Cyber Insurance Year in Review: Here's a Few HUGE Takeaways!

What's going on? Happy Friday to all you fine folks that are out there. Uh, Will, what's going on, my friend?

Dude, not much. It is indeed Friday. That's pretty much all the energy I got for me today.

Yeah, man, I, I'm excited about that. Uh, you got any good weekend stuff going on?

Yeah, actually, so tonight we— my wife and I love Christmas movies, so tonight we're watching, uh, Jingle All the Way, Arnold Schwarzenegger. We're having some friends over. And then tomorrow we are doing a Grinch night with our friends because they're— my wife and our friends all love the Jim Carrey Grinch. I know it's not the OG, so we may have some people in here who get upset about that.

But I love, I love Jim Carrey. Grinch, he does a great job.

Some of those quotes, we say them all year long. So, yep, pretty pumped about that. Some cozy nights for winter, cold winter nights.

That's awesome. Those of you in chat, throw out your favorite Christmas movie. I want to see it.. And yes, Die Hard counts. We will certainly accept that with, with a great deal of happiness. Let us know what your favorite Christmas movie is as well. So this is going to be a great livestream today. We're going to be talking about some of the new data that's come out specifically from Hiscox. You want to talk, Will, just quickly who the heck Hiscox is, because some people listening today may not know who they are.

Sure. Hiscox is an insurance carrier. It's one of the, the many that we at Fifth Wall have access to, but they Uh, without going into too much detail, they tend to write— and this is, I'm not going to give it like a black and white, this is exactly what they do— but, uh, they tend to write, um, companies under $100 million in revenue. So not necessarily small businesses, but not massive ones either. So that's, uh, one of the, one of the carriers we will go to. Um, I do love their form. They very rarely sublimit more than maybe 3 different coverages, which is awesome. Um, maybe 4, I don't remember, I have to look, but either way, fewer sublimits than we tend to see, which is excellent. So, um, they— yeah, so we have a report from them that I guess we're going to go through just to show some statistics on what they observed this past year. But just keep in mind that tends to be smaller businesses across the board.

Yeah, which is, which is good in this case because, um, I, I like finding niche reports from, uh, vendors that do have a specific amount of, or a specific industry, a specific industry size, because you can really sometimes glean a lot more from, from those industries. So yeah, I think that's absolutely great. And just, I can't, I can't help but say to plug for Fifth Wall, I mean, I love— that's why we have such broad access, because it's just like you said, hey, in some cases, you know, Hiscox is great because of the lower, uh, numbers of supplements, which if you don't know what supplements are, we actually did a live stream on that. If you're curious, we can go and grab that. Just DM us later and we'll go find you the live stream for that. Um, uh, or, you know, they just happen to know a particular industry well or an industry size. And so that's what we're all about, is matchmaking you up. Um, so some good ones came in, uh, just a minute ago. Paulette going classic with A Christmas Story. You can't go wrong with that. Mad respect. And Natalie Suarez is on. For some reason, Natalie, you just show up as LinkedIn user. I'm not sure why, but I know that's Natalie. And, uh, Die Hard. There you go. So Natalie, I hope you're doing great today as well. She's a great friend of mine.

Wes, what's yours?

Uh, I have to think about that a little bit. I mean, I love Elf for sure. Um, that's one of our favorites. Um, give me a minute. I'm always terrible at like these top, you know, Christmas movies, but Elf is definitely up there for sure.

My hands-down favorite is Chevy Chase of Christmas Vacation.

Yeah, that's got to be a top 2, top 3.

Painful disaster movie, and I love it.

Yeah. Bob, can't go wrong, Nightmare Before Christmas. Uh, that's, that's a good one as well. Yep. All right, so Will, why don't we just dive right into this? Should I share out the screen? We'll start jumping in?

Yeah, let's do it.

Okay, let me flip off a couple things here. Let's get rid of this little overlay that's a little big, and then I'm going to pop this guy in. And oh boy, that's a small screen. Let's see if we can get this better here.

Um, oh, because the chat overlay.

Oh yeah, that's exactly what it is. Let me— so we're going to pop chat off, but we'll still see chat. Oh, uh, Zach Duke checking in, A Christmas Story again. Yeah, can't go wrong with that one. A great, great one as well.

Yeah.

All right. Start leading us in here, Will.

Yeah. So as I mentioned, we have this report, Cyber Readiness Report from Hiscox. It, it breaks down effectively some of the stats pulled away from the past year when it comes to cyber insurance, when it comes to what they're seeing in terms of claims, in terms of ransomware payments, in terms of general responses and maybe some trends in types of claims and, and average costs and all that kind of stuff. So we wanted to work through this a little bit just to, I guess, ultimately say things aren't changing. I mean, they are in some ways, they're getting better, in some ways they're getting worse, but cyber insurance and just protection against cyber attacks is going to continually need to be a thing. And I think that's— we all know that, but at the same time, it's good to see the data because I mean, I know for me, I'm a stat guy, I'm a math guy. So when I see data, it's helpful because it's like, hey, all right, the industry is still necessary.

Yeah, yeah, it's definitely not going away. That is absolutely the case. And we are seeing that uptick. We're seeing more and more businesses, more and more industries, more and more industries and business sizes really realizing that insurance is critical and it's important. And the reason we wanted to talk about this now is If you're an MSP or an MSSP listening today, or you're a VCSO, you're an advisor of some kind, just understand, um, we talk a lot in the insurance circles about 1/1, you know, meaning January 1st is a date that a lot of organizations really— that's when their new policy goes into effect. And so now is the time to be talking to your clients about this. Now is the time to get in front of it. I'd even argue you're just a little bit late, right? But you're not too late, right? If you haven't started yet, now is the time to do it because many are starting to go through that process again. And if you're not getting in front of this with your clients, you have to understand that some things may be happening that are outside of your sphere of control, right? They may go to just a local agent who is great, potentially awesome, right? But many agents are not as awesome, right? And it's not that the agents are bad. It's just that from a cyber perspective, that's not their wheelhouse. And they'll readily admit that to you. They're great at all these other lines. But, but from a cyber perspective, not only do they not have a lot of access, but they also just don't always know what you need and they don't know a cost of a breach and they don't know how important this stuff is. And so now is the time to get in front of it. You're not the one that's selecting the insurance for anybody or recommending, but it's important that you get in front of it and make sure that you're, you're in those discussions because we're seeing the game continue to change and it's shifting sand under you in terms of the minimum policy requirements. So just wanted to throw that out there. Um, let's jump into the first, uh, piece of this report, Will, that we want to talk about.

Before we jump into that, just to, to, to say one other thing concerning agents. I mean, we have a lot of agents who work with us Um, and I think that is a— that's becoming a sign of like agents who get it. They're like, hey, look, I, I either understand the importance of cyber insurance and I want to get my clients the best access possible, or hey, I don't get this, but let's go to someone who does. And I think that's, that's really important that if you're an agent listening in, just take cyber insurance seriously. It's not just, uh, it's not just an add-on thing anymore. It's not just a little dinky, you know, endorsement. That's just not going to cut it anymore. Even based off of the stats we'll see today, those $50,000, $100,000 endorsements you see aren't going to cover it. Yeah. Um, so it's important to— it's important to really get behind this if you aren't already. For the agents I know who are being proactive, awesome, keep it up, you're killing it. So that's, uh, you know, both, both channels there. It's just vitally important that cyber insurance is not swept under the carpet, but it maintains kind of forefront for a lot of people.

Yeah.

Yeah.

Well said.

So, yeah, let's jump in.

Let's do it.

All right. So, there's lots of— I guess I should probably maneuver this faster. But there's that guy and there's some stuff. Okay. Where do you want to start here, Wes? I'm going to make this—

Yeah, let's start right here. There's some good data. I don't know if you can stretch your screen out. There we go. Yeah, a few really good pieces of data.

Can you see it enough?

Yeah. Yeah. We've got this up now.

Yeah, I don't think I can make it any wider.

No worries. I think this will be perfect. It sort of reorganized, so that's good. So, a few things we want to talk about here. And by the way, we will have chat open, so we'd love to hear your thoughts, reactions, questions as we go through all of this. But anything that stands out to you here in particular?

For me, this one, I think attacks intensify. 48% of companies reported a cyberattack in the past 12 months. We're not surprised by that, I don't think. But at the same time, it's, it's just like what I'm going to— what I would say at the beginning is that things aren't changing. I mean, cyber attacks are going to become more common because they're so easy to try and pull off. Phishing, you know, phishing, ransomware, all that kind of stuff is, is so simple to try and do. And then that's what phishing is. You're literally casting a net hoping someone's going to click on it. It's not that hard. So I mean, I've listened to interviews from hackers who got caught, you know, that kind of, that kind of thing where they're saying, look, for years all I did was do this. And I was like, oh, I can make money off of this, why not? And they were usually like high school kids who just got into it. They weren't— it's weird to think like, hey, you're stealing someone's money, that doesn't bother you, but it didn't. And I think more and more as the internet becomes consistently more accessible to people and easier to use, why not? You're going to see it. So, um, but I was also encouraged by the, by, I guess it's row, row 3, column 2, more cyber policies. Um, the fact that 64% of companies now have cyber insurance, a standalone, that's, that's the key. And we're even seeing that, speaking from Fifth Wall's perspective, one of the things we do, policy reviews. And I would say when I first started doing policy reviews, I saw so many endorsements coming across my desk and since, you know, even in the course of a year, more and more of the policy reviews I've done have been comprehensive policies. Um, are they the best? Maybe, maybe not. But at the same time, at least it's a standalone policy, and we're starting to see more of those come across our desks when we do these reviews.

Yep, yep, very much so. Um, and that's a great thing. Now, two, two things that really stand out to me that are kind of shocking here. Um, by the way, Will, if you hit those— yeah, I was about to say, if you hit that button, I think— yeah, yeah. Now if you stretch it, I think we'll have Either way, that's good enough. We can, we can see it well. So I want to cover— I want to cover a discrepancy that you're probably seeing today that you see at the very bottom here. If you see what I see, first thing is respondents' mean cybersecurity spending is up 60%. Okay, that's a good thing, right? If we're managed providers in particular, we're thinking, great, spend going up across the board means that's what we want to hear. It needs to go up. You know, up 60% to $5.3 million and it's increased by 250%. So since 2019, that's great. But then you flip over to the right and all of a sudden you have this head-scratcher of like, time out, wait a second, the median cost of an attack has risen 29%, but it's still under, just under $17K. And I'm thinking, wait just a dad-burn second, are we saying that we're spending millions of dollars to go protect against, you know, a measly $17K. What are we talking about here? Now, Will, you and I have been chatting about this a little bit, but give us some initial thoughts here as we kind of unpack what this actually means.

Yeah, obviously when you look at a report like this, first of all, you don't have all the data in it. I mean, there's, there's a lot of statistics and a lot of specifics, like 19%, 16%, 64%. You see these percentages. They do have that the median cost of an attack has risen to just under 17%. I'm not sure what an attack means either, just to say that. It doesn't say a claim, it doesn't say the medium payout of a claim, it just says the median cost of an attack. So I don't know if that's what was paid out or if that's what was some of the damages that were suffered specific to the attack itself. Now Um, there are a couple of pieces that we talked about. Potentially it's that Hiscox writes these companies under $100 million, so who knows, um, specific in that regard. They also do kind of break down what the, the revenue tiers of the sample. Um, I think they sampled what, like 100 companies, Wes? It's in there somewhere.

Um, yeah, so the very bottom last page.

Yeah, yeah, so we can, we can look at that too. But I, I don't have all the answers here, but I do think that there's when you start to look at the different types of attacks, if a big chunk of those were these small, like, money hit attacks, um, and multiple of them happened, that's going to cause the median to change, right? That's going to change averages and median numbers and all that kind of stuff. Um, although a median is just the middle value, so I don't, I don't even know how they're— what, what data pool they're using for that either. So it's, it's that kind of stuff of— I think the question though, Wes, is Hey, if we're saying, hey, you should have $1 million in coverage, but it says $17,000 is the average attack, how do you have that conversation with someone?

Yeah. Yeah. So we're going to cover a little bit of that. We're going to salt in some other data that we need to see alongside this because from a pure risk mitigation and management perspective, no, that would be foolish. No one spends $1 million. We don't step over dollars to save nickels, right? We just don't do that. So we do know the cost of ransomware is actually far more expensive than that. The cost of business email is far more expensive than that. But I think when you just take— because as you said, when you look at the survey data that comes back from Hiscox, because a lot of these are very small businesses. In fact, let's just do this. Scroll to the very bottom, the last page, if you would, Will, because what you're going to see is the survey data that comes back here. There you go. You just had it. It's the second to last page.

This one?

Nope. Keep going down. It's a page. It's all black.

Oh, that is it.

Yeah.

Yeah.

Right there. Yep. So if you see the very bottom right respondent number of employees percentage-wise. So the vast number of percentage of smaller companies that are here is— look at this— the vast majority are 250, actually 999 and down. But really, you add up all of them, it's 249 employees and down. So really smaller businesses that are, that are making up this report, which I actually like because sometimes this— the SMB sector gets left out of threat reports and threat data. And so we can see this. And so when you take the average that you may see a lot of gift card types of scams and things like that, that can pull down the average cost. And so, yeah, the average cost may be $17,000, but what we're really talking about, the things that should really scare and put a business, a small business out of business could be these bigger, these bigger threats. Right. So we just wanted to cover that a little bit. Will.

Yeah. And we're going to talk about some other stats soon. But I just, I think it is interesting to look here and see the people who were responsible for those attacks broken down and kind of the percentage and how many of them were kind of directors or presidents or leaders at the company. And then on top of— but on a, on a greater scale, you see these industries and we had that We had that LinkedIn Live a couple of, maybe a month or two ago where we talked about the difficult to write risks and you see a lot of them in here. Healthcare, manufacturing, government, nonprofit. So public schools, things like that. You're starting to see there, there's really two things I look at here. Government nonprofit is down, is, is only 5%, which is kind of awesome. At the same time you look at manufacturing, that's 8%. I mean, we've talked about throughout the year that manufacturing has been hit harder and harder, and we're seeing them get hit. And a lot of times it's just because, all I do is order some stuff, or I use my computers for a couple of things. But no, you're collecting client data, you probably don't have the best security. Those are a lot of things we were running into. Um, but hopefully that shift is happening too. But, um, it's, it's reports like this where carriers then lead to price increases the following year because they start to see who's getting hit harder, you know, who's who's being targeted by cybercriminals. And there was one other, um, block that I thought was really interesting. Sorry for the, the vertigo attack here, guys, but, um, here. So you have these— this median cost being just under $17,000. You have respondents, um, increasing cybersecurity and all that kind of stuff. But right above that, the median attack costs more than doubled for, for firms and businesses that were ranked as cyber novices. So people who aren't taking their cybersecurity seriously, not only are they paying more for a cyber insurance policy, but then the cost of the attack increases. Here's where the issue happens. If you're paying more for a cyber insurance policy, chances are there's probably two sides here, right? Either you're not getting a good policy because you don't have the right controls in place that are going to make you eligible for a good policy. Or you're paying way more than someone who had good controls is. So you're not only paying a ton of money, you're also not protecting yourself properly, and you're— based on this, you're getting hit for way more on those attacks. So I— there, it, it can sound like, oh look, $17,000, but if you're properly securing yourself on the front end, you're then able to be eligible for a good cyber insurance policy. And those good controls coupled with the good policy ensure the payout and also ensure that you're not necessarily losing as much. And I feel like anyone who's ever dealt with a cyber claim before, it doesn't— you don't get paid right away. So a lot of times there's— there, there can be that process. I mean, I went through— this is different, but it was a car accident and someone in a U-Haul scraped across the front of my car, and I'm still waiting after 3 weeks on getting some sort of decision from insurance carriers and stuff. And it's just, it, it It's not to say that cyber insurance carriers are faster or slower. It's just that you don't necessarily think, oh, I need this money now, not in a month, not in 2 months. So you want to mitigate how much you're getting hit.

Yeah, absolutely. All right, so Will, let's flip over to the Hiscox mini report, the sort of the summation. So both of these, and we'll get a link to you as well if you want to see each of these. We'll get that as well. A couple comments, Will, while you're flipping over to that one. I want to bring up the chat overlay here, but there's a few things that I wanted to jump back into. So Jack, thanks for joining us today. Jack was saying Jim Carrey's really good. Uh, yeah, totally agree. And then whoever this is, I gotta go look up on my phone, see who this is. This wise person— Planes, Trains, and Automobiles. That is Brad Gross. Uh, I abs— Brad, I absolutely love that movie. Like, oh yeah, I dearly miss the fact that, um, John Candy is no longer with us. What a great comedian. Just, I just miss him.

I actually introduced that movie to my wife for the first time this year. She had never seen it, and she hates, she hates, um, they're not disaster movies, I forget what they're called, but just where one thing after another goes wrong. It makes her so uncomfortable, but I love— yeah, so out of the kindness of her heart, she watched it.

We just don't make a lot of movies like that anymore, which is—

no, we literally said that.

Yeah. Uh, Connor checking in. Connor Swalm's a good friend of mine, CEO of Finn Security. Thanks for, for dropping in. Um, Eddie's jumping in here. Great question. Does Fifth Wall provide services to Canadian MSPs? You want to answer that really quick, Will?

Not yet, but I do know that that's the next, uh, kind of focus of our, of our ability to place coverage elsewhere out of the States. Um, right now we're, we're licensed in the, in the 50 States, and I don't know about U.S. territories. I'd have to check with Reed on that, but I feel like that's also true. But then outside of that, not yet, because, you know, different governments, federal regulations, all that kind of stuff. But I know we're working on Canada. That's next on the list. Okay.

There you go. Michael, good to see you on as well. Thanks for joining us. And I will see you at SHNIZ Fest. I can't wait. It's going to be my first SHNIZ Fest. Hey, oh, I'm excited about that. It's going to be rockin' cool. Bob jumping in here. Yeah, it's a good point here about insolvency, right? That will sober you up really quick. And it is important that we help our clients understand this for sure. And Bob went on here. There are costs associated. Let me, let me pull— sometimes Restream does this. There are costs associated even if you're internally running down a bad email. If they count labor on those types of investigations, that could average the median cost down. Yeah, exactly right. If you guys don't know Bob, he runs a lot of incident response, so he's very heavily in the middle of all of this. It's really good feedback that exists there as well. So, yep. Thanks, Bob. Appreciate that. Okay, so let's jump back into that mini report and there's some really good data right here. Let me take the chat overlay off. There we go. And towards the bottom there on the same page in the purple, will. Some really interesting data. So the most common methods of entry from the data that Hiscox is seeing— again, keep in mind this is S&P-focused— really good stuff here. Still phishing number one. Isn't that shocking? I talk about this over and over and over, but here we are about to be in 2023, and you know, when you think about from an insurer's perspective, what they want to do is have low loss ratios. At the end of the day, you boil it all down, and if phishing is still the number one entry point What are we going to see? We're going to continue to see more of an effort towards your employees. And there's some data that's in here and I don't remember where it's at, but I was looking at it and they talked about— Hiscox has talked about the post-breach. Actually, I think it was from Coalition, the post-breach, like what, what companies actually do after they come out of the aftermath of a breach. And one of the top 3 things they work on, Will, and I think this is shocking, is we're going to train our employees more than ever before.

Yep.

That it's a natural outcome that we don't necessarily invest in it now. And then after something happens, we're like, whoops, well, that was a big deal. I think it's really important that everyone understands how big this is. So that's still number one. Number two, not a shock. Credential theft. We talk about this over and over. This is why MFA is so important because we do know our— and this really comes back to number one. We do know that people reuse passwords over and over. Because we stink at keeping great, unique, complex passwords for every site. We just use happy cats 1, happy cats 2 for every website we go to. And password managers address that, but multi-factor protects against that as well. And then the third one, and I wanted to flip this over to you, Will, and get your thoughts on it. Ta-da! We have what we've been talking about for years among security people in the channel, which is third-party supply checks. They call it MSSP, but it's also MSP as well.

Right?

Managed IT providers are still a huge attack vector. They are still the middle of this because they keep the keys to the kingdom. Does that surprise you, Will, as the number 3 entry on here as far as most common?

I think it surprises me because you think in your head, hey, my MSP is the cybersecurity guy and he's going to keep me safe. Maybe I'm reading this wrong. Is, is this saying that it's due to like attacks are coming in via MSP channels. Like if, if your MSP handles, you know, like you said, the keys to your kingdom, so your MSP is managing all your endpoints and it's those endpoints that the MSP is managing that the attack happened through. Like I said, this is getting at—

that's exactly what it's getting at.

Whereas in your head you're like, oh wait, my MSP is supposed to be protecting me from this. Not— I mean, if there's MSPs listening on the call, I mean, obviously yes, right? The case, but it's surprising to see because then you're like, well, what's happening then that attackers are getting in via these channels?

Yep. And, and this is a sort of a two-pronged, uh, risk approach that you need to take. One is weaknesses in your own systems, right? Like vulnerabilities that exist through no fault of your own. Those things happen. We have a lot of legacy software that's out there that MSPs use every day. I'm not hating, right? This is— and this exists in every other industry, right? But we do We do have a lot of tools in place that, that sometimes a vulnerability happens and it's— it nasty things happen. There are anyone that's in the MSP space. I'm not going to call out names today, but it's happened over and over and over and will continue to happen. Hear me. But the second prong of risk that you need to think through on this is misuse of tools where there's no vulnerability in the tool itself. Right. So I'll just give you an example. Let's say you use an RMM and a bad guy gets access to the credentials and use of one of your engineers. And uses the RMM to do nasty things. Well, the RMM was not exploited, right? There's no weakness in the RMM there. It's just that the RMM was leveraged to run ransomware, right? We typically, in my old days at Perch, we called these buffalo jump attacks where it sort of goes back to this Native American hunting technique where they learned, you know, hey, my like bone spear and atlatl is not so good at like killing buffalo. Why don't I just cause a stampede and push them all off a cliff? Makes hunting way easier, right? And that's what bad guys are doing. They're like, we can use the supply chain to go after all of all of your clients, right, through no misuse of the client, no fault of the client, all through the MSP supply chain. This is why we talk about tech E&O as such an important piece for MSPs. Will, can you kind of quickly talk about what tech E&O is and why MSPs need it?

You're reading my mind. So there's, there's two things that my mind brought— my, my— that's coming to mind here is one side, tech E&O, because when you look at this stat that says I'm not— I don't really understand how the percentage works because it says 62%, 44%, 40%, 28%, 17%. That does not add up to 100. But either way, we look at that number and the MSP one being kind of middle of the road there, that a lot of attacks happened through that. And maybe because some of these are interconnected. But if you are an MSP, if you think of it this way, oftentimes we talk about, hey, when we're selling cyber liability insurance at Fifth Wall, one of our biggest talking points to say 83%, or maybe it's 87 now, but a large percentage of cyberattacks are due to human error. Your MSP can put all these things in place to protect you, but guess what? You can still make mistakes. Guess what? MSPs are also made up of human beings, and human beings make mistakes. And tech E&O coverage is a branch of what's called error and omissions coverage, and it just says, look, if an error happens based on something you installed or you put in place technologically for a company system, you can be liable for that. So we want to protect you from that. And so Tech E&O will help cover the damages in the event a breach happens through what, you know, like a third-party supplier, like an MSP. So if you're an MSP and you don't have Tech E&O coverage, we strongly recommend it because, as this stat shows, a lot of breaches happen through those avenues.

Roger that.

The other, the other piece of that then is on the flip side, we've been kind of telling MSPs, you know, it's, it's good to encourage your clients to have a cyber liability policy, but when you look at this stat and you say, oh wait, even with all my controls in place, there's still potential for mistakes that aren't from the client but from my end that could cause them to have a breach, so it's in my best my interest to strongly recommend, if not require, my clients have a cyber liability policy. Because even though they'll come after me for my tech, you know, they're still going to need help to recover. And that recovery is really important. So I think it's, it's, it's not just a, oh, you really should carry a good policy. It's like, no, look, human error happens. Human error happens on your end at your business. Human error happens for an MSP. You don't want to sell with that, right? You want to say, hey, we can mess up. But at the same time, it can happen. You have that knowledge within your head. So it's important to say, hey, we strongly, strongly recommend you have a cyber liability policy that is standalone.

Yep. Okay. So let's scroll down to the next page and some interesting things that show up here that I kind of chide a little bit. Yeah, let's get to this blue thing here. So now what they're doing is they're stacking each of these attack vectors that we just talked about along with their recommended mitigations. And some of these make a lot of sense and one of them at least makes me really scratch my head. So Phishing. Of course, we've talked about this. The way we address phishing, as much as we want to stop phishing and we do email filtering and we do some things like turning off Word macros and things like that for documents that come in and limit documents that come in and limit links and try to link check. That's all good stuff, right? We should do those things. But phishing is still going to get through. We know this, right? And so custom and general and custom staff training. Yes, that's important. And we move to the next one. Credential theft. Shocker, right? Same thing. Train our people and use MFA. Right. So those just make total sense. But then we jump into third-party supply chain MSP and all they say here is understanding supply chains and regular audits. Right. Well, what does that mean? I think what that really means is you really do need to understand a few things that I'll unpack a little bit more when it comes to your third party. You need to know what kind of data you have and where that data flows. So who has access to my data? Who can store my data? Who can process my data? Those are things you need to think about to understand your supply chain risk. And then you can begin to ask good questions to those third parties to say, hey, you have this amount of data from me. I want to understand better your security program here and there, right in these areas. And you are going under that yourself. If you're an MSP or an MSSP today, you've probably seen over the past year and you'll see a lot in 2023 of a lot of your own clients diving into what are you doing to protect my data? And so this is why we cannot just sell security. We have to eat our own tacos. We must truly go down a security journey for your MSP and build maturity in this because you are responsible for the protection of your clients' data. And just as Will talked about with Tech E&O, sometimes those entry points come from you. So that supply chain risk is big. Now, Will, here's the funny one. We get to unpatched server. You know, this, this next one that lists here, we didn't talk about that too much, but number 4. And for sure, right? Like, you know, hey, I had a Windows server that was out of date or Log4j that we talked about a lot this year, right? Or some of the Windows Exchange vulnerabilities that we've seen a lot this year. Here's what cracks me up is the first thing they show and here it is, is SBOM, Software Bill of Materials. Now, please don't panic. This is just Hiscox's recommendations. As a cyber expert, I would just tell you, as much as SBOM is really awesome and important, we're not going to see that really come down market at all. It's not going to be a focus yet as much as it ought to be. Software bill of materials was— we actually have seen the federal government recommend this, basically a list of all of the software packages that go into the platforms that you use today. Right. That's big. The problem is this is really complex, especially because so much open source software is used in almost everything today. This is really difficult. But we— Log4j illustrated this for us when that big vulnerability came out. Everyone was panicking, thinking, well, wait a second, where does Log4j exist? Well, if I had a good SBOM, I could go look it up and see. We don't. So I'm not arguing that SBOM is not important. I'm just saying that is— that is putting a cart in front of a horse. The horses in this way should be vulnerability management and scanning. We need to know what's in our networks and be aware of those things. We need to have really good patching regimens and hygiene with all of this, and we need to have good ways to test to make sure these things are working. That's the big piece for that one. And then same with like unpatched servers in terms of like configurations, that last category you see there, same thing. Vulnerability scanning can show that kind of stuff, but they do mention some things like staff training, MFA. And then just-in-time control. I think what they mean by that is like what's coming out with like privileged access management, you know, like my friends at Cyberfox, what they're doing there with like let's provision access when you need it, let's tear it down when you don't, right? So I thought this was good stuff that exists here. It's not perfect, but these are certainly things that you can use in conversations with clients every single day just to make sure that you're communicating why these things are important. Definitely.

This is— yeah, it's— I'm gonna be honest, this is some of the mitigations here I look at, I'm like, oh yeah, I know what these are, but I didn't know what SBOM was until you brought it up. But that makes— it makes sense as to why it could be helpful, it could be extremely taxing to put together.

Exactly. Um, Jack, great point here that he makes. Keep in mind not everyone is equal here, right? They're mature, less mature in the cyber perspective. A thousand million percent agree with you, um, absolutely. And if you're one of those that are less mature, it is, it is in your best interest for survivability to, to grow, go down this maturity journey, right? And I've seen mature MSPs that are very small and immature that are small. I've seen mature that are big and immature that are big, right? So company size doesn't always reflect either. So great, great point there, Jack. All right, a few minutes left here in the live stream. Um, any, any other major things that stood out to you? If not, page 5 had one thing for me, Will, but I want to make sure you get a chance to talk about anything else that stood out to you.

Let's—

this one right here.

So this one, I don't think we're going to have time to get to the other report, which is where I think there was a lot of interest for me, and that's fine. But let's, let's just go with your thing. I don't want to spend too much time scrolling.

So, yeah, so, so this one I thought was pretty interesting. Why we pay ransom. So in the aftermath and in interviewing, why did you end up paying? Right. Well, we know ultimately, well, I paid so I get my data back. We know that exists. But remember, we've been talking for a long time about this idea of double extortion, right? So they extort you once to say, we've ransomed your data. If you want it back, you got to pay up, right? But then we've also said now bad guys are starting to say, we've also stolen your data. So if you don't pay up, then we're going to leak it on the web. Now, we actually— Perch, we predicted this like a year before this happened. You just look at the ebb and flow of what's happening. This is a natural evolution. And I thought this was shocking, Will. 40% of the respondents that paid a ransom, one of the reasons was to protect customer data. So they actually said, uh-oh, well, you've got all our data. We better pay you to make sure that you don't leak this data. I just— I'm very, very, very concerned that companies would say we're going to pay a bad guy so that they can keep their promise to not leak our data. There is no precedent and there is no guarantee that that will happen. Right. And it doesn't release you, by the way, from all of your regulatory and legal responsibilities of your data that your states have authority over.

Will, right? No, I mean, I think you're right. And there's, there's two sides. They could be like, okay, we'll return the client data, but who's to say they didn't make a backup? Because why not? And then on top of that, um, half the time the ransom gets paid— I don't know about half the time, but a lot of times the ransom gets paid, they get the encryption key, and the encryption key doesn't work. So the question is like, how much of this data, you know, when I pay this ransom— it's— there's, there's a lot of conversation around should you pay the ransom, should you not. I know on the Coalition report I was going to reference, it said oftentimes they were able to negotiate the ransom down to 20% of what was asked, like a lot of those things. But in the case that doesn't happen— and that's— I wanted to get to that and finish your point first, Wes, and then I'll—

no, that's it, go ahead, jump in.

Okay, so my thought process here was like, okay, we looked at those stats earlier. It's like, hey, the, the average cost of an attack was $17,000. In the Coalition report we saw, um, and I'm not going to jump into that now, but it was somewhere between $130,000 and $210,000 depending on the type of attack it was. But then even with that ransomware stat where they say, look, we were— we've been able to negotiate a lot of our ransom demands down to 20%, that doesn't mean all. And if you're not covered for the right amount and you happen to be one of those people who the criminal will not negotiate you're stuck paying out the full asking price. And if you don't have the right coverage in place, well, that stinks. You're probably not staying in business. So like, that's the, that's the mindset when we read these reports. I think a lot of times it's the carriers, rightfully so, patting themselves on the back and saying, look how these payouts are working, look, our, our, like Wes Spencer was saying, our loss ratios are down. They want to be able to show that because that means we're successful. But at the same time, that doesn't say, hey, a lot of us, we were able to talk down a lot of these reports, but guess what? Some people still had to pay the full ransom, and that's, that's the scary part. So some people get scared, oh, I'm gonna lose my client data, but you get even further down the road and say, hey, you could also lose your business. So there's a lot of this that kind of builds off of itself.

Yeah, yeah, well said, really well said. So there you have it. That's some really interesting data that I think came up that I wanted just to make sure that we kind of covered, because this data just got dropped from Hiscox and great partner of ours, really love what they're doing and just wanted to make sure we shared some of this data out with you. And keep in mind, the big takeaways for me are now is your chance, now is your time to get in front of your clients. If you're an MSP today, if you're an agent listening today, now is your time to build some resilience, right? And definitely reach out to us in terms of understanding and knowledge around cyber insurance and broaden your access, right? That you have the ability to offer coverage not just to 2 or 3 carriers, but, you know, 40 plus. It's a big deal in this day and age to make sure because there is a lack lack of consistency in cyber insurance when it comes from carrier to carrier. And that's to be understood. So I don't know if anyone has any questions. Will and I will continue to hang out for another minute or so in case anyone does have any questions they want to ask us. But Will, this has been really good and I love diving into different threat reports that come here. We know that they see what they see and they don't see what they don't see, right? And that's okay. But they do help us kind of see the world around us a little bit more. And at the end of the day, carriers have more access typically into like breach data than almost anyone else that's out there because they're the ones that are paying these things out. So they get some really rich information that comes out that we should be listening to.

Yeah. And we're able to see trends. I mean, even if it doesn't give us the full picture, we're able to see what we— what, you know, based— because I say this in a lot of my MSP calls is, look, as logical as it seems to just want to put this thing in place and this thing in place because it makes sense, insurance has always been— I think will continue to be an industry based off of actuary tables and data. Data. So it's good to see that data come out because it tells us, hey, the carriers are starting to learn things, they're starting to pick up on things. And now we know that can be helpful for us because we're starting to see where the attacks are coming from more and more. So things that we kind of knew were true, or we assumed were true, are we starting to— we're starting to see, hey, they are, we were right about this. So let's, let's keep moving in that direction. And I know a couple more reports are going to come out at the start of the new year, so might be something to dive into again Yep, we'll see the full picture of 2022.

Without doubt, we'll pack— we'll unpack those and dive into them. Absolutely. So if you guys have any other questions for us, reach out to us, fifthwallsolutions.com. If you're an MSP, just tag an MSP into that, fifthwallsolutions.com/msp or MSSP. We'd be glad to talk to you about that. We can help you for your clients in solving their cyber insurance hurdles. We can educate you on the way of what this looks like and how leading MSPs are growing revenue like never before through cyber insurance. We can talk to you as well about how to solve this for your own MSP with Tech E&O. Um, or we can just be there to answer your questions, right? If you just have questions along the way, and we lead with that, an education-first approach. We've got a great sales enablement program. So we'd love for you to reach out to us if you have more questions. Um, other than that, Will, you want to carry us out today?

Yeah, and just on, like I said before, if you're an agent, you're listening in, we also have a great agency channel we can get you connected with as well. So if, if you It doesn't matter where you're coming from. If you're looking to make cyber insurance or take it more seriously, we want to— we're the experts in it. We want to help you out. I mean, that's, that's where we want to begin. Let's educate. Let's get behind this. We see the trends. We see what's coming. We see what's happening. So let's, let's talk about it.

All right, everyone. Thank you guys so much for joining us today. It's been a ton of fun and hope you guys