play this year, right? So I mean, and again, I mean, I'm wearing a suit today. I was joking with my wife when I was walking out. She was like, what in the world are you doing? I was like, I'm trying the insurance. I've only been doing this for 5 years. I'm still trying to figure it out. Isn't insurance about wearing a suit and using big words and playing golf and trying to, trying to get people to pay more than what they should. So to that point, the history of insurance has been, oh guys, hey, you know, it's a hard market. Y'all seen all this stuff on, on TV about ransomware and in the news? It's $141,000 if you want it this year. No, it's not $141,000, right? It's MFA, it's train your people, it's get an MSP, it's get an IR plan. Let's go back out to market. Let's make sure that we get multiple carriers competing against each other. And let's drive this thing down to where it's manageable and you have a full policy, right, with no sub-limits, uh, with, with the, uh, you know, the, uh, the limits at the top end, the aggregate limit that matches your exposure. Really good question. Really good.

Yeah, I think, uh, on that point too, where you start to see the cost savings, because that example you brought up, Andy, I mean, that was a big company. I mean, they had high revenue. Um, their industry is one of those more difficult, tougher-to-place industries. When you start to run into particular industries and particularly high revenues, that's where you begin to see the security solutions really start to, to kick in the cost savings. I mean, if you're a, a million-dollar company and you're putting MFA on your endpoints, which is you, you might save, let's say you saved a percentage, but that percentage isn't going to even be noticeable at all versus $150,000 premium and you're a massive business. Um, and on top of that, uh, the, the cost and the premium— the premium cost in general every year has kind of trended upwards, at least until last year. You didn't even see any like premiums that are kind of the same across the board. And that's been part of the, the bigger challenge there is you might have not seen actual cost savings because you're like, wait, their premium stayed the same, but that could have been cost savings. You just have no way of knowing. And that's the challenge, is, is, um, Travis put a, a comment in here, keyword, which keywords take it out to the market, right? And Andy said lazy agents, or agents who don't want, who are more concerned about making a buck than making sure what's right for your client. If you're not taking this to market every year, you have no way of knowing if the cost is being saved. It's pretty rare that you're going to get a policy from the same carrier a year later. It has happened, but the same carrier a year later with the cost going down— I mean, I'm thinking of my auto policy. Unless I do something really tangible, it's probably the same kind of pricing across the board each, each year, right? I mean, that's what I'm running into, or it goes up a little bit. But if you shop it out to another carrier, all of a sudden you save money. And that's really what we need to make sure we're doing. Um, so any other, any other thoughts, questions here, things?

There was one that came through. Yeah, one that came through earlier going back to the apps, because the apps were kind of the onus of everything. Travis asked about what exact advice do we give MSPs when they're helping their customers fill out apps. And I get this question a ton, right? In my role, uh, you know, I'm the MSP partner success manager, uh, palindrome anyway, um, but that's like what that, you know, in that role, I have MSPs come to me like, Andy, should we really be filling these apps out? What I always tell them, right, um, reality is somewhere in between, right? You don't want non-technical people filling out non-technical questions because they're gonna lie, right? They're either gonna lie on purpose because they go, yeah, we have it, yeah, yeah, yes, 100%, because they want a cheaper premium, right? Or they're going to lie out of ignorance and to quote Randy Black, former defensive coordinator at Cabot High School in Arkansas, ignorance doesn't mean stupid, it means you don't know, right? So don't take offense to that, they just don't know. I've had a $120 million manufacturer before say that they backed up every 30 days, and I called as soon as I read that question. I called the MSP and I said, blank person, what in the hell are y'all doing? And she was like, um, what are you talking about? And I said, y'all are backing up once every $10 million in revenue? And she goes, Andy, I back them up twice a day. What are you talking about? We would never back a business that big up every— we don't back anybody up every 30 days. And I went, that's what they put on their app. That's what the carrier is going to rate them as. Right. So, you know, if the MSP is— first of all, it is not a final attestation. The MSP needs to understand that if they choose to fill that out on their own, it's not their wet signature on the app binding cover. Right? So if they want to fill it out on their own, they can. If they're uncomfortable with that, the easy suggestion would be fill it out with your client. Sit down on a call, um, you know, go sit down with them in their office, walk through the app, talk to them about it, right? And do it together. That's, to me, that's the ideal scenario, is for you to walk through it together. Bill them for it. 100%. Listen, I mean, MSPs are always looking— I mean, I hear daily We're looking for positive touch points. We're looking for ways to show up and not be creepy or salesy or whatever, right? Okay, there, find out when their insurance is coming up, holler at them 90 days out, fill out a map with them, and bill them for it. Yep.

Yeah, and to that, I mean, bill them for it. And as an MSP, it's an— it's a touch point, right, with your client. And that's huge and important, um, that you're now coming around. And, and here's the challenge, and Andy brought it— hit the nail on the head. Find out when their expiration date is, and you take charge on that. So reach out, hey, your policy is expiring in 30 days, 60 days, whatever you want your cadence to be. I haven't seen that app yet. You got that app? Because we gotta, we gotta go through that. Um, but the challenge, and one of the things we, um, we run into, uh, not even we run into, but a lot of MSPs are being told by their cyber lawyers, hey, don't fill out that app. Right? So even if you're encouraging, hey, there's no, there's no liability here, you can fill that out, they're being advised by legal counsel to not do it. So I think, to your point, Andy, to your point, Wes Spencer Spencer Spencer, charge your client and sit down with them and have, you know, advise them on it, right? I think that is the key, um, because it is income for you, it's a touch point for you, and you're making sure your client's putting the right information on that form.

Yeah, I know we're at bingo here, but, but that's If you're not doing it, you're— I think to sort of say what Andy said in a different way, you're actually just— you're introducing just as much risk and liability to yourself because you're going to get yourself in hot water when you didn't help them. And now they're mad at you because they misrepresented on their form and you could have helped them. Right. And so it may not turn into a lawsuit, but it certainly is going to turn into a negative relationship. So you need to have a KPI of do we— are we actually tracking this? Are we discussing and talking with our clients about why cyber insurance matters? At what point do we get to the point we draw a line in the sand and say we require all, all of our clients to have cyber insurance? You have to get— I really think you have to get there, at least the vast majority of them. And so, and by the way, your PSA makes all this possible. Alex Farling's famous for saying, right in your PSA, you can put a little field right there that actually tracks their cyber insurance renewals. And so you're getting in front of it and you're helping them. You're not answering the questions for them, but you're making sure you are the one that can tell them Yeah, this is what MFA is, and I can just tell you, you don't have it. I'm not saying anything else. I'm just saying, as the expert in MFA, you don't have it, and we need to put it in place. So, so you have to be involved. You should be charging them for this. But yeah, you definitely can't be in the business of writing it and filling out for them. That's a huge no-no. Yeah.

And that eliminates the need for you. I mean, a lot of times when MSPs were going through those forms themselves and filling them out, they were going through and say, oh, my client doesn't have this. My client doesn't have this. My client doesn't have this. Doesn't have this. Now I'm nervous they're not gonna get coverage, they're gonna get mad at me. All you— just to Wes Spencer's point— oh, look, you don't have MFA. I'm just telling you what you don't got, you know. You don't have a PAM tool, you don't have EDR solutions, like, you don't have those things. We can talk about it, we can enable those things for you, but you don't have them, right? So don't mark that you do. And if they decide to mark that they do, that's on them now, right? So there's that, that whole conversation there. Um, so, uh, there is a question in here. I know we're at time, just real quick. Um, how do cyber policies adapt as companies grow? I mean, that's the renewal piece, right? I mean, at a renewal, you should be reassessing your cyber posture. You should be reassessing— you, I mean, you're submitting updated revenue numbers, you're submitting updated employee counts, all that kind of stuff. So theoretically, you should be looking at higher limits as your company grows. I mean, that's just the reality. And if you're— if your agent is just passing you over a base $1 million policy every year because that's what they know about and they're not actively comparing your risk and looking at your risk as to what coverages you should have based on your risk, then something's wrong, right? And, uh, Melanie puts a bow on it. She says that right there is why you should do business with a cyber insurance specialist and not your best friend from high school or the agent down the street. Now, your best friend from high school or the agent down the street may have a cyber expert on staff, or they may be the cyber expert, but they might also might not be, right? Really important. So We're gonna put a bow on it with that. Melanie, you get the, uh, the— I don't know what the, what the ending chime is because I can't really do that on here, but that's, that's what you get.

So Melanie, you get a pancake with a bite taken out of it.

Good job. Awesome. Wes, Andy, thanks so much for jumping on here, guys. Um, really appreciate the time. Um, and we will catch you all later.

Thanks everyone. See you guys.