Insurance Webinar - Dec 20th

in facilitating better coverage for their SMB customers. Before we dig into this emerging relationship, I wanted the panelists to introduce themselves and more importantly, their company's roles in the MSP or insurance ecosystem. Let's start with Tim Golden and Polygon.

Hey, good afternoon. Thanks, Tim, for the, uh, for putting this all together. Yeah, I'm Tim Golden, founder of ComplianceRisk.io, where we bring people, process, and policy to MSPs. Trying to help shape your policy future and giving you great tools to really bring policy peace of mind. We'll get into some of the gory details a little later, but yep, Tim Golden, ComplianceRisk.io.

Awesome. Lifecycle Insights, Alex Farling.

Yeah, my name's Alex Farling. I'm a recovering MSP owner, just like many of the folks that are out here listening. I spent, spent, spent my years in the trenches with you guys. I, we've, we've, I've kind of engaged in a journey now to, to help you make your quarterly business reviews suck less. And that's really all about telling your clients what their risk looks like, helping you translate that to English, and that makes your insurance applications a little easier. So that's kind of how we fit in here.

Great, great. Wes, you're— I don't know how to introduce you with, with all of your titles, but—

The man, the myth, the legend.

Wes Spencer. I don't know about that, but hey, you got Wes Spencer here. It's great to be with you guys. And let's see, I guess I'm a cybersecurity guy by trade, was one of the co-founders at Perch Security, if you guys know Perch. And let's see, I am also the founder of a new company called Empath Cyber that's just helping MSPs in their journey in security and messaging it and communicating it and getting better and getting everyone rowing in the same boat. And also the channel chief at Fifth Wall. We're a cyber insurance distributor and helping MSPs in that journey too. So I'll just pick two.

How about that?

Awesome. Awesome. Um, and, uh, our panelist who works primarily outside the channel, but is extremely knowledgeable and plugged in, uh, to the small insurance, small business, uh, Manny Carmona from W3 Insurance.

Yeah. Thanks for the intro, Tim. Manny Carmona, Wallace Welch and Willingham. I'm a commercial insurance advisor and have been for the last 4 and a half years. Uh, so my firm represents all the insurance carriers, and I work with corporations to structure a kind of tailored commercial insurance policy, uh, to cover their, their exposures. One of my areas of expertise is cyber, so I've been extremely attached to that line and happy to, uh, kind of talk about some different ways to navigate the ever-changing environment of cyber insurance.

Awesome. Um, and And myself, I'm Tim Schneer. I don't think I introduced myself on the— when we went live here. Fort Mesa helps MSPs, partners with MSPs to do a couple things really to bundle cybersecurity packages that are profitable and can reduce the most amount of cyber risk for the small business owner. So we do that. We have call it, you know, typical GRC or governance, risk, and compliance workflows. But also we have a very good vulnerability scanning and vulnerability workflow as well. So, so thanks for joining again. Let's, let's lay some groundwork on the state of the insurance market with Manny and Wes Spencer. Manny, do you want to talk about kind of what you're seeing in terms of rates?, from 5 years ago to, you know, comparing to now, and maybe talk about just a little bit about like, how do you get cyber insurance? Is it— are there breakdowns in coverage? Um, how does it— is it bundled into some other insurance package and things like that?

Yeah, absolutely. So I mean, I think it's safe to say everyone has the same idea of what the cost of insurance is for cyber, and that's expensive. We obviously saw a ton of rate go up the last few years, but, you know, it's kind of important to understand historically where we came from as an insurance policy. So in the grand scheme of things, insurance has been around for quite a, quite a while, right? So, so cyber, like the first policy was written in like the early '90s. And really this policy form is adaptation to the reality of the marketplace. So what exposures exist at that time? That policy was solely just like a third-party liability policy. And we'll obviously get into the nuances of these limits, but, um, going historically, we see that policy adapt to the real-world environment as more losses and claims stemmed coming from cyber events or breaches. That policy grows to cover those limits. So third party to begin, we start to see in the early, like, 2000s media liability gets attached to it. We start seeing some regulatory bodies. An example would be like California. They're starting to implement some, some laws due in regards to like notifying individuals affected by a breach. And you see this kind of development of a policy again reacting to the marketplace. And then you see like mid-2000s, you know, first-party coverages are coming to light. So this policy is, is a financial instrument to respond to the expenses incurred by a company in the event of a breach. So, you know, why is it expensive today? Really, at that time, the Internet of Things was increasing. Companies relying on networks, infrastructures, IT wasn't as prevalent as it is today. But, you know, there wasn't a lot of losses and claims surrounding it. So carriers kind of saw the opportunity to, hey, you know, let's get involved. In this cyber product. Let's, uh, let's, let's earn another revenue stream. Um, so you saw these policies being sold, um, in the early kind of like 2010s, uh, relatively cheap. So like a million in limit, very comprehensive, broadened coverage, um, and very inexpensive. And at that time, you know, insurance is really educated gambling, uh, for, for as an example. And there wasn't a lot of claims or historics to base off of like a lot of other policies were, like property. We can run reports on, you know, 1,000-year periods, and we can kind of get an idea of what the storm cycle is going to look for, and then therefore quantify into premiums and rate. Cyber, we had no historicals. So these underwriters were just kind of like, you know, the term is loosely thrown around, just kind of the Wild West. These carriers are kind of just doing what they can to, again, earn another revenue stream. Not a lot of claims backing it or affecting it. And then we get into kind of 2014, 2015, the year of the retail breach, the year of the healthcare breach. We're starting to see these threat actors becoming more sophisticated in their approach, understanding that companies have individuals' information that they can sell on the dark web. So now we're seeing, you know, media-wise, there's a lot of attention tied to those breaches, Target, Home Depot, Marriott. So now there's obviously some public awareness. But it wasn't affecting total premium or rates yet. Sure, we were still seeing a little bit of increases, but nothing that was breaking the bank. And we were getting heavily involved with a lot of different carriers because of how, you know, easy it was to source a quote. These applications were just like, I don't know, 5 questions, and it was more so just check the box and we'll give you credit, and boom, now your premium's $1,000 for a million in limit. So we were, we started to roll down this kind of path of cyber's there, it's a problem, but it's not breaking the bank. The carriers are profitable, they're happy, you know, they're not losing a ton of money, uh, their market share is increasing because they're rolling out another policy line. And that, and again, the application process is easy. Eventually, I think we are going to get to a point that we're at now, but, you know, 5, 10, 15 years at that time. We needed a catalyst. We needed something to kind of, you know, break the camel's back. And that kind of— that happened in 2020 with COVID and the rest of the workforce working remote. So really, ultimately, it was due to irresponsible underwriting at that point in time. These underwriters, they didn't really have the sophisticated nature and understanding of IT, proper safeguards, security procedures, etc. So they were just, you know, again, checking that box. You get the credit. Well done. Now you're paying less and you have full limits. But now we find ourselves in an environment where the whole workforce is working remote from their home. Security compared to their office security posture, just vastly different. So for these hackers, it was more so just like fish in a barrel. That's when you start seeing that loss ratio from the carrier's book of business start to explode. They're charging little to no money but paying full limits. So you, you, you charged $1,000 and now you're paying $1 million. That doesn't really make sense. So there needed to be a correction. There needed to be, um, a, a change. And that's where we started to see, um, either InsurTechs coming into play, more sophisticated underwriting, uh, more sophisticated carriers taking, um, kind of market share into this space, increase in applications due to that sophistication. Underwriters need to understand, you know, is this a good risk? Is this a risk that is most likely going to incur breach? Now they're more cognizant of what is their total payout? What is their— what is the carrier's exposure in the event of a breach? I want to make sure that this insured has everything under the sun in place to, to, to a certain extent. So that's why we started seeing those 15-page applications, um, and then rate increases to offset the losses that were incurred, uh, the few years prior. Then regulatory bodies are coming into play. So it became this whole kind of mess that again kind of goes back to kind of unsophisticated underwriting. So now we find ourselves, yes, we saw a lot of rate increases in 2020, 2021. But, you know, being involved with the marketplace, seeing what these quotes are coming into play, we're starting to get a little bit of rate relaxation. We're not seeing the 100%, 200% rate increases that we once were a few years back. We're starting to see it start to level out. Um, but by no means is this risk gone completely. Uh, if anything, the underwriters are more positioned to understand this risk, ask the right questions, get a better, uh, understanding of an insured's environment, uh, and then working together. You know, this is 100% a partnership play with all parties involved. Um, so at this point in time, the rate is still higher. We, we're not anticipate anything going 200% like it was a few years. If anything, we're starting to see maybe incremental decreases, maybe 8 points, maybe 10 points. But again, the sophistication of this policy line has completely changed in just a couple years. Now underwriters are looking at a few different checkboxes before they get to the security controls. You know, what industry are you in? Are you in a high-class industry of breaches? What revenue threshold are you in? Depending on your revenue, that's going to require different, um, security controls to even get a quote. So now, so Tim, to answer your question, we're starting to see rates level out. It's very sophisticated and kind of hard to explain, but if anything, not as expensive as it once was 2 years ago.

Gotcha, gotcha. Wes Spencer, you know, as a cybersecurity professional and CISO at Fifth Wall, You know, any, any thoughts here? Like, I guess, where are the losses coming from? Monday— I like to say Monday morning quarterbacking, you know, looking at kind of in hindsight, right? Like, I know you guys have a lot of data over there as well. You know, what are things that, you know, we could do better on, I guess, as MSPs and small businesses?

Yeah, well, great question. Manny, I think, really nailed it on the history on, you know, what's happened in the past, you know, few years that have led us up to this spot. And, you know, if you're a small business owner, you're an MSP today, you're on shifting tumultuous sands, to be sure. And I don't think we're going to have this fixed yet because, you know, as Manny was talking about, the things that led into this problem are not easily and soon fixed because the whole cyber insurance market was founded on some some, some predications that were wrong from the beginning. And that's going to take a long time to course correct. So we see that as well in even the claims, you know, what's going on. So, you know, I can just say a few things. You know, when you look, Tim, at like what was happening just geopolitically in 2018, 2019, we really saw breaches, you know, begin to take off, especially these focused ransomware attacks. Right. And MSPs in particular were under attack like never before. At Perch, we coined this term Buffalo Jump, you know, sort of going back to this ancient Native American hunting technique where, you know, they learned pretty smart, hey, this bone dagger and ax— and axolotl— what is it, atlatl? I think it's atlatl. They just are not so good. Maybe axolotls too. I mean, you never know, but they just weren't so good. And so, you know, what I could do is just start a stampede, push buffalo off the cliff, and makes hunting way easier. That's exactly what threat actors did through 2019. And then 2020, we saw this hit ahead, right? Because really what happened there was, in the middle of the pandemic, everyone's just ripping and replacing systems and open up RDP to the world and not really any focus on like, "Yeah, I guess someone could come after me for that, but like probably isn't really gonna happen." And so you see these systemic attacks that are happening. And then of course you see, you know, weaknesses in RMMs. And so, you know, we could go down that rabbit hole as well that we won't, But, you know, you saw some major breaches there. And so it's just been a really ugly past few years in terms of these systemic big breaches. And that caused a lot of exposure to the carriers. And so that brings us up to where we're at today to answer your question. I just wanted to set a piece of an answer there. So geopolitically, we do know ransomware is down right now. And we see this in evidence in a lot of places. You look at Coveware, my friends over there, they're the ones that, you know, perform most of the ransomware payments that are out there. And they've shown the volume of ransom payments has gone down, the average cost of a ransomware ransom is somewhere around $250,000. And so that's gone down. And I think we can attribute a lot of this to the conflict in Ukraine and what's going on there. But that doesn't mean ransomware is gone. It just means that right now attentions are elsewhere and we're seeing a pick back up with BlackCat. We're seeing a pick back up with some new variants that are coming into the market, especially in the post-Conti era when Conti was taken down through their, their all like, and by the way, if you don't know what I'm talking about, these are like threat actor groups, right? So Conti is now, you know, they went into the ashes and they're picking back up with like remnants. They're starting their own groups again. So we're going to see— I say that to say we're going to see ransomware take another big step up, right? So ransomware, of course, is a big piece of it. Business email compromise. Oh my goodness. That's just going off the rails right now. Right. And we're seeing a lot of that. That's a huge problem. It's a huge challenge because it's sort of like controls don't do a lot about that to stop it. Right. We can do email filtering, we can do phishing and security awareness training, which those are all critical things. But at the end of the day, if you don't have tight processes around money movement and handling, good luck, right? It's going to be a problem. So that is an issue. And this is why, by the way, just to throw something out there quickly, that's why you're seeing many of the carriers put sublimits on the damages to these types of attacks, because they're saying they're so prevalent, they're so common, we're only going to pay a certain amount of those damages.

Right.

So, so those are a lot of things that are happening. But then, Tim, I'll just finish on this. We're also seeing a lot of additional types of things that are happening that a good cyber policy will have coverage for, right? It could be outages of certain kinds. It could be some of the compliance kind of stuff like data leaks and some things like that that happen that you're like, whoops, we didn't mean for that to happen. It wasn't really a hack per se, but it was certainly a claimable issue in cyber. And so it is pretty varied and it's good to see ransomware coming down a little bit over the past 8, 9 months, but I think it's a temporary reprieve that's going to pick back up.

And in terms of those losses, do you guys— what are like the top 3, I guess, top 3 things? Or, you know, I know obviously Alex Farling has talked about this before, about a customer or a customer of a customer losing on an ACH wire fraud, like, you know, please do this now. You know, someone's out of work, you know, something like that. Is that, is that still like the biggest bucket just because it's, it's a huge like number you can lose right away? Or is it like kind of trying to figure out like, all right, we had a ransomware event, we were down 24 hours, like what's the cost of, you know, lost business? Or, you know, I don't know, you know what I mean? But I think you guys have a breakdown of that.

Or yeah, the two I'll point to, and then Manny, I'm curious what you see as well from your perspective. But of course The like per incident, the most expensive per incident is typically ransomware. In the event that ransomware has gotten to every machine, that backups either were not performed or they were, they were deleted. You know, the per incident cost of that is now well over $1 million, right? Because if you take, you know, $250,000 average ransomware payment, of course they go far higher than that because bad guys know what they're doing. They know the size of your business. Then you take the forensics, then you take the outages, then you take the fines and the regulatory fees, then you take legal costs, then you talk lost business. Reputational damage, like these things just stack up to over $1 million per incident. But in terms of like total volume, absolutely, the business email compromise, and I could lump in like the gift card, you know, scams, which should not be happening today, but they do, you know, that's by far the biggest just in terms of overall volume. It's just the per-claim cost for those is typically a lot, a lot lower. Manny, any others that you would point to?

Yeah, no. So I mean, everything that you just said, Wes, We're still seeing just in our firm and kind of bouncing off of industry experts on the brokerage side, what we're experiencing is a lot of cybercrime. That's— it's tough to kind of identify the actual term because there's no standardization across the insurance carriers on the cyber front. But ultimately, social engineering, we're seeing a lot of invoice manipulation. So the reverse end of it, client receives a bill from So our insured has a client for their services. Client is using the insured. Client receives a bill from the insured for the invoice for the services. Ends up not being our insured, ends up being a nefarious actor. So now not only is our insured out money from a service, but their client just wired the money to someone else. So we're seeing a lot of more cybercrime, but again, it all kind of rolls right back into what Wes Spencer was saying with business email compromise. So it's— we're seeing a lot of the cybercrime and ransomware front occurring.

Cool, cool. So just shifting a little bit, and I know, you know, I've been sitting on a lot of the Fifth Wall webinars, but really the applications, right? I think when we talk about, you know, the title of this webinars really on how MSPs can help their, help their clients, right? Usually it's the— they play, they play as an intermediary between the, you know, the insurance process and the small business. Um, but, you know, I've looked at a lot of applications. I know Fifth Wall has really gone through this process as well of looking at kind of across all applications, like, are they asking the same questions? Are they too simple? Are they, um, I guess I've always been concerned, like, how are the insurers weeding out the bad from the good, right? So, um, just your thoughts, Wes, in terms of, on, on, in terms of that, and, and kind of what are you seeing? Um, is, is there a trend there? Is it changing? And Manny mentioned before, like, a 15-page application, which I haven't seen yet, but yeah, yeah, the—

I mean, these days of, um, even more complex questionnaires at the time of underwriting is It's just, it's going to get more and more complex for sure. Yeah. You know, I think from our perspective, we work with about 42 carriers and so we get to see kind of the nuances and ins and outs. And I only typically only speak when I mention a carrier's name, it's because I'm speaking well of them. So if I leave them off, it's intentional. But, you know, we see some that we tend to really, really like because they do a lot of good work around really trying to assess what is a good security questionnaire, what is, what makes that up, like what's accurate, what is tailored well. And so, you know, as an example, one of the ones that I personally like a lot is, is Beazley, right? And I'm not necessarily saying only use Beazley, I'm definitely not saying that, but I'm just saying their, their questionnaire tends to be fairly thorough but not overly taxing and complex, right? And so just an example of one. But sometimes what you'll see is particular carriers, Tim, will do well in certain industries and, and poor in others. And so, you know, when we're managing this with our MSPs and their clients, one of the things we'll really want to understand is what's What's the revenue size of the business? What's their industry? Because sometimes we're not going to want to place them with a carrier that we just know doesn't fit them well. And, and this is the case, is that one of the biggest mistakes you can make when you're going down this insurance journey is just assume all carriers are the same. They're not. Even though regulations have really forced a standard into insurance and have for quite some time, the differences in how they rate, the differences in some of the things that may go in like sublimits and how they work, can be wildly different from one carrier to the next. And so you really do need, when you're, when you're addressing this, you do need a partner that can understand this, right? And this would be my sales pitch if I had one, is like broad access is really important because it is not uncommon that we'll see someone come in and they're like, man, you know, my policy, you know, it went up. I was paying $3,000 last year. Now I'm paying $8,000. What's going on? I'm like, well, welcome to this world. I mean, it's getting more expensive no matter what. But sometimes you can go and shop the market and find someone a lot better. And one of the reasons for that, Tim, and I'll just close on this one, is, you know, a lot of the carriers are not standardized in the way they go through this process. And so let's say you're a CPA and last year you had Carrier A and that carrier had a lot of breaches from CPAs and claims that they paid out. All of a sudden, if you're a CPA, your cost is going way up. But down the street, Carrier B has not seen a lot of that, right? And so they're like, oh, this is a lower risk industry for us. There should be no problems. Like, you're not going to see that much of an increase. And so that's kind of what's happening right now is there's a lack of standardization, there's a lack of sharing data across from carrier to carrier, and so they're each kind of in their own silo. And that causes a lot of these problems that exist that you've got to really play the market and search the market, um, if, if you want to find a policy that's going to be a tailor fit to you. Gotcha.

To your, to your point, Wes, so we— I am— I'll put my MSP hat on for a minute, uh, went through and, uh, had to go through and renew our cyber liability insurance in November. And, you know, we worked with a couple of different organizations, Fifth Wall being one of them, and like wildly different application questionnaires, application processes, and wildly different sub-limits on all of them. Like, as you were saying, there's, you know, there's no standardization, and just us going through our own process, not even our clients, but our own process was very confusing. I mean, fortunately, you know, we have friends like you, Wes Spencer Spencer, and the team over at Fifth Wall to kind of help us, even as an MSP, navigate what that looks like. Um, we actually were denied one, uh, one company that we went through because we're an MSP. They didn't want to work with us because we are, you know, technically an MSP and they didn't want to insure an MSP. So, you know, it's such the Wild West right now, even for us going through it, let alone our clients trying to navigate it on their own as well.

So, yep, there's only, Tim, to your point, about 6 MSP— I'm sorry, 6 carriers left that will even insure an MSP for tech E&O. That's how much— that's how hard the market's gotten.. And that's how much things have dried up. And you have to understand, when you look at loss ratios across the board, Manny, I think we're somewhere around like 62% across the board right now, but we were up as high as 100+. And so when you're in a boat like that, and many of these come from MSPs that cause these systemic breaches, unfortunately carriers look— Tim, to your point, all MSPs are the same is what they think. And so even though your MSP, Tim, I know because I know you, is definitely much more mature, That's not how they look at it. And so yeah, we're in this boat together and it's really caused a problem.

Well, you know, even going back to the questionnaire, like, and I'll pull Lifecycle in here for a second, Alex, you know, for those MSPs like myself that use Lifecycle, you know, having that fifth wall questionnaire inside of Lifecycle Insights, I mean, Alex, maybe you can talk a little bit about that, but having that in there for us to use with our clients is a really great baseline in giving, you know, Alex, you could probably talk a little bit more about how that works inside of LCI.

Well, yeah, I mean, a lot of what we do is speaking about preparedness, right? Everything that we, that LifeCycle's built on is making sure that we can transparently communicate risks to our clients. Well, what does your insurance company want to know? How much risk that client has. So, if we're already having those conversations, number one, you're in a better place, right? If we, if we start early, if we're doing the preparedness work along the way, and our partnership with FifthWall, they've worked with us to build a questionnaire that our partners can use for free that is a list of the most common questions that they see across insurance applications, you know, across the industry. So it doesn't matter if you're getting your, you know, your Beazley or your Travelers or whatever your policy is. We're covering a lot of really broad bases. To that end, you know, there's an Eisenhower quote, and it's something about, peace time plans are useless, but, uh, peace time plans are useless, but wartime— but in wartime, planning is everything, or something like that. And, you know, it's like, having done the plan isn't necessarily what's of value. It's having experienced the process of going through, filling out an assessment, going through and understanding the work, so that when you get it from your, from your carrier, it's not the first time you've ever seen it. It's not the first time your customer's ever been through it. It's not the first time they've ever heard, hey, here's a remediation plan and these are 3 things we really need to do to shore things up. Because at some point those 3 things are going to be what keep them from getting insurance or what keep them from getting affordable insurance. So, you know, it's about preparedness. It's about getting out there ahead of it. But a lot of it is really just about keeping that, that customer informed and having a good partner for insurance that you can go back to and say, hey, help me explain this. To them, because what we hear across the board is that insurance is helping folks sell cybersecurity products, helping them layer on the layers of the cybersecurity onion, if you will, and with customers that never would have taken it before.

Yeah, that's a great point, Alex. I mean, getting a non-regulated small business to invest in cybersecurity has obviously been a challenge in the past. You know, here's the catalyst, as you know, as you just said, that can finally get them, you know, at least in a conversation on like what they should be investing in or building or buying or, you know, right.

We could argue all day long about why the average MSP customer is way undersecured, right? And it's just a fact. If you look at average, it's terrible to, to to the point of just, you know, not understanding what MFA is or why we need to have it, still pushing back on things. Like, you can blame Microsoft for not having forced it on to everyone, or you can blame the customer for not taking it, or the MSP for not pushing, whoever, doesn't matter. The point is that the insurance carrier actually is the only one with a stick in this, uh, in this equation who can say, well, do it or else I'll whack you with my stick. And whack you with my stick is I'll take away your insurance.

Right.

Yeah.

We're charging 20x, right?

Yeah.

And it's the first time ever where we've had a, um, a tangible thing that we can dangle in front of the customer and say, this changes if you don't do security. It's always been fun. It's always been scary. It's always been, if you don't, we'll talk about the boogeyman under the bed. There's no value in that. There's value in, well, your policy will go up instead of 300%, 800%. Like, sorry about your luck.

Well, the interesting part— yeah, talk about the As Wes Spencer, you know, I've done a lot of, you know, HIPAA, CMMC— well, CMMC is newer, 850— I've done a lot of work in the compliance space, you know. And part of the MSP sales process is— it's not FUD, but it's reality— on like talking to a doctor's office or a dentist's office about trying to bring them through a sales process, you know. And a lot of the objections we would get would be like, I don't need that. Insurance will cover it, right? I don't need that. Like, if I'm breached, my insurance will cover it. So those are the kinds of, you know, objections as an MSP we would get. Now those tides are turning, right? Like, maybe you won't get insured, or maybe your insurance rates will, you know, skyrocket, right? And so from the MSP perspective, like, what used to be a way for a potential client to say, I don't need that, insurance has got me covered. Those tables are turning. And Wes, or, you know, either of Wes or Manny, have you seen that conversation start to change as part of that sales process with MSPs trying to help, you know, doctor, you know, little dentist office with 10 people, or, you know, even a home healthcare or anything like that when they would say, yeah, I don't need that, insurance will cover it for me.

Manny, what do you think?

Yeah, so I mean, it's a— it's definitely a conversation that I've had in my experience involving MSPs direct to the client. Uh, and reality is, is, you know, is the company able to afford the insurance? That's reality. Everyone's kind of being mindful of expenses because what we're discussing is that the insurance market is trying to make a push to better defend their portfolio and the insureds altogether. So it makes sense to implement all the best practices to make it less likely. But in response to, if you do this, will this save credit on your insurance? If you don't do it, will it make it increase? Really, the theme from the carriers is it's a question of not saving money, but are you insurable? At a minimum, MFA is the baseline to be approved to get into programs. Now, I'm not going to say that there aren't insurance carriers that provide coverage without MFA, but that's going to be your difference between, you know, your, your clunker versus your luxury vehicle. These policies are going to have gaps in coverage because you don't have certain things in place. So it's definitely something that everyone should consider, that this is a risk that is not only constantly occurring but extremely expensive. And that they should consider investing more so in their security posture because at the end of the day, that's going to be the least expensive.

Yes. I mean, you talk about security posture, right? Like, I think a lot of what we just talked about in the last 5 minutes is about how do we check the box or meet that insurance application requirement? How much— I guess when you have this conversation, this might be— this might be for Alex, right? Talking to MSPs. How much of it's like, oh, we, we're just gonna have— we're gonna work on having better insurance or better cybersecurity posture, hardening hygiene, like every year we're gonna, we're gonna pick a framework. Um, you know, how much of— do you think you can— do you think they can sell that narrative? Like, and this may— and I kind of jumped ahead, um, from Wes and Manny, but like, are the applications changing quickly? So you, you might as well just like do the right thing and have great, you know, cyber security investment in place? Because the— are the applications changing so quickly that, you know, in order to kind of play the game, like, you're gonna have to up your game every year? So I don't know, maybe I'll go first on the changing requirements for Wes and Manny, and then maybe Alex can talk about, like, you know, selling that and selling that narrative right to MSPs. So Wes, any comments on that?

On which part of it, Tim? The changing requirements and how to keep up?

Yeah, is it changing? Like, it seems like we're kind of like in this process, like we want to position or we want to position the small business to meet the applications. Like, as you said, like they'll do MFA, they'll do MDR, but like Obviously, you know, as you're given your experience as a CISO, like how much of that is great, like cybersecurity and how much of that is like, you know, theater.

So great question. A few things stand out to me. One is never forget that a security aligned journey in with your clients is the most important part. You know, this is carts and horses and the horse should always be pick your framework and stick to it. CIS, NIST CSF, either of those are solid. If you mature and walk through those, you're going to find the insurance mapping is going to be much, much simpler. There will always be things that stand out that you're like, why are they asking about this and not that? Right? Like, why are they so hung up on, you know, I don't know, I have to think hard about something. But, you know, like application whitelisting when, you know, I don't have MFA rolled out properly and they're not asking that question accurately enough or, you know, privileged access management has become huge. That's a big one. Why are they not asking more questions about Pam when they ought to be? Right. So, so you're going to see that kind of stuff for sure. But largely, if you follow the journey of an aligned approach, you're going to be in good footing to be prepared for what comes in the future. Now, two things I'll share that will help you in that is one, get in front of the insurance game at least 2 to 3 months before renewal, because that way, if you see some things that seem strange, you're like, why are they asking that? I am not ready for that. That gives you a chance to go back to the carrier via your broker, your distributor, whoever, or agent and say, can you ask the carrier? This is a question they're asking. How important is that if I say no? Because right now we're not. Is that a big deal? And they might come back and say, oh, that's critical.

If you don't have it, we're not binding.

Well, guess what? You now have 2 to 3 months to roll something out. So get in front of it early. It will always pay off dividends. The second thing I'll say is this goes back to what Manny said at the very beginning. Welcome to this world of insurance where nothing is standardized yet. And it all started from, from false presuppositions that this is like giving candy to babies, and it was much more difficult than that. So now we're paying this price. And so what you're seeing carriers do right now is this evolution of, well, how do we go from point-in-time underwriting into continuous underwriting? So like, how can I really assess where, where this insured is throughout the journey of me binding with them for the year, right? And, and they're also exploring things right now that I just think are not ideas. Like, for example, many of them are doing like external vulnerability scans before they bind. And so they're like, well, tell me your domain names and your IPs and we're going to scan it and that's going to be part of our criteria. And then you get a big mess of stuff that comes back that's inaccurate. The carrier says, no, we're not going to bind with you. And you're like, time out. That's not even my infrastructure. I don't know what you scan, but this is not right. So they're trying to get better at this. They just don't have the full answers yet. And so that is kind of a longer-winded answer towards where these problems exist, Tim, and what's going to have to happen to fix it.

Gotcha. Gotcha. And you mentioned picking a framework, Alex. I think you guys have worked a little bit with CIS, which is also, I know, Tim and Team Tim's favorite framework as well. But you want to comment a little bit about that and, you know, how you leverage that?

Well, I think, you know, CIS is my favorite framework just because of how prescriptive it is, right? As a dumb sales guy that ran an MSP, it just made more sense to me. Um, and I think a lot of MSPs are coming at this from a give me an answer, like they need more than just the theoretical, and this seems to be a little theoretical. But they, they get— I think they get a little more easy handholding from CIS IG1, IG2, IG3. It's just really well mapped and laid out, to Wes Spencer's point. But, um, you know, Wes really made the wonderful point, which is get every single one of your clients insurance renewal dates. If you don't have a tool like Lifecycle Insights where you can track it as a contract, just track it as a configuration. Set an expiration date on it and get something to bubble up at the top. Like, this doesn't have to be fancy. You've got a tool, right? Let's take a tool and set an alarm and get something to go off so that we have 60 to 90 days in which we can get out in front of this and say, Mr. Insurance provider, what are your requirements going to be for my customer this year? We want to make sure that we're proactive and we're out ahead of it. And let's go ahead and run that assessment internally, even though it's just a preparation. Like, let's get out in front of it, do the homework, and, and make sure that when, when go time gets here, um, we've practiced, we have a playbook, we know what we're supposed to do, and we're ready for that, for that insurance premium. Because otherwise you risk some sort of a lapse when you can't answer the questions fast enough, you can't get the, the right things done in a timely fashion. Um, if you're doing these for a bunch of customers all at once, um, you're going to be backed up, your MSP is going to be backed up, and you're just going to have a bandwidth issue. So the thing that gets you out ahead of that is planning.

Awesome. Yeah. So in terms of planning and executing, I guess the last thing as well is documentation, right? Like, how do you prove that you're doing the right thing? I was going to jump to Tim because he is the policy documentation master, but also Manny, I think I asked you this question yesterday. The application is what it is, but could you provide more, right? Are you able to leverage additional materials in those, in those applications? Sure. Any, any thoughts?

Yeah, yeah, absolutely. So, and it's already been said, but it really just begins with making sure you're partnered with the professionals that understand what they're doing. Everyone listed on this webinar, because to that point, Anything that's going to support a strong security posture should be submitted to the insurance carrier. As an agent, I represent, uh, our clients, our insureds. I need to understand what they're doing from a compliance framework. I need to understand what carriers— like Wes Spencer had said, I already know what market is going to be competitive based off of their revenue and industry. That's going to get that direction going. That's going to allow me to understand what application is going to be best to submit. But at the same time, these applications are pretty— it can be large. So therefore, having something that's simple for the insured to complete, and Beazley is a phenomenal application. I like to use HTC Tokyo's in addition to that one. It captures a 360-degree security posture that allows me to have a more in-depth conversation of what might be missing. What did they say no to? Why did they say no? Or if they say no, are they open to implementing within a timeframe? I'm building a narrative, I'm building a story, and I'm selling that to the insurance carrier because again, it's a partnership. Let's all get on the same page of what our insured's goals are, what our carrier's capacity is, and then let's all get on the same page with where we can keep moving forward to, to better secure the overall posture. So I absolutely send more information in addition to the application. Really trying to illustrate that this is a great risk for the carrier to, to insure.

Awesome, awesome. Yeah, that's, uh, you know, so, so far we've talked about some of the most important things MSPs can do. First thing is obviously know those dates when the renewals are coming up. Um, second thing we talked about, um, was, uh, obviously the intermediary between having a great, uh, insurance intermediary like a fifth wall or or someone like Manny, if you don't know what the good things you need to be doing, you're not going to do them and you're not going to position the client. So obviously you guys are pivotal in securing good coverage. Documentation. Tim, I know you're working on some documentation pain relievers, I'll call it that. Yeah.

Having spent the last 17+ years writing documentation. Yeah. So, you know, it is interesting. Like, I remember one of the cyber applications actually asking for my incident response plan. But then they were asking, you know, a bunch of other, like, non-related questions. So, you know, I don't— I can't speak for the insurance industry. I mean, that's Manny and Wes Spencer and their team's job. But I can foresee a future where insurance companies start to ask for, you know, what do you have for documentation? Do you have an incident response plan, a disaster recovery plan, a wire fraud protection policy, right? Any of those kinds of things that help you and your clients protect their business. I can foresee a future where that will be coming sooner rather than later, right? So as, as everybody's kind of shared so far today, it's the Wild West. There's no real standardization. But as they start to build their data and their actuary tables and get, you know, kind of on a more level playing field, you're going to start to see these questionnaires and the artifacts in which they're going to want increase, at least in my opinion, right? And so that starts with a solid documentation program. And what do you have? You know, I think Wes Spencer mentioned CIS. Kind of an iterative process, like hardware list, you know, assets, software, you know, all of those kinds of things. I just can foresee this future where you're going to be asked for this documentation, and the standardized templates are just not going to cut it anymore. And so that's why, you know, we're trying to bring, you know, some awareness around that and try to help educate MSPs. You know, I mentioned it earlier in the LinkedIn chat. I'll throw up the wire fraud policy that I have on our website at Compliance Risk here tomorrow so you guys can kind of use that as a template. There'll be others available there too. But, you know, if it's not written down, it doesn't exist, and yet you'll still be held accountable for it. So everybody hates writing, but, you know, what that does is not only does it define and help you and help your clients kind of have a standardization, but it also gives you the reference to look back and be like, oh yeah, this is what we do, this is how we do that. Like, what good is a password policy if you don't actually write it to a standard, write it to the business practices in place, and train your end users, right? And these are the things that I think, at least I can foresee, the insurance companies start to ask as we, you know, progress into the future. Future.

Well, writing it down goes way beyond just insurance though, right? It's the— when we have it documented somewhere, we know that in a— in the emotional moment when something's going wrong, right, we have something that was created in a non-emotional void of emotion where we could actually— we can go follow it now that we're, we're wrapped up in the middle of the situation. We're not answer— we're not answering rashly. We're not addressing something. Um, you know, just when you're mixed into a cyber breach or any kind of an incident your emotions are going a million miles an hour and you're going to make mistakes. So it's to the insurance company's benefit to make sure that you have it, and it's obvious that one day they will. Um, the last thing I'll say is just, um, we have to remember that as much as this is a journey for the insurance carriers, it's also a journey for all of our clients, and we need to remind them that we all have to start somewhere. And even if you feel like you're way far behind today, if you don't start today, you won't get any better. And it's— this is the epitome of 1% better every day. Um, none of our clients are going to fix this overnight. The insurance companies aren't going to fix this overnight. But as long as we're all moving in the right direction, in the same direction, um, much better things will happen.

Yeah, I mean, I mean, let's face it, like, us as MSPs, we have documented repeatable processes, right? It gains us that operational efficiencies, right? We have onboarding things, offboarding things, like It's just doing what we're currently doing, but in a different discipline, right? It just helps us, you know, be prepared. I think somebody put a couple of great quotes in the LinkedIn chat on like that preparedness of, you know, having, having a documentation system, having something written down that says this is how we handle X so that when X happens, we know what to do and we're not, like you said, Alex, going, dealing, you know, leading through emotion without the process in place.

Well, I know Wes Spencer can agree, um, just quantifiably from the numbers, having those documentation or processes in place when that breach occurs saves tons of money exponentially. It cuts costs big time because you're reacting in real time. You know what you're doing. You, like you said, Tim, removing the emotion and you can clean that up a lot sooner than like you're running around with your head cut off and that's going to save money at the end of the day.

Awesome. Awesome. I think we'll wrap it up, guys. You know, obviously some great tips for MSPs, you know, obviously finding a great intermediary like Manny or Wes Spencer and the Fifth Wall team, very important. Just doing, you know, really trying to position the small business to have good security with a framework like CAS or NIST. You know, that's important. And then documentation and being— and as you said, being proactive, being 3 months ahead of these, of these applications will be huge. So, you know, thanks everyone for joining and some great tips and great guidance here for hopefully tackling 2023 here and really positioning those small businesses. So thanks again. Thanks again for jumping on and hope to talk again maybe in 2023. See you guys.

Thanks, Tim. Thanks, everybody.

Thanks, Tim.