Is Cyber Insurance getting even MORE expensive?!

What is going on, everybody? Thank you for jumping in, listening to a stream here about cyber insurance. I know it's always so fun. Um, it may take a little bit for people to creep in. So I'm going to, I'm going to open up the chat for if anyone does come in. Actually, I'll wait. If anyone jumps in, we'll open the chat. But I am joined here today by Wes Spencer. Wes, you want to say hi, introduce yourself, let people know where you're coming from?

Yeah, for sure. Hey, Will. So you got Wes Spencer here. I'm the vice president of security strategy at CyberFox. We are— CyberFox is a super cool company focusing on privileged access management, which is becoming a big topic in the cyber insurance scene for sure. But I'm a— I love MSPs. I've been a security guy my whole career. Advisor with Fifth Wall Solutions, man, you guys know how much I love you guys and also do all kinds of stuff for MSPs. So great to be here.

Awesome. Wes, thanks for jumping in. We do have some people even though it says zero. So that's always fun.

It always says that on— on— I don't know why Link or Restream does that, but yeah, you have a bunch of people join and it shows zero on my end. It always does. That.

Yeah, that's— so I'll open up the, uh, the comment. It's weird, I don't know, it's probably some API thing that's broken. Um, they make it really complicated with LinkedIn too. They say you can only add one account or different things like that, so it just gets a little wonky. But, um, yeah, we got my friend Phil here. Hey Phil, thanks for jumping in. Hopefully you learned something even though this probably has nothing to do with you. That's the best part. Awesome. So, uh, yeah, we're going to talk a little bit about reinsurance. They actually— Phil works in insurance, so This is something. So we're gonna talk about reinsurance today, specifically around the cyber insurance space. Exhilarating topic, but it talks, you know, there's some news coming out recently about increased cost for reinsurance. And, you know, you might be asking, what the heck is reinsurance? I've never heard of that before in the first place. And we're gonna just really briefly define that. Um, so I'm gonna just— I'm gonna make this super simple. We're gonna bring this up. Um, as, uh, Investopedia would say, reinsurance is insurance for insurance companies. It is literally that simple. Um, reinsurance is, is a way for insurance carriers to pass off the risk. So when you're an insurance carrier, you're taking on all this risk. You're taking— and I'm gonna pay— I'm gonna charge this much in premiums. I'm gonna Thanks, Alex. Yeah, that's, that's very true. Um, takes me a long time to do my hair. Actually, my beard, I did have to put some oil in it before jumping on here, but that's because it was super dry. Um, reinsurance, just to put it real simple here, is a way for insurance carriers to not have to go completely bankrupt if there's a ton of losses, right? So if a— if the losses reach a certain threshold they need to then make insurance claims to recover some of the losses they've had to pay out. It's— I mean, that's how I'm going to put it that simply. Um, but you don't typically see rate increases in reinsurance unless carriers have had a significant number of losses. So, um, I mean, we're going to dive— this thing— we're going to dive into an article here in a little bit. But, um, Wes, does Anything else you want to add to that? Kind of.

Well, first of all, can we, can we appreciate the humor of Investopedia for a minute? That like I get on Investopedia often when I'm trying to like figure out, you know, this is a stock agreement. Do I really like this? You know, what does this, what does this term mean for me? And they're always so serious and they're always so like, you know, aboveboard professional. I actually like the humor in this is just awesome, right? I mean, the fact that they, they define it, you know, like how to pronounce it. The little, like, what do you call those little Russian dolls?

Little Russian nesting dolls.

Yeah. You know, the fact, I mean, that's like they nailed it there, you know, insurance for insurance companies. I mean, I just, I love the humor there. I didn't know they typically have apparently a very dry sense of humor that I love. But no, I think that helps because I don't think a lot of MSPs know what reinsurance is. They don't really even know how the insurance marketplace works in the sense of like, well, I just talked to an agent and that agent has, you know, like I don't know, State Farm on the window, and they just— that's how it happens, right? But there's a lot more that happens behind the scenes. If I can steal from Reed Wellock, your president, you know, Reed's like, if you really boil down insurance, you know, it's a half-millennia-old basically legalized gambling on mountains of data, you know. And that's a good way to look at it. And I don't think we actually understand— most of us understand, including myself, you know, how the whole kind of tier of insurance works. So it is important we start with, reinsurers, because that's a big topic of today's discussion.

Yeah, I mean, put it plainly, you buy your insurance policy from a carrier. That carrier has to buy an insurance policy in case they have to pay way too much out on all the people who bought insurance policies from them. So it becomes this tiered system. But the reason I want to bring that up is we've, you know, there's an article that came out, I guess it was late last week, but I've been seeing other articles um, since then about the same topic. So it— I'm going to bring that up on the screen. Oh, it's up there. Sweet. All right, so this, this topic: reinsurer cyber rates expected to rise as they seek to regain profitability. So the S&P, um, who does a lot of ratings on specific carriers, but they're also doing surveys on pricing and the reinsurance market and all this kind of stuff, they, they basically did a survey where it turns out reinsurers are talking about raising their rates. And we see reinsurers had a difficult 2022 due to low profitability and even underwriting losses in their cyber portfolios. Um, so this, this kind of— Wes, one of the reasons I want to bring this up is I feel like a lot of the data that we, we've shared with MSPs kind of juxtaposes what reinsurers are talking about, right? So from the— from, from the MSP— from the standard carrier market, so like down the carrier line here, so the person you're buying your insurance policy from, do you recall some of the statistics you've shared in that area before?

Yeah, I mean, I talk about this all the time, and this struck me as interesting, right? Because I'm not the insurance expert that, you know, that you are, that Wes Spencer or Reed are, you know, but I did stay in a Holiday Inn Express last night, right? So I've been in the industry for quite some time, and the talking track that I usually use, which is true by the way, is If you look at the trend over the past few years, we, we really, um, fell down hard, got bruised up, and now we're back up and running a lot better. In other words, what I mean is, you know, 2019, 2020, 2021 were really bad years, uh, for consumers and really just the insurance carriers. They had loss ratios that went out of control, 70 to 100%. I mean, that, that's, that's as bad as it gets. You know, we saw the of cost of premiums doubling year over year. I mean, literal hockey stick growth. And then we also— and then lo and behold, in 2022, when the data came out, we saw for the first time a huge reduction in loss ratio. And so when I'm talking to end-user clients, one of the things I'm telling them is, hey, a couple things stand out here. One is this reduction in loss ratio is because insurance has gotten really expensive, but also We've reduced losses because of all of the things the carriers are now mandating. I mean, I'm just telling you, when you put in 365-day-a-year monitored EDR from a quality EDR like a Huntress, a BlackPoint, you know, a SentinelOne, that makes a difference. When you put in a great privilege management solution like CyberFox, you know, just saying, that makes a difference. When you put in MFA everywhere and you don't budge off it, it makes a difference. So the talk track to me for the clients is like, That's why loss ratios reduced over 2022. So then when I saw this and it said, well, the reinsurers, the guys that are on top of the carriers, had a difficult 2022, I'm like, well, how do you justify that? I thought if like the down market, we have lower losses, everyone does better. But it may not quite be that way, right, Will?

Yeah. And that's where things are a little strange, right? I mean, this is an important statistic here to highlight the importance of reinsurers to the cyber insurance market. The S&P pointed to the fact that In 2022, so again, this is a year ago, right? That a lot of the data we've shared was from 2022. So in 2022, primary insurers ceded about 50 to 65%. So primary insurers are the ones you're buying your policy from. Those aren't the reinsurers, right? Of cyber insurance premiums to reinsurers, depending on the region. So there's, they have this whole chart on the different regions on where that happened. Interestingly, I mean, we're focused primarily in the North America market, so that's where I can really make my most of my observation, but I know that the North American carriers, and I'm sure, I mean, you know, I get on calls with, with, uh, MSPs who are in England or, uh, Canada, different areas. I mean, Canada is part of North America, but, you know, England, um, sometimes Europe in general, and they're, they're getting hit with very strict applications too. So on some level, um, I know that the carriers are seeing lower, better loss ratios. It's weird to say, but better loss ratios, right? So that's a good thing. But at the same time they had to cede a lot of their losses over to these reinsurers. So the losses still were coming in, and unfortunately we were at a point where— I, I'm guessing what this data means is that the losses were still at a point where it wasn't quite enough that the insurance companies were able to, uh, handle it all themselves, right? They were going to these reinsurers pretty heavily. It says 50 to 65%, so half of their losses, it's premiums, right?

Is it 50 to 65% of the premiums were going over to them, right? If I'm reading—

sure, sure, yeah. Um, but again, those premiums, you know, they're, they're— that means on some level that 50% or more of what they were charging for cyber insurance, they were then paying over into reinsurance, right?

So, and, and why, Will, why is that? Because I'm actually curious. I don't, I don't know this. Why is it Why is half of those premiums going over to the reinsurers? Is it to like stack them back up because they have to, they have to recoup those losses? Is it just because that's how the agreements work? Is it because that's the level of risk and those are the agreements the carriers agreed to? Like, why is it 50 to 65% of those, those, um, those premiums going over to them?

Yeah, I'm not sure on the— I mean, it might be different on a carrier to reinsurer basis, but I'm, I'm guessing on some level, I mean, they have to pay their premiums for their reinsurance policies. So it might be saying that, you know, 50% of what carriers are charging for a cyber insurance policy is going towards paying the reinsurance, uh, premiums on their end, uh, for those cyber insurance.

I'm—

I don't know for sure, but to me that's kind of how I read that, is the mindset that right now when you look at your premium, if you're paying $10,000 for a cyber insurance policy, $5,000 of that is going to reinsurance. That's a lot.

That is— if that's what it is, that is a lot.

That's significant.

Well, so, and that's just what I, I mean, I don't know, but that's what I was guessing is that the reinsurers through 2020 and '21 probably took, we know they took mega hits, right? We know they did. So I just was thinking, well, is that to like recoup those losses so that they could increase capacity? 'Cause if you go down, can you go down to the next paragraph? They talk about that a little bit there. As the insurance market develops, the reinsurance market will mature as well. And then some of the larger reinsurers are saying, we're close to capacity. We've done all we can do. We can't issue out anymore., and that's causing, um, you know, you see other reinsurers exploring, well, what can we do on that, right? So I thought maybe that is what's happening here. I, I'm not smart enough to know, but I am smart enough to know that, um, you know, this, this tells me this is— we know it's not going away. Later down the article, we'll get to this. It's the fastest growing line of insurance out there. So we know this is the future. It is good to see though other reinsurers kind of coming in and saying, well, what can we do? This if, if we're hitting others that are having capacity.

Yeah, definitely. And I mean, that's something— it's a little, it's a little weird to think about because I think sometimes in our head, all right, I get a million dollar policy, so I have a million dollars in coverage. But if, you know, every person, every business that I'm close to also gets a million dollar policy from that particular carrier, that carrier is committing to a certain amount of money. Now, if all of those people have to file claims, that's a ton of money out of the pocket of the carrier. So then they have to go up the chain to their reinsurer, right? And it becomes this chain of reinsurers over and over and over and over. But I think the, the reality is, I mean, I have a friend who's an underwriter and he, you know, he tells me like, hey, every underwriter is given a set amount of premium that they're allowed to write every year. And I'm guessing on some level reinsurance kind of remains the same. So you have to kind of balance, you know, if you take— if you're given— you, you can write $500,000 in premium this year, but if you're if you take on one client that costs $100,000 in premium, you've just cut your book down by a fifth that you're willing to write. So you have to kind of play that balance game, right? And I think there's probably some of that involved in the pricing and all that kind of stuff too. Um, so it gets, it gets really complicated as you go up the chain because we don't really see that deep, right? We see the articles come out with the pricing so we can kind of make guesses here, but when it comes to the actual where's this money going, how's it being utilized, all that kind of stuff You don't really know, but then you have stuff like this about, you know, about 56% of gross. Did you have something else?

Well, I was just going to say before you get to that point, keep it highlighted, though, because I want to— I want you to jump into that. The reason that we have these— the when, when, when you see words like they're close to capacity, they've hit capacity. This is a very regulated industry. I came out of banking and banking was the same way. We had what's called loan loss reserves, and we had certain amounts that we were legally able to lend up to. So as a bank, let's say your bank has $20 billion in assets, well, that doesn't mean they can lend out $20 billion. It means because, because there's concern on, you know, take what happened in 2008, all these homes start going underwater because people were being lent to and given loans that they couldn't pay back on, and it caused a systemic downturn, and it literally was going to eliminate a bunch of banks. Now politics aside of how we handled that or didn't have it, doesn't matter. The, the issue is that signaled to regulators we need to be a little bit more careful on how much a bank is actually able to lend out. What's the quality of that capital? What percent of that capital can they lend out? So this whole, like, we every year we had examiners come in and look at our capital, look at our liquidity, look at these things. And so I, the same thing is happening in the insurance space is just because the reinsurer says, well, here's, you know, $10 billion we're putting up, does doesn't mean they can lend out $10 billion, right? They have to have limits on all that because things can tumble. And so, yeah, I just wanted to say that. So when they say they're hitting capacity, you know, that's not necessarily a good thing or a bad thing. It's just showing that the demand has filled up and maybe losses have caused, you know, they just— that their capacity— they didn't get to lend out, they didn't get to have as many policies issued out as they might have wanted. It can be all of those things sort of tumbling together. Right. But it does show activity in the market and it shows you know, that there's room for more. And I think that's, that's an interesting take.

It's also, I mean, you talk about demand, and there is a huge demand for cyber insurance right now. I mean, it's, it's crazy the number of MSPs we work with who, you know, they have clients coming to them who are willing to implement controls just because cyber insurance is saying they need to. Like, people want cyber insurance, which is interesting, and the demand is there. And that's another reason why the capacity is being met, right? Right? So the supply is almost running short to meet the demand, right? Just classic Economics 101 stuff there. Um, and I guess, yeah, I guess I, I want to bring this in here. There's specifically, because you could be watching this, you say, okay, reinsurance, whatever, this is really nerdy insurance stuff, Will, why are you talking to me about this? One, because it's fun, but also I think on a, on a different level, how does this affect the end user, the insured, the person who is buying the policy. Because the question here is, if, if the reinsurance cost is going up, so if carriers have to pay more for their reinsurance, is that going to trickle down and affect the end-user prices? And, um, on some level, I mean, you can't say for sure, obviously, because it sounds like it would, right? On some level, it feels like, uh, if, if my carrier has to pay more, it's, it's almost like you go to the grocery store right now and you want to buy chicken Chicken or eggs. Eggs is a great example, right? A carton of eggs used to be like $2. Now it's like $5 because the grocer has to pay more. It's all inflation and all that fun stuff. So the chain, if the supply chain starts to cost more, it should affect the end user. But in this case, there's a lot— it sounds like there's a lot of encouragement from, uh, you know, different reinsurers and the reinsurance market to, as they talk to their carriers who they reinsure, to not inflate the cyber insurance market pricing. I mean, I am seeing that on some level. So that's where I just— I look at that and I don't know if it's super addressed in this article, but it's something that I think we need to talk about because the fear is always, how is that going to, you know, am I going to have to pay more money for cyber insurance?

Yep.

Yeah.

A couple of things that stand out to me. I want to make sure we don't skip by it and forget the paragraph right above what you had highlighted. You know, so S&P says that, and again, they're looking at this data just like Fitch and others, that cyber insurance is still— it didn't become— it is still the fastest growing subsector of the insurance market. Premiums about $12 billion in 2022. And I've looked at future forecasting. You know, they're showing by 2025 it's going to double to $23 billion. I mean, that's— yeah, that's doubling, guys, in just a couple of years. And then you look at, I think, 2030, '08, I think I was looking at some of the long-term projections and something, something like a little over 10 years from now, they're saying that cyber insurance will be the largest insurance market out there. It'll be bigger than auto, bigger than like, you know, home, bigger than, you know, you know, all these other things. It's going to be the biggest. That's nuts to me. It really shows just, you know, how young this area is in insurance. But The fact that it can eclipse stuff that's been around for decades and decades and decades in just, you know, a few short years is mind-boggling to me.

Well, yeah. And, you know, I have conversations with, with people all the time around this, though, is— I mean, okay, obviously I work in cyber insurance, so I'm going to hear more about cyber claims. But at the same time, I can recall hearing more about cyber incidents happening, whether it's in the news, whether it's in just knowing that this has happened, someone got hit. Even, even your friend might, you know, post, oh, my Facebook got hacked. I mean, that's not a claim, but it happens, right? It's so— it has happened to more people that I know personally than a car accident, than a fire, than— so, so the actual threat, I think, is more real for people because everything is digital today. There are people who work from home who barely drive, right? But then there are They are accessing the network and accessing their company data all the time, every day. So, so I feel like the threat is very real, and that's why the market itself is probably growing pretty rapidly of all lines of insurance. And so to your point, it, it doesn't surprise me that it's going to explode. I'm curious to see it surpass because like things like commercial property, forever commercial property policies and things like that were those were the, the top, top earners for a lot of agencies because you were, you were putting together this package policy where your business had all these things, crime coverage, all these pieces. And now you have a lot of businesses that completely exist remotely, so they don't even have property anymore. So how are you approaching this, this whole new change, this whole new world of insurance? Um, and it's— and there's a lot of words that are used throughout this article like maturing, growing, learning. You see increase, decrease, decelerated, increase— like all these different terms that really just make it seem like it's still figuring itself out, right? And I know we say that a lot, but at the— the reality of it is, is that cyber insurance really didn't get serious until the pandemic happened, right? I mean, the policies were accessible, people could buy them, they were cheap, Um, but there was no real security requirement around it. Underwriting guidelines were basic. We only needed to collect like 5 pieces of data from someone, and it had nothing to do with their security. So, and that's maybe the piece to, to address here, is as we, you know, talk through rises in, in reinsurance, if, if it's trickling down to the end user, um, well, did we hit everything in the article you wanted to cover? On here, Wes Spencer?

No, there's actually a bunch more things I wanted to talk about.

Okay, good. Me too. But I meant— I meant around that.

Oh, yeah. No, around that is great. Yeah, that's great. Okay, so can we shift over? I'm looking at my side. I want to make sure you get to it as well. The one that's— yeah, just right below that where it says insurance insurers have adjusted. Yeah, that's the guy right there.

So we actually talked before that.

Oh, sure. Go ahead.

Because this is what I was talking about before affecting the end user. Right. So You— what Wes has talked about, um, and it's not so much a decline in premiums, um, I think we need to— they talk about it a little bit here, but, uh, the average increase in cyber insurance premiums— we have to kind of preface that— it's the average increase in premiums fell below 10%, not the premiums themselves falling below 10% of what they were the year before. So that's continued premium The increase has decreased over the past year. Your pricing has still gone up, but it's cheaper than it was, or it's lower than it was. So the increase has decreased, right? So, um, I want, I want to make sure we're clear on that. But, um, the report that they're specifically talking about, it was an S&P report, um, it attributed to the decline in premiums to increased competition as more carriers have begun to offer cyber insurance, as well as the measures that insurers have taken over the past 2 years to cut exposure and increase rates. So Wes, what you were talking about way at the beginning of this this talk, um, we have been doing a lot on the security side to make sure that the risks are better, to make sure that they are less likely to run into a lot of the incidents that were plaguing the cyber insurance industry in 2020.

Yep.

Uh, and that's, that's why even though you're not seeing a— you're not seeing a decrease in premium— and just to be clear on that, it's like if you have a policy from a carrier, chances are chances are— it could happen, but chances are that you're not going to see your policy, your renewal, come in cheaper from that same carrier. Another carrier could write it cheaper, right? But from that same carrier— and that's what we're kind of getting at here— but there's increased competition. And that's something that I know you've brought up. The market is finally softening, which is a very nice thing to see. So, and that leads over to what you were just saying before.

It does. And I want to talk about two things. One here that I think is great for us, and one that worries me from that, that same paragraph. One is I think the increased competition is mega important. If you're an MSP and you're listening today or you're a business owner outside of the channel, but you're just, you know, or a CISO at a company and you hear things like this, SMP saying that increase in competition is coming among the carriers, that, that should be a signal to you to say, well, am I taking advantage of that? In other words, as the market softens and carriers start to say, huh, We're actually starting to get a grip on this. Loss ratios are coming down and, you know, we're not seeing such a vast increase in premiums. If you're not shopping the market, what that means is you're potentially missing out. And I'm just— I mean, I know it sounds like a GEICO commercial, right? But like, you're probably missing a bunch. You're probably overpaying quite a bit. And so you need to make sure that you do that. You need to make sure that you're actually shopping the market. Just because the carrier you used last year does not mean that they're suitable for you this year. It is not uncommon. I mean, if we brought Wilson on, I mean, I mean, that's kind of like Fifth Wall. It's what— that's what Fifth Wall does. I mean, Fifth Wall shops across 43+ carriers. They're going to go find something that's a better fit for you. And that can change from year to year based on the industry you're in, the revenue sizing, the way that the underwriters are sort of rethinking and re-quoting. So that increased competition means that, you know, there's opportunity for you to save a lot of money. And I just— I see over and over, Will, that people are like, oh yeah, we had XYZ carrier last year. I'm going to use them again this year.

Well, why?

Why are you being loyal? Uh, you know, in the sense of like, you should just make sure that you're doing the right thing for your company. Don't just go pull the trigger again with the same carrier year in and year out without shopping.

Yeah. And I, you know, before moving on from that, I theoretically, what you're saying makes sense across all your lines of insurance, right? You should, you could shop out your auto policy every year, your homeowners, your business owners, all those things. But cyber is so volatile. That we've seen savings from just shopping out a policy going from like $10,000 at renewal to $6,000.

Yeah.

I mean, that's a big jump.

Huge.

And no changes in coverage, sometimes better coverages. And that's just because different carriers are taking on different risks and they have different appetites. And it's so volatile that you're able to kind of win pretty big savings that way.

We had just a funny story on that one. We had one of our MSPs called us up and said, hey, they're like, let me tell you, Cyberfox, this little story I I just had. They said, so I had a client who is going through their insurance renewal and it was, you know, got— it's fairly expensive. And they talked to the, to the agent and tried to get a better handle on what was going on. They're reviewing the controls. And one of the things that they realized was they had the no box checked on privileged access management. They said, well, what happens if we check the box? And they said, well, let's go back and re-quote and kind of figure that out. They came back and the quote was not just way cheaper, it was cheaper. It was— they— it basically paid for CyberFox, plus they still saved money. And the MSP was like, this is the most, like, no-brainer decision I've ever had. I didn't even have to sell CyberFox. I'm like, hey, you see that checkbox? As your MSP, we can meet that for you, and you're going to save money, and it basically is cheaper and then some. Like, why would you say no to that? And the client's like, why are you even talking to me? Of course we're going to do that, right? Like, that's the kind of stuff that Yeah, you've got to be proactive on this stuff because the softening of the market and the additional increase in controls is a big deal.

And that's— I mean, if you think about it, it could— one control, one, one additional security measure for your business could change not only your pricing, but it could change your coverages. I mean, there are certain controls that if you don't have them in place, carrier will say, fine, we'll, uh, we'll still take you on as a risk, but we're going to charge you Uh, you know, $2,000 more and we're not going to give you ransomware coverage, or something like that, right? It could be anything. And it's just to, to shore up your security posture, to consistently be looking to mature your security so that it is in line with what— at the very least, in line with what a carrier would consider not just a good risk but an optimal risk, I think is something to, uh, constantly be striving for. And as an MSP, why not shoot for that with your clients? Why not work them towards that mindset of saying, hey, let's help you get there. Let's help, let's help you save money. Because if the story can happen to that MSP you met with, Wes Spencer Spencer Spencer, it could happen to so many others that, oh, actually it ends up being not just a wash in terms of security, but my client ended up saving money overall. And both parties, and they're better protected on both sides of the boom at that point, you know. So it's, it's that, that mindset, and that's kind of where this is approaching. I know we But that kind of— you wanted to bring this up and this kind of, this kind of feeds into that a little bit.

Yeah, it does. Because before, just one quick thing to say and then it goes right into this next thing you have highlighted. I said like there's one thing that makes me excited, which is that right there, the increase in competition. But the other thing that paragraph said right before it as well is that they're also doing some things to cut exposures. And so when I hear carriers say things like, well, we need to cut exposure to certain areas, then I'm like, well, what, what are you— what area of exposure are you cutting yourself from? Because if we're not careful about that as buyers, as MSPs and clients, as buyers of cyber insurance, we could potentially— who shoulders the exposure? I mean, someone's going to be exposed, right? So if the carrier is saying we're cutting ourselves out of this piece of it, then does that mean that I'm on the hook for it? And that's what this next paragraph gets to, right? Adjusting contract terms and conditions, increased retention levels, meaning policyholders retain more risk and reduced coverage. And then they mention the two, especially And these, Will, I think you would probably agree that two of the most expensive ones in relation to ransomware and business interruption coverage. Now, at Rite of Boom this past year, early this year, we had director, one of the assistant directors on, Brandon. I just forgot his last name anyway. And one of the things he kind of quipped on, he didn't really elaborate, but he did sort of say it. He said, when we're talking about ransomware actors, He said the cyber insurance carriers haven't helped. In other words, he's basically saying they've hurt because they've sort of said, well, we've covered ransomware payments. And so what does that do? It incentivizes the bad guy. I'll be the first to stand up and say I don't think that should be legal. Like, I would— I don't think carriers should be able to pay the ransoms. I think carriers should have the ability to help in the lost business interruption costs and forensics and all this. But I just don't see why I understand his position. And so when I see some of this limiting and ransomware and business interruption, like some of it I support, some of it I don't support. Right. And so curious what you think about that whole statement there.

Yeah. Well, the business interruption one, I mean, that's an extremely important coverage because if you have a ransomware attack or just a general— I mean, what's— what I'd say the average Downtime for a business during ransomware is like 14 to 16 days or something like that. Yeah, it's a long time. So even if the insurance company wasn't going to pay ransoms anymore, so let's say they were, they pulled ransomware coverage, just said that's not going to be a thing anymore. There's a lot of other coverages that are still really vital, and business interruption is one of those. I mean, if you have a policy that doesn't cover business interruption, you have the wrong kind of policy because that is like the heartbeat of your downtime when you have an incident. So you need to be able to make sure that that's being covered. As to ransomware, there are— ransomware isn't just the payments, and I think usually ransomware is bundled on a policy. Usually, say, extortion is brought— is built into that. So any loss of funds due to extortion, you have the ransomware piece, you also have paying someone to come in and negotiate the ransom. That's all part of the conversation too. So I guess Yeah, right. Is— should the insurance carriers just be paying the ransom or are those other pieces important? And maybe they redefine and I guess they're going to see how that— how that moves forward.

Yeah. I'm curious to hear from you guys that are in chat. Tell us what you think. What's your opinion of it? Again, my opinion is I think policy should cover the effects of ransomware, but not the payment of the ransom itself, because that goes to a bad guy. The last thing we want is them to be more incentivized. For more of these ransomware outfits to spin up. We don't want— we don't want them to say, well, cyber insurance just makes it even easier. If we were to— let's say we passed a law tomorrow. You know, I'm finally elected your friendly dictator and I say, hey, no more payment. Carrier's not allowed to pay the ransom. They can help with all the other outfits of it, but not paying the ransom. No, that's going to be— if you choose to pay it, it's on you, Mr. Client, Ms.

Client.

That's it. I, I just don't see how that's a bad idea. I'm not saying that we're not paying the ransom. I get that there are times when you pay it. I just don't think the carriers should be the ones to do it because it just incentivizes it all the more.

Yeah. And I mean, if, if the carrier, you know, catches wind that the client happens to have a $2 million policy and that, you know, the sublimits on ransomware are $2 million, what do you think they're, you know, they're going to look for when that payment happens? Right. So I think that's where some of the, the worry is around that particular topic. But again, that's why you see it here. I mean, they're reducing coverages for specific types of loss, including ransomware. They're renegotiating their contract terms. They're doing— they're doing all sorts of kind of— and this maybe this kind of stemmed a little bit from some stuff back in the fall of last year with Lloyd's talking about nation-state actors and all that kind of stuff.

Um, I, I love Alex's comment.

Yep, classic Alex Farland coming in here with the, with the, I think they should pay for the cruise missile we send in the window of the ransomware.

The irony is we know where a lot of these guys are, you know, that's, that's sort of the, the dirty irony.

Yeah, and I think the difference here, um, and something to, to keep in mind because there's this, this comment here from, from from, uh, from Mike. Ransomware insurance is kidnapping insurance. Just say no. Um, and if you're buying a policy that is simply just a ransomware policy, that's probably not a good move. Um, a good cyber insurance policy is going to cover a mess of things, and ransomware is just one of the items on there. So it's the idea of like, if a carrier were to say, hey, you know what, I don't, I don't want to deal with ransomware anymore, I'm going to pull that type of coverage, I think. But here's the other side of this, Wes. Right now, all the carriers are paying ransomware ransomware. That's all— like, every good cyber insurance policy has ransomware. So unless they unanimously decide we are not going to cover ransomware, or a law gets passed that says you're not allowed to in this unregulated cyber insurance world that we live in, the Wild West, um, but if something were to happen that would change things. But I think right now, because of the competition being what it is, we have increased competition in the market, you would need a major shift in the tide of things for them to pull that type coverage. Um, just my two cents there. But yeah, um, yeah, so, okay, so we talked through that. Uh, so this, this is important, um, and this is— this defines— this addresses a major elephant in the room that I've heard many, many times in conversations with MSPs of the cyber insurance market not being profitable, the cyber insurance market's gonna deteriorate and fall apart. And I mean, this was back in December of last year. There were articles coming out talking about it, that by April of this year they'd be out of money. Clearly they're not. Um, so this is— but S&P said that these measures, everything we just talked about, so that's the, the adjusting the terms, increasing the retention levels, doing all these things to make the policy a little more, um, a little stricter in when it'll pay out, uh, has recently led the cyber insurance market to return to profitability. And that's a big deal. So what that's saying is that carriers are actually moving in the direction where they may actually start to make money on cyber policies, not just lose money. And, um, so that I think leads to what I was saying earlier in the call of, is this reinsurance rate increase going to ultimately affect the end user? And I think the way that it's going to affect the end user is not necessarily necessarily in price of policy, but in this additional stuff we just talked about— the tightening of the terms and conditions, redefining certain things, making coverages a little stricter, um, maybe pulling certain coverages from across their policy forms, things like that. So rather than say, hey, we're going to make you pay, um, you know, $5,000 more this year, what is a way that we can lower the, the actual chance of payout, because it can't just be the money side of things for them to reach that profitability point. Um, I mean, that would be my, my two cents there. I— again, it's all, it's all speculation, but that's kind of what, what I talk about.

Yeah, I, I'll just say I'm, I'm not, I'm not here cheering on the carriers. I'm not pro-carrier, I'm pro-MSP. Um, so when they get profitable, I'm like, well, I don't really care. But I do care in the sense of I'm glad they're getting profitable because that means things are getting right again. Like I tell people all the time, remember, the carriers are in this for profit too. This is literally— stop looking at this and make sure your clients stop looking at this like, you know, this magic wand that eliminates cyber risk. It doesn't do any of that. It doesn't. All it does is it lets you transfer some of your risk over to cyber insurance. But there are limits, there are exclusions, and we've talked about that already today. You need to know what your policies say about that. But them getting profitable does soften the market. It does increase competition. It does show things are working. It does show spend in cyber matters. And it— good cyber hygiene makes a difference and forces bad guys to go to the easier target. All of this is true. So, you know, I'm glad that they're getting profitable because had they not, then all it means is I just don't believe cyber will ever go away. Cyber insurance, it's never going away. So if it's not profitable, then that's just even worse news for us because that means it's going to have to get even more expensive. So them getting profitable is showing, hey, we've made what I would say mediocre increases in cyber hygiene, and that's actually had a big difference. Holy cow. Well, what happens if we have more significant upgrades in cyber hygiene? That should have an even bigger difference. And so I just, I'm glad to see it. It's encouraging to me.

Yeah, now I want to address this one piece, right? This is why I think that the, the price increase itself—

you—

why a, you know, if the reinsurance rates go up, why carriers shouldn't increase their prices. And that's because when the prices get too expensive, a lot of small businesses, a lot of businesses that think, I'm not a risk, I'm not going to get hit by a cyber, uh, a cyber incident, who then end up getting hit by a cyber incident, are going to opt out of cyber insurance because they can't afford it. Too expensive. So if carriers keep jacking rates every time, you know, they face some new level of rate increase from their reinsurers, then the end clients, the insureds, aren't gonna— they're just gonna drop the coverage altogether. I mean, we've seen that in conversations. Um, but that's where also, you know, as we, as we get ready to wrap this up, that's where I think it's important to talk about the business advantage for MSPs. I mean, this is, this is kind of the big takeaway if you're an MSP listening in today. How can you help those small businesses with not— how do you help them say yes to cyber insurance as opposed to say no to cyber insurance? Because I think that's going to be a turning— a key factor, because like we said at the beginning, cyber insurance is being desired. The demand is there. So if the demand is there but they can't afford it, there's a problem. So how do we make it more affordable? How do we get them there? What are some best practices? Wes, you got anything for that?

Well, you know, I think a few things as we pull this home. One is you don't have to be the expert that Will Brooks is on all of this, right? But I do think what you need to know is, is you do need to understand what's happening in the insurance marketplace. You need to understand why this is happening. You need to understand the good benefits that are coming out of this in the sense of we're forcing more controls because we have evidence that the controls work, right? And it's not just buying vendors. Hear me, it's controls like good cyber hygiene, like, you know, actually doing something about vulnerabilities that you see in your network, you know, things like actually scanning for them and remediating them, things like, you know, doing risk assessments, you know, things that may not— you may not buy something, but you do like. So I just want to be clear on that. But like, It makes a difference, guys, it does. And so, so that's the first part is helping people understand it makes a difference and it's important that we do it. And then the second piece is, you know, when you hear the reactions, the knee-jerks that say, come on, man, this is now so expensive. I don't need this. It's too expensive for me to get any value out of. Well, let's reverse that thought and understand what is the damage, right? Because if the damage is $10,000, $100,000 when you get hit by something, then I would agree. I don't think cyber insurance is worth the spend if you're having to spend $10,000, $15,000, $20,000 to get a policy. But if the damages are, you know, in the neighborhood of $1 million, which oftentimes they are, somewhere between $500,000 to $1 million, then I think it's a no-brainer decision. I think you literally need to do that to be a good business owner, to be a fiduciary of your company. And let me kind of explain this. My buddy David Powell from Pax8 and I were talking yesterday on this exact topic, and we were talking about this. He said, Wes, Do you know how much the average Russian makes per year? And I'm like, I have no idea. He goes, well, he goes, they make about— and I'm looking at now somewhere about $12,000 to $14,000 a year. That's how much money they make. So when a business owner says something like, well, I'm just a small, you know, I make less, I make $1.5 million a year. No one's coming after my little business. Oh, yeah. That Russian coming after you, getting a ransom for $70,000, $80,000 from you. Is not just life-changing money. That's like 5 to 10 years of their salary they made in one fell swoop. So you being small for you is still mega big for them. You are still a target. You still have a big target on your back that they would love to come after you for. And so I just— it's important that we stack this up right. And this is a business decision. If I come in and I tell you that you have a risk and that risk is a very high risk of occurring and that risk could cost you $500,000, and you can offset that by a very small spend, you'd be a fool business owner not to go and address and remediate that risk. That's what this comes down to. And so I think is, is, is MSPs listening today, you don't have to be the cyber expert, but you do have to educate them on why this matters so that they can make an informed decision for their business. And we got to get better at that.

Yeah. One of the tips I give a lot of our MSP partners, that's huge. That one of the tips I give our MSP partners is, you know, you do your, your business reviews, your security reviews, whether they're quarterly or monthly or half a year or whatever. It's probably time to have a security review through the lens of insurance. So if you treat an insurance policy like you would all of your other subscription services that your clients subscribe to, on some level that renews. It's It's usually an annual subscription. Policies renew annually too. So to track that, to have that, that, uh, to have that understanding of when the policy is set to renew and then actively pursuing a meeting prior to that renewal date where you're ensuring— ensuring with an E— you're making sure that the clients have the security in place that's going to make them a good risk to the insurers this year. And that's the big difference, is it changes every year. And I, Wes Spencer, a lot of times in talks, you'll use that "you must be this tall to ride this ride" graphic, right? The little kid. But every year carriers are saying, actually, you didn't grow last year. The ride requirements have grown. You have to actually be taller to get on this ride now. And every year it's just a little bit more. So a lot of our successful MSP partners are literally integrating this into an annual conversation to help clients. And this is the education piece going backwards. It's helping clients understand that just because my MSP implemented all these controls the first day they onboarded me, it doesn't mean it's going to be enough forever, right? It's like, oh, you, you were full stack when I took you on, but now we're adding this, we added this, we need this, we need this, because carriers are consistently adding a little bit more. And to your point before, you shouldn't use what a carrier desires as your baseline for— or as your, as your heightened top, top security profile. But it is helping clients understand this idea that it is an evolving industry and you always need to be thinking, what do I need next to better secure me? And the cost savings on the insurance side is just an extra benefit. So I would say, I would say that'd be kind of my key takeaway for MSPs here. There are a couple of, a couple of thoughts here. Timothy Duncan, I just want to, you know, put up what you put on this up on the screen here. If it is, it's showing up.

Yep, there it is.

There we go. All right. So car wrecks happen every day. Cyberattacks happen every day. I'm curious how much it costs for a starter policy. Me too. Uh, they can be anywhere between $1,000 and a lot more. Uh, it's all over the place. And that's why this whole conversation we've been talking about the importance of having good cyber hygiene along with everything else, because having good security is going to give you access. I think you actually asked a question earlier about the top cyber carriers. It's not about being the top carrier, it's recognizing what a good comprehensive policy is. Reach out to me on LinkedIn, I can walk you through that whole thing. But the reality is understanding what should be covered in a policy and then saying, all right, the carriers that offer the best security, the best coverages at the best price, you're only going to get there if you have really good security. So protecting yourself on the front end and the back end is vital.

Um, yep. I love what Chris said here. I'll unpack this one too if you want to highlight it. Great, Chris. Thanks for joining us today. Chris is awesome. Um, and he, you know, he's just saying, hey, for regulated industries, if you're not meeting your insurance requirements, then I inherit your risk. And Chris is saying something very wise here is that you do have to recognize as an MSP, as a business owner, you inherit the risk of your clients. Yes, we have tech E&O. Yes, they have their own cyber insurance coverage. But sometimes there are things that happen that still make life a nightmare for us. And those things can crop up in any number of ways. Right. It could be things like purely their fault. They chose not to invest in X, Y, and Z. They chose not to defend their company in a certain way to put this policy in place, but they're still going to point their finger at you at the end of the day, you know, and you may still just in the course of doing what's right for the customer, getting sucked into an incident, you know, and you burn tens, twenties, thirties, fifties of hours that you weren't prepared for. So like Chris is right, you inherit one another's risk and that's why you need to have these, these level set discussions with your clients of understanding what's the thin red line, what are the minimums that we have in place with our clients? So we say, hey, we are going to pull you along with this. You know, a lot of, a lot of times MSPs will say, well, I just give them a, you know, an agreement they sign when they choose not to do something, you know, and I get it to some degree. But I also want to reply back to them and say, well, do you just knee-jerk into that or are you actually really helping the client understand why this matters and pushing on it? Because if you're not pushing on it, then what you're going to do is you're going to run into a situation where every time they say, well, I don't I don't like this MFA. Okay, no problem, just sign this thing for me, right? And that's not necessarily get out of jail free card. I'm no lawyer. So, um, I love what Chris said there. That inheritance of risk is something you always have to be filtering through your mind. And sometimes you do have to push back on your client and say, I'm the expert on this, and we just— that's best— that's, that's terrible practice, and we just can't do that.

No, it's huge. I mean, I, I advise— not advise, I talk to MSPs all the time, right? It's like, oh, they don't want MFA, just sign this this agreement saying you've declined MFA. I'm sorry, we live in the world of law. Everybody sues everyone for everything. So that piece of paper they sign, they don't care about it. When, when stuff hits the fan and things go wrong, even if you're gonna win the lawsuit because they signed that piece of paper, you're still racking up legal fees. So is it really worth all that extra effort? And you're probably losing a client. Is it really worth all that effort or lack of effort just to get them to sign a piece of paper? Because I don't want to say— I don't want to sell this. Rather than saying, hey, let's get those pieces in place, let's do this. I want to help you mature as a client. We'll get you that cyber insurance. And then when an incident happens, now they're actually coming to you thanking you because you got them a good policy or help them get to the point where they could get one rather than, oh man, I didn't get a policy because you didn't secure me right. So not only am I suing you, but I'm now leaving as a client, right? It's totally different.

That's right. I'll close on this. If we're guilty of something as MSPs, it's not guilty of knowing the right path. It's not guilty of knowing the right procedure. It's not guilty of knowing what good security practices. It's being guilty of not being able to get our clients to move in that direction. That's where the guilt comes from. I was just talking to a friend of mine who's a very high-level VP at a very, very, very big investment firm out of L.A., and he was reading a report They weren't caught in an incident, but they were notified by one of their third parties. And the third party was caught in an incident because their MFA— or I'm sorry, their MSP had not enabled MFA for that client. And he's like, are MSPs that bad? And I'm like, well, no, not across the board, but there are still some that are out there that are letting these things happen. I guarantee you that that MSP, if you had questioned them and said, do you think MFA is important? They can say, of course it is. 100% of MSPs say MFA is important. The question is, are we actually pushing on this, right? Are we actually demanding and requiring these best practice minimum set standards? Yes, I'm glad cyber insurance is pushing on a lot of those as a minimum. But that's the challenge I think MSPs have is saying, how do I get to that confidence level? It's not a problem of knowing what's right. It's a problem of getting the client to go with me in that journey. And by the way, that's why— just shout out to Empath Cyber— that's literally why I built Empath Cyber, you know, to really help in that journey. Because, man, if we don't have the level of confidence there to get those things across, that's where the negligence comes in and it's really bad. So, yeah.

Awesome. Cool. So hopefully this was really helpful to everybody listening in today. Wes, if they liked what they had, they heard from you, where can they learn more?

Yeah, I would say a couple of things. I mean, if you're struggling with or, you know, you need to go resolve the privilege management components that cyber insurance requires, or going again, going above cyber insurance. You should have privilege access management deployed everywhere. All the CIS controls say that you should. It's a minimum security standard. Check out what we're doing at CyberFox. Awesome. Cyberfox.com. Would love to show it to you. It's really, really cool stuff. And then Empath Cyber, you know, reach out Wes Spencer at empathcyber.com if you want to see what we're doing. We're helping MSPs grow in their security journey, and that's from the largest PE-funded mega big MSP all the way down to the one-person MSP. We're helping them grow in their knowledge. We're helping their entire company come across in Learn as well. So check out both of those. Would love to open a conversation anytime.

Awesome. Yeah, education for this is super vital. Um, you know what, one of the things that we're, we're learning real quick in this space is it's not just an MSP learning about what all the crucial controls are, but how to convey those things to clients. Cyber insurance, cybersecurity, all those different elements, actually getting the client to understand them is going to be crucial in the whole process. So awesome what you're doing Wes Spencer, thanks for jumping on today. Everyone else, thanks so much for listening in, and we'll catch you next time. See everyone.