What Every MSP Should Know About Cyber Insurance

We are going to get started here in just a second. I know a bunch of folks will be joining in. Hope everyone's doing good today. Joe, how's your day been so far?

Good so far. Thank you, Wes. How about you guys?

Awesome.

Been meetings left and right, but that's kind of how I like life. Reid, how about yourself?

Never bored, I can say that. Very busy.

Right.

But very happy. So good.

Awesome, awesome. I'm at the Cyberfox HQ today, day, uh, office today, so I've stolen Adam Slutskin's office. You can see all this like super, uh, nerd cred, um, uh, stuff happening up here, which is really cool. All the, all the Star Wars helmets. So it looks like the live stream has kicked off. If you guys are watching today, go and say hi to us. Let us know where you're connecting in from. We'd love to hear from you and love to see what's going on in your neck of the world where you're coming in from. And here in just a second, we're going to jump into cyber insurance. We're going to be talking about what MSPs need to know about this. It's literally one of the hottest topics that's out there today, without doubt. And we've got some really good data we're going to share with you too. Same with the folks from, from SpearTip. So we're going to get started in just a second. Let's see here. All right, so I'll do some intros as we're getting ready to start. So you got Wes Spencer here. I'm an advisor with Fifth Wall Solutions and really excited to be with the Fifth Wall team today. We'll talk more about what Fifth Wall is doing. I'll also be moderating us as well. Joe, you want to say hi and who you are?

Yeah, thanks. Joe Husich, Vice President here at SpearTip. We provide cybersecurity services in the community.

Right, right on.

Reed?

Happy to be here, everyone. This is Reed Wellock, your designated insurance nerd of the stars. So I'm here to talk about cyber insurance and cyber insurance-related accessories.

Love it. Awesome. We have some folks checking in too. Carl checking in from St. Louis. We also have Timothy Duncan on as well. Good to see you on. Glad you're here. The rest of you folks, I see a bunch of people on the live stream, so don't be shy. Say hello. Let us know where you're connecting in from. And then we'll be using this as well. Josh, we see you as well. Thanks for saying hi. Use this as well for questions, for comments, for feedback, to make fun of how bald we are. Any of those things are on point and on game. No issues at all. Mike Stern saying, "Hola, dictators and friends." Or gray.

Some of us aren't bald, we're just gray.

I'm more aerodynamic now, Wes. I'm faster, that's all.

Yep.

Yeah, less wind resistance.

Yep, any of those things, um, are— will work for sure. Um, Reed, why don't we get started with, uh, telling folks if they don't know who Fifth Wall is, a little bit about who we are and what we do.

Sure thing. So, um, Fifth Wall, you know, we can— let me kind of use an analogy of the MSP space. So we're a wholesaler. Think of us like a distributor. Okay, so, uh, we are above the agency you work with. Retail agents, you probably have one for your own business. Um, well, they have to go somewhere to get access to good cyber insurance products, right? Um, they go to the wholesale space. Well, in 2016, we started and we said, you know what, we're only gonna do cyber. Um, and we're still one of the only in the country that decided to, to do that. So we are currently working with thousands of agencies across the country. We work with over, I think we're at 44 carriers now. That we work with. So we really have a good understanding of what are carriers looking for, what's the temperature of the water. We're doing this every single day. And about 2.5 years ago, we made the decision, you know what, this is becoming really critical for MSPs and the path of the increased security requirements for insurance is kind of making this an inevitable partnership. So we started working through the MSP community and Wes, you were a key part of that. Wes joined us and helped carve out our channel, which brought us from about 20 MSP partners last June. Now we're over 700 today. And really, we're doing this today. Our main mission is we wanna help educate, we wanna help drive good knowledge about what this is, what this is not, and really how MSPs can be leveraging something that's laying in their lap essentially almost every single day. So that's who we are.

Super cool. Reed, thank you so much for doing that. And yeah, just absolutely love everything about Fifth Wall. And you know, you're right, that education journey is what we're all about. So Joe, talk to us about SpearTip and who you guys are and all the awesome stuff you guys have going on.

Sure, so SpearTip's been around since 2005. We're a US-based cybersecurity company. Our headquarters is in St. Louis, so our security operation center's here in St. Louis. You can see it behind me. We provide rapid incident response services to many of the insurance carriers, and then we also do proactive services. You know, which a lot of the carriers, and we'll talk about this later, but a lot of the carriers are looking for those proactive services. You know, what are organizations to do, doing the better themselves before looking for that insurance? And of course our SOC as a service.

Awesome.

Love that. And first of all, you guys have the coolest name ever. I think SpearTip is such a great name and love that. I love that you actually have your SOC like literally right behind you so people know it's not vaporware. It's a real deal thing.

Yeah, we used to have our pictures on our proposals and everybody was like, oh, that's a cool picture, where'd you get that from? And it's like, uh, we had a photographer come into our SOC. And they're like, no, no, but yeah, it's real.

I love it. And I think we first met over at, um, I want to say IT Nation, maybe IT Nation Secure. So you guys work with MSPs as well. You want to talk about that a little bit?

Yeah, so we've made a big push, um, just because we We understand, you know, especially after the Kaseya incident, you know, we understand the vulnerability that those MSPs face, you know, so, so are making a big push in the MSP market of providing our SOC as a service to the MSP and their downstream partners.

Awesome, love that. So if you're an MSP and you— we're going to— we'll talk more about all this today, but definitely reach out to, uh, to SpearTip. More folks have joined in on the conversation, so, um, Let's see who else. Oh, Joshua checking in from Denver. Uh, jealous about that. We were just in Denver a week or two ago. What an awesome, awesome place. Um, Josh Franks connecting in with a good question. Looking forward to hearing more from us. Um, sorry, uh, you know, it was Josh. Yeah, any good resources for an MSP on how to review a client's insurance policy? The answer is yes, we are absolutely going to cover that today. So thanks for, for joining. Michelle checking in from Boise. The locals do say it how she wrote it, Boise. Make sure you put the Z in there. I was educated recently by that, by my friends at Fisher's Tech when I went to do an event with them. It is Boise, not Boise, but the Z-E, Boise. So you got that right. And by the way, Boise is gorgeous. Absolutely loved being there. West Texas, someone coming in. I don't see the name of who that is, unfortunately. And then Mike Stern checking in. Non-stock sock pick for the win. I cannot, it is a tongue twister if ever there was one. Do not ask me to say that 3 times fast. All right, so let's jump into some content. We're going to be talking about all these things. So I'm not going to go through this bullet point and just like repeat them. We'd rather just spend that time talking about the content, but we're going to dive into cyber insurance, the data around it, what you need to be doing specifically as an MSP around this, how you can find success in this, and why managed partners are a really big, important piece of solving this journey. So I'm going to skip by that and let's just jump right in, Reid, into the meat of this. So I think this is actually important because there's a lot of buzz right now happening in the industry. I won't name any names, but even this idea of like warranty versus like real insurance. And unfortunately, I think this because this has become such a hotbed, there's a lot of activity happening and a lot of sizzle that's happening around that may not always have so much meat. So talk to us about what a real cyber insurance policy is and why they're so critical.

Yeah.

So, I mean, there's, there's a couple of categories. If someone said, hey, I have, I have coverage, right? And what do they mean by that? If they're saying, hey, my business is covered for a cyber event, Well, cyber insurance is actually very purpose-built, right? So there could be a reality that you're covered for most of what you would face, but there's also a kind of a harsh reality. There's a lot of products out there that really don't do the job and they kind of, they don't serve the purpose, right? So when we look for a cyber policy, so when I say cyber insurance, let's just kind of set a definition. When I say cyber insurance today, I'm talking about something that's really comprehensive. So it's meant to cover really the, you know, that initial right when IR starts all the way to full restoration. It's covering a lot of the critical elements that we know about today as far as, you know, losing funds in various ways, a lot of different ways that crime happens, whether it's ransomware or it's actual theft. And we also seen, you know, Wes, you kind of alluded to it, we're seeing some coverages that are coming out. Maybe they're compliance-focused, maybe they're attached to other lines of coverage, maybe it's a warranty. But when we look at those, we say, well, you know, those all have some sort of edge to them that we don't like because there's a loophole, right? And so cyber insurance really is meant to be a comprehensive safety net. And we'll go through that at a— I'll keep it high level. I promise not to put too many people to sleep when I talk about cyber insurance. We'll actually describe what we mean when we say comprehensive. So whenever you hear, hey, I hear that might not— I hear that doesn't pay out.

Right.

We talk about cyber insurance. We really got to make sure we're talking apples to apples when we're talking about a comprehensive policy.

Love it.

Okay.

So that's why I wanted you to cover this, because again, there's a lot of buzz going on right now, which means you're going to get a lot of stuff that comes alongside that is going to cause both market confusion. And we're ultimately talking about business risk here, which we're going to get into in a minute. And you can't make mistakes here. There's too much that's at stake. So, okay, let's move past that just a little bit more and let's jump into— if I can get this thing to go, come on, slides. What fun. Yay, on a live stream. I seem to be halted. There we go. All right. So I want to talk about the timeline for a minute because there's a lot here. And Joe, I want you to add in a little feedback into this from your visibility as well, since you guys have, you know, 2005 onwards. So you guys have had a lot of visibility through the way on this as well. And so from the cyber insurance side of the house, you know, we, we say for us that, you know, there was an age of innocence that existed. That was really anything before 2000, like '15 or so. And you know, what happened in those days was, you know, we didn't see from an insurance side of the house, we just didn't see a lot of attacks happening against small and mid-sized business. It was largely the, you know, the Targets of the world, Bank of Americas of the world that were being hit. And so the carriers looked at this and like, look, this is like stealing candy from babies. It's literally that, like what could possibly go wrong? So like anyone wants a policy, psh, we got it. We just need like a name, maybe a business name, can you fog a mirror, maybe do you have like standard antivirus like Norton, psh, you're good to go. Like literally no worries. And that was what was happening. It worked well for them. And then what happened was, we saw a threat actor hit the scenes that changed things for good. And that threat actor was called GandCrab. GandCrab was very interesting because they're a Russian outfit and they discovered that not only were MSPs immensely lucrative targets, but also SMBs could pay way more than anyone ever thought. And so what they began to do was hit these small businesses en masse. And they actually leveraged MSPs quite a bit for this. And I remember this day in 2019, and all of a sudden some data starts to come out. The federal government says, "Yo, MSPs, you need to be much more careful. You're not ready for this." And we saw an explosion of malware and we saw an explosion of ransomware. And so, you know, we went from this day where it was like Oprah up in here, you know, like you get cyber insurance, You get cyber insurance, you get cyber insurance, right? You know, after listening to this webinar, you know, we'll have a policy for you too, you know, into now, like all of a sudden, it's gotten much more difficult. And so one thing happened, though, that made things even worse. We thought that 2019 was as bad as it could get. And then it was like the cyber bad guys said, hold my cyber beer, watch this. And what they did was they kicked off something new. This pandemic comes across. And now they're like, ha, all these companies are working from home. Everyone has remote desktop open. We're just going to— we're just literally going to blast MSPs and small business with credential stuffing and break in left and right. So we saw an even bigger explosion. And so this has caused the market— we're going to show the data in a second— that's caused the market to get super expensive, super complex. Carriers got their lunch eaten and things did not go so well for them.

Joe, from your perspective, what I'm curious about is, did you guys see the same kind of ramp up as well at Spirit Yeah, and even going back to, you know, in kind of that 2015, 2016 timeframe, everything prior to that, it was direct calls from organizations that they were seeing ransomware. They were, you know, they were getting hit, but they didn't have cyber insurance. So they were calling us directly to investigate and help them restore and help them get back up and running. And it was about 2019 or so when we were still getting those direct calls, but then we'd be, you know, start the investigation and then they say, oh yeah, we have cyber insurance. And that's where we learned about, we really started learning about cyber insurance and the carriers' panels of approved vendors, you know, who can do the forensic investigation at insurance rates. So it was, that's where we really saw cyber insurance becoming the norm. And I say cyber insurance, big umbrella, right? Whether it was a comprehensive policy or not, but we saw that cyber insurance becoming the norm even in the middle and small market, SMB market. So where today, almost every, probably 95% of the incidents we respond to are through cyber insurance.

Yeah, got it. Reid, okay, so hearing that from Joe, from— you're the resident insurance nerd, right? So you didn't come in like Joe and I did from a cybersecurity background. You come in from an insurance background.

Right.

I guess it's fair to say that when you look at this timeline, the carriers had no idea all this was going to happen. And so a lot of this, can I just say it, is kind of their fault, not in terms of the attacks, but what's happened tumultuously in the market of them realizing this is not as easy as they thought, right?

Uh, they're gleefully ignorant, right? I mean, they were having a great time. Um, and the unfortunate reality is, I think, you know, in insurance, you know, if you know when you're in a soft market, which is what we're describing, and you know that eventually it's just the ebb and flow, there's going to be a hard market. So to a degree, it's more so, you know, the consequence of their own action because they knew this was not going to last forever, but it was a land grab. Right? So while acknowledging that cyber is a dynamic type of exposure, right? It's not like fire. It's not, you know, we don't understand it. It's gonna continue to evolve. And that these threats were gonna continue to persist. Well, let's get as much business in the door as possible, right? Before you know what hits the fan. So I think it's two-part. I think it's one is you had those that just had their head in the sand and they were just going. Because they could, right? Give me your revenue, give me your business name, give me your website, I will send you a policy. And I don't really know how much, if I'm appropriately pricing it, but I don't care because now I have you as a client, right? Uh, and then you also had those that were doing the same thing but also aware there was a hard market coming. Um, and we'll go through the consequences soon, but the consequences became very, very critical, uh, and very serious, and it affected so much to where we are today, the game has completely changed.

Okay, got it. So now you kind of understand what's happened here, and I think that's really important for us just because we need to have a good understanding of, you know, what got us to this stage. So I'm going to move forward again if I can. For some reason, sometimes my slides just don't work. I don't know. There we go. So let's talk about what's happening in the news a little bit. So one of the big things in the news is we're seeing this hit full scale. Right. And I'm not going to spend a ton of time on each of these news articles. If you want links, we've got links to all three of them. We can get them for you. Just reach out to us and we'll be happy to send them over. But I'm just going to highlight a couple of quick pieces out of some of these news events. One is you see that one in the middle from Insurance Journal. This happened last year. And what happens is the carrier in this case is what they discovered is they paid out on an insurance claim for a cyberattack. And in the aftermath, because keep in mind, the carriers are going to involve digital forensics. They're going to find out the details of what happened. How did it happen? When did it happen? Where did it happen? What's the scope? All these kinds of things. And what they discovered in the aftermath of the breach was that the client didn't have MFA, multi-factor authentication, rolled out. Now, the reason that's important is because they said that they did. In the insurance world, they did something called misrepresented. It's what those we normal people say, you lied, right? They just simply lied. Now, what did they do it on purpose? Did they not? That's not for us to say. But the issue is when you say in a questionnaire, I have something in place and you actually don't, the insurance world operates off of what's called good faith, and that's not operating in good faith. And unfortunately, the carriers are in this for profit. And so they're actually suing to take back their losses paid out because the client misrepresented. And so it's really important. This gets into that question that Josh asked earlier. Any good resources to review on a client's insurance policy? We're going to touch— we're going to get into that in a minute. But this goes right into what Josh was saying. Clients oftentimes don't know. They're like, I don't know what MFA means. Sure, I bet we have it. We'll just hit yes. One of the worst things that you can do. It's important to be accurate. The other article I wanted to cover very quickly is that one you see from The Register. So it's a PC store. They had some business email compromise, you know, where a bad guy gets in your email and they tricked the store into wiring out some money to where they thought was good. It was actually a bad guy. It was $600,000. In this case, the PC source said, no problem, we have a cyber insurance policy for $1 million. We should be covered. They make a claim. The insurance company comes back and they say, yep, we will cover that claim. We do cover those things. Here's $100,000. And they say, no, no, no, no, this is a $600,000 damage. What are you talking about? We still have $500K you owe us. We have a million dollar policy. And so what happened was the insurance company said no. The carrier said no. You have what's called a sublimit. For social engineering damages. We don't know what to tell you. You have $100K. That's the max we're paying out on this. You knew this. And the client said, no, we don't agree. And so they sued the carrier within one week. It just took 7 days. The judge threw it out. And the reason he threw the case out was he said the insurance carrier is right in this case. It was very clear you had something called a sublimit in your policy, which almost every policy has these. The sublimit limits social engineering damages into $100K in your case, and the client had no idea. What's the lesson learned out of these news stories? Tell the truth when you go through these, and you need to know your sublimits. It's one of the most important things that you can do. And I have found clients left and right, they're like, I didn't even know the word sublimit was a thing. So we're going to get into this in a minute. Reed's going to show you a sample policy in a bit, and we're going to talk about that. Okay, so just wanted to share those two news stories because they are vitally important. Now what I really want to do is talk about the data here as well. So Reed, I'm going to turn this over to you to talk to us about the data that see here, because this really shows that timeline that we're talking about. And then we have some brand new data that just dropped that really is showing what's happening now in the future.

Yeah. Well, and one thing too, just to add to the previous slide, I think the one critical piece is make sure you're educated on all sides of the fence, because there's a reality that, and Brad has a good point, clients don't know, totally agree, it's up to the MSP to explain to them. Yes, it also, you know, clients are supposed to be having right now two risk advisors in their life, an insurance one and a security one. And right now, understanding, okay, hey, how am I filling this application? Is it accurate? Do I need to be— how truthful I need to be? Yeah, you need to be truthful. But this side too, there's a reality. Most clients are not aware of what they have, and that's a huge issue. They really should understand what they have, and we'll go through what that exercise looks like. So this This is really interesting data, at least for me, given this is all I do and all I, I eat and sleep and breathe. But I think it'll be interesting for you because what it's telling us is that we've gone through— we're going to explain what happened in this hard market, okay? But there is kind of an end of the rainbow, so to speak. We're getting closer to a lot of this, this knee-jerk reaction that occurred and what that led us to. Um, but there's a reality that the, the knee-jerk reaction created nothing but heartache on all sides of the fence, right? We saw rates skyrocket, right? When I say rates skyrocket, I mean I'm talking you may have gotten a cyber policy for $2,000-$3,000 one year, and they're coming back and saying, yeah, it's going to be $18,000 or $20,000 this year, right? You have those that are operating out of their own— these are carriers that are operating out of their own historical pain. So maybe they had higher losses with manufacturing, right? But it didn't have as much with education, for example. You just happen to be a manufacturer, your rates skyrocket. You're with the wrong carrier because you might be with someone else and they're saying, you know what, I didn't have any issues with manufacturers, bring them on in. So there's a lot of issues going around just on the rating. And then when you look at, um, the process itself, the, the process itself was drawn up as far as what does it actually take to get insurance, and we're going to cover that in a little bit. But the reality is that, you know, the rising tide, what it did is it created high demand, right? So we saw huge demand for cyber insurance, but because of the market conditions, supply was super, super, super low. And so you saw carriers make very, very strategic decisions about what they wanted to do with rates, what they wanted to do with eligibility requirements. Um, and that in essence is what became our hard market. And I'm not kidding when I say This happened in less than 6 months. I mean, it really— and in our world, that is, that is overnight, which is kind of crazy.

Okay, so there you have it. By the way, Brad Gross, thanks for checking in. Um, if you guys don't know, Brad Gross is a cyber attorney, so that's what he does. He works for the MSP. So if you're looking for an attorney to help you, not just in terms of like cyber, but your MSA, and really giving you the right kind of, um, legal advice that you need, um, check out Brad. Really big fan of what Brad Gross does. So thank you for joining us today on the livestream, Brad. Look forward to your comments as we go through all this. Okay, so now you kind of understand what's happened in the market, right? And we talked a little bit about this, about the fact that it is a hard market for sure and what that means. And so basically, you know, Reed, I want to gloss this kind of quickly so we get to some more meat. But that's what Reed talked about, is we're in a— we've been in a hard market where the access is not so— it's difficult to get. It's both expensive to get The damages are high. It's just not easy. And so this is why, like, if you're an MSP and you've been trying to find tech E&O, which is like the insurance you need specifically to cover yourself, there's only like 6 carriers left that'll even offer it because MSPs are just considered such high risk. We're in a hard market. It's difficult to get. And also it doesn't help that insurance is very knee-jerk, right? So what happens is like the way I would approach if I were dictator of insurance, which I'm running for that, by the way, you know, I would say we're going to do a framework-aligned approach. So if you can demonstrate to me that you've chosen, let's say, CIS controls and you've gotten through IG1 and IG2 and you can prove to me you've got through that goal, you should be an insurable risk. It's not the way they work. They're sort of like, well, we've seen a lot of breaches with CPAs and those breaches happened because they didn't have like good— they didn't have MFA rolled out, they didn't have EDR rolled out, they didn't have like privileged access management rolled out. And so, you know, we're going to require these things. That's not a bad decision, but it's very knee-jerk according to what they're seeing. It's very reactive. And so this is why, if you wonder why, all the time we're in conversations with the clients like, look, I had no claims, nothing changed, no differences, and the carrier was fine with me last year and they rejected me this year. What the heck? That's what's happening here. It's very, very—

and if I may, Wes Spencer Spencer, the rising tide is all— I mean, it's per their own individual experience. So not only what you just spoke to was one carrier's reaction right? And you may be, um, you may be with a carrier that had good previous experience with your industry or bad, but then you've also got 40+ others that are out there that are operating differently. It's not a standardized process. There's no governing body telling the cyber insurance carriers, hey, this is how you need to operate, right? It's more so they're operating independently as their own company, which they are, and their knee-jerk reaction is based on their own historical losses. Right. And so for a while we were basically saying, look, and I think we're still there, it's like, you gotta shop because you may be with a carrier that is simply in the knee-jerk reaction because of the space that you're in, but not on who you are as a risk versus someone else who does not have that pain.

Well said. Okay, Joe, I wanna flip this slide to you if I may. You know, we've been talking forever in the security world that it's not a question of, you know, if it's gonna happen, it's a question of when. So it really does change our mindset. So teach us from like SpearTip's perspective and like your visibility into attacks and what happens around us, why this idea of assume breach is so important inside of this conversation.

Yeah, you know, and I always like to kind of start this part of the conversation with, with, I'm a motorcycle rider, right? And, and every time I get on my motorcycle, I start it and I pull out of the garage and I have that mindset of it's not if I'm going to get in an accident, it's when I'm going to get, when I'm going to be in an accident, motorcycle accident, right? And it's that defensive driving, right? So, so I know as soon as I pull out of my driveway, I'm the reason, I'm the sole reason that if I make it back to my garage, it was all my defensive driving because, because people in cars just, they, they don't look out for motorcycles. They have a lot of steel around them. You know, so, so I kind of equate that to the cyber world too, right? From, from our perspective, it's, it's what can I do as an organization to better prepare myself when that happens, right? How can I limit my exposure, right? Yes, one server may get, may get compromised, but it doesn't mean I have to be completely down as a business for 16, 20 days. Not being able to do business, right? So it's implementing a standard, right? It's using CIS, it's using, you know, some standard and those protective measures and going after the low-hanging fruit, right? Build out that roadmap. You know, where am I at today? Where do I want to be and how do I get there? Roadmap that out. And I like the term eat the elephant, right? You don't eat the elephant in one sitting. You take small bites of that elephant along the way and get yourself to where you want to be. But that's a never-ending process because technology threat actors change almost daily. You know, so you have to continually be reassessing where you're at and where you want to be. And that where I'm at changes daily and that where I want to where I need to get to changes almost daily.

Well said. Well said. So this is the way. And even though the carriers don't necessarily— yeah, did you like that reference right up here? Even though the carriers don't necessarily value that perspective because they're so control-focused, what Joe said is right as rain and pure as gold. That's exactly the approach. That's the mature approach to security, because the good thing is you start with that, then everything else, including insurance alignment, follows suit with it as well. So very well said, Joe. All right, so we're gonna move forward a little bit in this if I can once again get my slides to go. They seem to have a little bit of a delay. I'm not sure quite why. Let's see here. There we go. Okay, I'm gonna skip the cyber resilience because I think we've talked about this a good bit from what Joe said, so we'll move past that. But basically the idea behind cyber resilience is, you know, your business ability to stay continuously operating, right? If we assume something bad is going to happen, how do we stay active and how do we, how do we keep the business operational, right? That goes into business continuity planning, incident response, cyber insurance plays into all of this to make sure that we can continue to operate. And those are the big things that we really need to be focusing on. So let's go past this slide and jump into the next one. I don't know if someone can get them going for me. I don't seem to have control of them anymore.

There we go.

Okay, so Reid, you know, one of the things that's important here is cyber insurance was never mentioned in the 2013 Cybersecurity Framework, and there's a reason for it. While it existed, it wasn't at the scale that it is today, so it wasn't conceived of. But I think we could argue that cyber— cyber insurance definitely fits inside of the response and recovery areas of the NIST Cybersecurity Framework. So you can talk to us a little bit about why that is.

Yeah, so, you know, and keep in mind, uh, my, my craft is insurance, but part of the understanding of cyber insurance is understanding cybersecurity. So we certainly have— we as in the community have better understood what does it mean to actually be addressing this comprehensively and holistically, right? So, um, and Wes, you were the person that turned me on to the Cyber Defense Matrix, which was awesome because it just clicked with my brain. It made perfect sense. But, you know, when you look at— there is a reality. So if you're looking at risk management, right, and I'm not just talking about cyber, but, you know, if you're talking to an insurance agent, you're talking to a risk advisor, the way they should be approaching it, because you're trying to mitigate your risk, you're trying to decide, hey, how— if I'm going to look at this risk, I want to understand the exposure, and I'm going to say, all right, what do I need to do to control this risk, right? Do I offload it over into an insurance policy? Do I put good risk management measures in place and I reduce that risk? So cyber is interesting because you kind of need to do both. There's left of boom and right of boom, right? And when we look at cyber insurance, you know, what I've— and whenever I'm trying to justify the presence of cyber insurance, not just as far as good risk management, but also if you're talking about your security stack, right? And what you're proposing. Cyber insurance kind of fits in there because it's fitting in the framework of response and recovery. And correct me if I'm wrong, we're going to be going through that, Wes, later on as far as showcasing what does it actually look like from an insurance policy perspective? What does response look like? What are those first initial steps and why is it important to have a policy so you can actually see these different third-party services and costs that you probably don't even— you're not going to see or understand until either you're in a breach or someone properly explains it to you ahead of time. So yeah, cyber insurance being part of response and recovery, Wes Spencer, I think is, it's now part of what has become the basic profile of good risk management because it's now part of the ecosystem, probably since about 2016. It's just part of the formula to manage the risk.

Yeah.

Well said. Really well said. So we're not going to talk about all three of these scenarios today. You're welcome to just screenshot them or reach out and we'll give you a copy of the slides either way. But these are examples of where cyber insurance is important. Important and can cover some of these things. And keep in mind, we're going to get into this idea of first-party and third-party liability in a minute. But one of the things that makes these things so tricky is the fact that we— sometimes a breach occurs through no direct fault of your own. It's had something with a supplier or a vendor. You see the example of this. Sometimes you get something sent to you, right? And it causes an issue. Or maybe one of your suppliers, or maybe you had an incident and now your clients can't operate because they rely on you in the supply chain. So these are a lot of things that I don't think we always consider. Also reputational damage, right, and business disruption. These are other things that we don't often consider. We're going to show you how these things are typically covered in a good policy, may not be covered at all in a warranty, but certainly are important to be covered in a full policy. Joe, I want to flip over to you now. And, you know, one of the things that we talk about a lot is the incident response piece of this. And I don't think a lot of clients understand how damaging a breach could be. You know, they'll say things like, oh, I think a breach would cost me maybe $50,000, you know, is probably what I would call it. They just really misunderstand how damaging this is. And so I think it's important we talk about, you know, cyber insurance and having all the controls in place to reduce the blast radius, but also to be prepared when it comes, you know, and the incident response capabilities is important because this— the breaches are ridiculously expensive. So walk us through— I know this is a very high elementary level, right? There's much more to it than this, but walk us through kind of this whole idea of crisis management and a breach and all the elements you see here, if you would, for us, Joe.

Sure. Thanks, Wes Spencer Spencer.

Yeah.

You know, and it is— and I always stress to our incident responders is, you know, 9 times out of 10 when we're, when we're responding to an incident, this is that organization's first time dealing with this, right? And we do this day in and day out. You know, but it, it, it is, it's, there's a lot of costs involved. There's legal counsel and digital forensics. Insurance is almost always gonna appoint a breach coach, right? That data privacy lawyer to give that organization the best best advice moving forward possible. And what's, what's really interesting is, is around 2000, probably '18, is when we really saw breach coaches start to become kind of, kind of second nature on every, on every incident response, because that's about the time the threat actors started saying, hmm, data, data encryption isn't enough, I've got to do something else. I've got to have some other hook to their pocket book other than just their encrypted data. So they started exfiltrating data. So it's important to have that breach counsel there to look, you know, if there's data encryption, is figure out what data was there, what that notification needs to be if it needs to happen. It's that public relations, like you said, it's that, you know, that black eye to my company. That, again, that breach counsel, that data privacy lawyer is first at those press releases, those notifications to internal and external of, hey, this happened, or, you know, it kind of containing that bad press. You know, if it's PII that's been exfiltrated, credit monitoring, and then that fraud response. And And I missed the most important one to us is that forensics response, right? It's answering those questions. You know, when did this happen? How did this happen? What exactly happened? What all was affected in that breach? You know, because if there's, you know, and I grew up back in the day where if there was a hole in the dike, you put your finger in it, right? You gotta plug that hole. But, you have to fix that hole a little bit more permanently in cyber, right? So, so identifying how that threat actor came in and ensuring that we know how it happened, and let's fix that hole so that they can't come in. And oh, by the way, let's, let's do a sanity check on other things that are kind of common that we see throughout the landscape.

Awesome, thanks, Joe. Um, and I guess a follow-up, a good question came in from Josh in chat is, in a Reid, I'm gonna throw this one to you, 'cause again, you're a resident nerd. Are we seeing insurers in particular starting to cut things short, right? Like forensics, no notification to individuals to save money, and just assume risk from the regulators. It's a trend he's seen in the past 2 to 4 months. Wondering if others have seen the same. Reid?

Yeah, I mean, we've seen that trend for years from the holders. So when you say cyber insurance holders, I'm gonna assume that's the client, right? So the person that's holding the policy. Where if they don't have proper coverage, absolutely. I mean, it's a reality that, that if you're trying to look at this to avoid the cost, we see some take higher risk by not paying. But the reality is that if there is coverage, right, you're not going to see is an insurer, an insurance company, um, take that stance, right? It's too much liability for them. Um, so one thing I will speak of though is there is a lot of, I'll just say, waste on their side that they're trying to figure out a better way to handle. So when we think about that claims process that's up right now, we have a lot of third-party services that are involved. And, uh, Brad, since you're on, I'll say legal is certainly paramount, but there's a reality to understand where you are from a regulatory standpoint, what you're beholden to, and, and really to get the facts. But often it was, you know, you're coming at this, you're shooting a bazooka when really you only need a pistol, right? Um, and insurers were still kind of figuring that out, and they're coming at it way too heavy-handed. And, you know, you could have what could have been probably just a $90,000, $100,000 claim gets doubled because they're just uneducated in the process, right? And so they start bringing in more experienced folks like Spear Tip, those that have been doing this for years and years and years and know how to do this with level of, uh, expedience. But, you know, be thorough because they're worried about two things. One, time is money, but then also you can't leave any stones unturned because that's a liability for the insurance company.

Okay, good stuff, really good stuff. So Joe, awesome. Uh, Reed, good follow-up there. Um, Reed, I know we're running a little short on time, but this is an important slide, so I'd love for you to just kind of walk us through. Again, this is not a Fifth Wall policy, right? We're pretty agnostic to all this. We work with 43-ish carriers. We don't care who it is, but a good, a good policy needs to have these things. So walk us through what we see.

Yeah, so I will do my best not to put people to sleep by talking about insurance policy, but here's the important pieces I want to make sure I highlight, right? When you're, when you're looking at a comprehensive policy, first of all, first and third party are really important because not only are you worried about what affects you, but you yourself could actually be a conduit to affecting somebody else, right? We see this a lot. You inadvertently transmit malware, right? You did not know that you were already infected or breached, and then you were the cause of someone else's breach. And guess what? Um, a good attorney is going to look at that and say, you know what, technically, um, it's not my client who's liable, it's you, because you failed to prevent this. Um, that's actually built into a lot of the policy language. When we look at that previous slide, right, where we saw a lot of third third-party services, right? And so hopefully that painted a picture for you. If you're not familiar with the policy, you go, okay, so bam, an event happens. Well, there's a lot of moving pieces that have to go into play, and they have to go into play right away. Well, you want to make sure those are covered completely, because the reality is you aren't really going through many situations where you aren't at least starting that process. Maybe if it's a gift card scam and it's not a legitimate breach of the environment, sure. But anytime there is a legitimate breach of the environment and there's suspected PII exposed, you're gonna want to get those parties involved. And they are expensive because they're needed and they're valuable. And a lot of them, you don't have a choice. If it's a breach of a certain size, your state is going to require you to do certain things like credit monitoring, like notifying. When we get into, I'll say, there's a couple different coverages. Some of them are more of like soft costs too. But like we all know what ransomware is, hopefully for the most part. When we started thinking about soft costs, I think this is where a lot of folks, they're thinking more of those hard costs. What is it that could affect my business that would cost me money? And they might not be really looking at time and business interruption. And that's a huge impact regardless of what you're going through. If you're going through a ransomware event, yes, you need to worry about the ransomware. Yes, you need to worry about recovery. But guess what? While you're doing all of that, you're not running your business. And a good cyber policy should be paying you for lost revenue. Right. And that's usually overlooked. Anytime, Wes, I get a question and I get, you know, hey, what limit should I consider? That's typically where I start. I say, well, let's look at your revenue and look at average downtime. And Wes, remind me, what's average downtime today?

It's in my view and most study data is somewhere around 16 days. Joe, is that about right for you guys?

Yeah.

Yeah.

Yep. So that's a quick exercise I like to do to say, all right, what would it look like if you were down for 16 days? I'm not even— I'm not even talking about other costs, right? I'm just talking about you not being able to run your business for 16 days. What does that revenue loss look like? And that kind of gives us a good litmus test to, you know, do we need to look at $1 million or $2 million or even higher limit depending on how large the business is. Um, one thing I'll highlight, Wes, you hit it already, uh, reputational damage is very So think about this, you're hit with ransomware, you go through it, you were just put through hell, right? And guess what? It made the news. You have folks talking about it. It is known. Your reputation is now tarnished, unfortunately. Now, depending on what you do and who you serve, that actually may have a really, really big impact on current clients and future clients. But guess what? A good cyber policy is actually gonna take that into account believe it or not, right? They're gonna look out and say, hey, what does the loss revenue look like 6 to 12 months out? When we look at the other coverages, there's newer coverages coming out. They've been around for some time, but they're still quote unquote new because they kind of popped up the past couple years. But cryptojacking, invoice manipulation. Invoice manipulation's actually getting more and more powerful because we're seeing more of, all right, it's social engineering to a degree. Someone was tricked, but then the person that, you know, may have been falsifying— it wasn't them that sent an invoice, the person that paid that invoice. Well, whose fault is it? Is it the person that sent that invoice that actually was a threat actor, or the person that received it and didn't know it was not legitimate and actually paid it? And so we're seeing policies start to look at kind of both sides of the fence. And yeah, Tim, good comment. Invoice manipulation manipulation is low. The reason— let me address that real quick— the reason you see sublimits on most of the crime coverages and a lot of these items that are highlighted in blue, most of those are actual for direct funds loss. And let me explain that. I'm not saying that— let's pick on invoice manipulation, and we'll say the sublimit's $250,000. I'm not saying that we're, we're limiting the entire policy that you're now— your entire bucket is $250,000. I'm still saying you have a bucket of $1 million right here, but for the funds that you lost directly— so maybe you sent an invoice out for $100K or $200K, that's going to get paid in full, and you still have $800K or $900K left over for everything else. And because it's a direct funds loss, carriers are going to look at that very differently. They're going to look at that and say, look, that is a very black and white— we are cutting a check right then and there, right? Um, and that's high risk, and it's kind of always been viewed that way. You're also seeing some crime coverages are being covered by other policies as well. Um, so, and, uh, there's, there's a reality that there is a lag time by what is the market asking for. So like, what's the demand on these limits, right? Is $250K appropriate? Or not? Well, here's a good, uh, story. Most of the social engineering you could get in back in 2018, 2019, the highest you could get was $100K on like the best policy out there. That was the sub limit. No one's going higher. We entered a hard market, but somehow the sub limits still went up because folks realized $100K is just not cutting it, and it's not, it's not actually going to get me to where I want to be. So we actually saw those sublimits increase, and then we started to see that some of them decreased depending on the losses. But I'm going to stop there on cyber insurance firehose, Wes, unless there's specific questions, especially for time's sake.

Yeah, yeah, no, I think that's good. So maybe just one other quick thing here. There's a difference between a good policy and a no coverage, an endorsement, a waiver. Warranty. Just quickly walk us through, maybe 30, 45 seconds, of kind of the difference here.

One belongs in the garbage, one doesn't. Okay, you have, uh, other lines of coverage. You have your general liability, maybe you have a management liability policy, right? They cover other things. Well, um, years back, there's, uh, someone that was— I will not name— but they said, you know what, I bet we can bolt on cyber coverage real cheap, like let's just say like $300 and let's see if people buy it. But let's only make it like $100,000 in coverage, and we'll sub-limit everything. Like forensics, we're only going to pay out like $5,000. Legal, we'll only pay out $5,000. Things that we already know are really expensive. Well, guess what happened? People weren't paying attention. And then what, um, they ended up doing was they turned it into an opt-out. So most folks actually ended up with these endorsements whether they asked for them or not. And when they went through the policy, they said 'Oh, I have cyber coverage, great,' because the word cyber's in there. False sense of security, because it's not a real policy. That's why I say it belongs in the garbage. If you have a standalone policy, you actually had a quality conversation with your agent about it, that's how you know, because it was an investment.

You—

it was a, it was a decision you made to invest in.

Got it. I love it. So you do have that responsibility. All right, Joe, I'm going to turn over to you, but let me preface just quickly Exactly. So, you know, it comes into the question of eligibility, right? The carriers are not in the business of taking uninsurable risks, right? So one of the things that they've really begun to focus on is, you know, what's the minimum standard to entry, right? And I love this little meme here of a little girl coming up. We've all been to the theme park, a lot of younger kids, you know, you know the sadness when they come in, they don't measure up, and they get sent away, you know, they just— their life is over, right? And same way for clients, you know, if you don't have the minimum requirements, you're not getting on this ride. So, Joe, walk us through these, these 6 controls that we have here and help us understand why they're important. You don't have to go through— you can just go as light or heavy as you want to on these.

Yeah, you know, and so probably everybody's heard of MFA. You know, it's just that second piece of information that I need remote access to get into accounts, you know, emails. You know, it's just that It's just that second check, right? And it's something easy, something, something fairly inexpensive. And it's just a good hygiene piece to have in place. Segregated backups. We've seen threat actors get smart, right? Over the years, they've, they've realized backups have become more prevalent than they were 4 or 5 years ago. So segregating those backups, making it so that the threat actor can't get to those backups. So I now have a data point to recover from should I, you know, end up with ransomware. EDR, next-gen AV, again protecting those endpoints, right? Again, it's limiting that attack surface, right? They might, they may get one server, but one server is better than my entire environment. So limiting that, that attack service. Patching vulnerability management, checking that, right? And again, it depends on your vertical, depends on, depends on your risk appetite, but looking for those vulnerabilities, you know, doing some periodic scans, whether that's monthly, some people do it daily, some people do it monthly, quarterly, or at least annually.

Right?

To say, here's those vulnerabilities, here's where my environment is vulnerable, and again, eating that elephant one bite at a time. I might have 100 of them, but let me knock out those criticals and highs. Weakest link is our people, right? And I say this all the time, you know, at training, you know, most folks do annual training, why not, why not quarterly, you know, a phishing exercise, something to identify those weak links in my organization, and then give them another 10 or 15 minute tutorial to go through to say, hey, you clicked on this link, you shouldn't have, here's how you should have known it was a bad link, because that, that employee, our employees are definitely our weakest link. And then security monitoring response, like our SOC, You know, it's, it's much more effective, much more cost efficient, I should say, for us to monitor an organization, for them to build what's behind me themselves, right? I can do it for a fraction of what an organization is going to spend to staff. You know, I always say I can throw a bunch of tools at a problem, but if I'm not watching the tools, those tools are pretty much useless. And if I'm not, if I'm not seeing the alerts they're generating, until Monday morning, that's too late. That's too late. So having, you know, having a 24/7 security operations center watching your environment around the clock, really, you know, again, it's all about risk mitigation, right? You've offloaded some of that risk onto another team or secure your own security team to watch for those unusual unsuspected behaviors in your environment.

Okay, got it. So those are, those are the things, right? And if you don't have those things, we're not saying it's impossible to get coverage, but I am saying the chances of having a lot of sublimits exist. The chances of rejections exist. The chances of very expensive policies exist. So you owe yourself to do these things. Reed?

Wes, one thing to add. I actually just— this is a hot take, as I know you love hot takes. Hot off the presses of this morning, was talking to, uh, head of, uh, one of the markets. Uh, what they're coming out with is, um, they're looking at doing actually a midterm attestation to see if you've adjusted the controls, because they want to see if, um, they're, they're opening up the opportunity that maybe you, you weren't quite tall enough, but they want to see, all right, did you get any taller, right? Um, so for the first time, it actually gives hope, right? It's kind of hard. They're going to look at you once a year and you're stuck in that position for a full year with something that's evolving and changing, and you may or may not have budgets aligned on the renewal. But we are seeing a little bit of flexibility as the market hopefully starts to soften. These controls are table stakes, and I think carriers are realizing that you cannot throw this at somebody last minute, but it's also a conversation you want to make sure you're having. So even if for the MSPs that are here. This is a really good conversation to have well in advance, because what you're doing is saying, be prepared for your renewal. Don't wait till you get to your renewal terms and they're like, oh, by the way, you have to have these in force within 2 weeks. And that may or may not be possible, and it may or may not be within budget. But if you approach them and say, hey, I know these things are really important from a cyber insurance perspective, we should probably start talking about them, because I'm pretty sure when your renewal comes up, these are going to come into play.

Yeah, and I would only add there too, right? If I know these things are in play and I don't have them all implemented, or maybe even none of them implemented, if I can show that carrier a roadmap to say, hey, I know these are in play and I've roadmapped this out over the next 8 months based on the budget that I do have, and here's where I'm going to implement each of these. It says a lot about the organization being proactive.

Yep. No doubt.

Good stuff. All right. So I want to make sure that we— there's a question much earlier in chat, and I want to make sure we get over to that because it was a really good question. And it was sort of— I think it was Josh asking, hey, any good resources on how to review a client's insurance policy. So I'm going to skip by a little bit of this and we're just going to get towards the end, but I want to answer some questions that come in, that are coming in from chat. So if you guys have questions, send them in. Um, so Reed, I want you to answer that question. Someone says, look, I'm an MSP and I'm a little bit uncomfortable here, and just, you know, what am I supposed to do when they give me this long 10-page thing? Like, do I answer the questions? Do I fill it out? Do I sign it? You know, what should be the process here?

Yeah, so I think first of all, if you're, if you're an MSP and you're saying, hey, I want to become proactive rather than reactive. Reactive is you're probably getting hit with the apps and you're getting hit with more than one per client, and it's a snowball. Being proactive means, you know what, I want to get ahead of this and I want to talk to my client in advance and just ask the question, do you know where you are on your cyber insurance journey, right? Do you know what you have? Why is that important to me as an MSP? Because your risk is kind of my risk, right? And also, if you're saying, hey, Hey, I'm looking to you to be managing security, or I'm looking to you and those that you work with. We just identified that cybersecurity insurance is part of what we should be looking at as far as the full picture. So the conversation should be relatively simple because you're not licensed, right? So you never want to get on the hairy edge. You just want to ask them, hey, have you had someone do a cyber review? Have you had someone actually walk work through that. Um, here's a little bit of a plug for Fifth Wall, but that's actually what we do with MSPs today is we're actively working to be that kind of cyber insurance sidearm to say, hey, we have a partner here, they'll be happy to review a policy. Very similar to, you know, how you would probably look at prospecting. You want to do an assessment, right, early. You want to do a gap analysis and identify the needs. We do the same thing on insurance, right? And we want to say, hey, where are you? And let's educate you. And that's really— if you aren't working with a licensed partner right now, really, really encourage it, because that makes the process a lot simpler and you don't have to feel awkward, kind of out of your element, trying to talk about something that you may or may not be really allowed to talk about. But, um, it kind of— it allows the, the bad cop in the room to be the bad cop, which insurance is kind of the bad cop right now in a good way, because we are looking for a lot of the things that are hopefully aligning with what you know to be part of a good security stack. And so we're coming in saying, look, you got to believe them when they say EDR is important. I'm actually saying you can't even get cyber insurance if you don't have EDR. That's how serious it is. That's a different story, right?

Well said.

Awesome.

So if you guys would like to learn more, got a couple last things for you. First of all, if you're an MSP today and you're really trying to solve this thing, fifthwallsolutions.com. Msp.com. Reach out to us, we'd love to talk to you. Everything we've talked to— by the way, this, this is recorded. Be happy to get you— reach out and get you a copy of the recording, no problem. We'll always do free reviews for policies no matter what. But really, more than that, we're here to educate you. We're here to give you the knowledge you need. We have a really awesome education pathway. It starts with a Cybersecurity 101. There's literally no restrictions to it. You don't have to do business with us, no nothing. You just sign up for it. We'd love to have you you in. Will Brooks leads that, and he's just incredibly awesome. Then we have a deeper dive as well, also free. Our goal is just teach you, get you educated, get you going, and this will take you and your clients so much further. So if you heard a little bit, you want to know more, please reach out. Joe, talk to us about SpearTip.

Yeah, from, from our, you know, from my perspective, agree, you know, it's all about education. You know, it's, it's Being proactive, it's, it's eating that elephant one bite at a time. Always looking to be better, always looking for that next thing, that next step in, in that risk mitigation. You can't simply rely on that insurance policy because when you're down for 16 days, yeah, there's some reimbursement from that policy. Yeah, there's some reimbursement for reputational damage, but, but it's your company, you know. So we have all kinds of proactive work from external pen test to internal pen test to a full pre-breach assessment where we'll come in and we'll assess any tools, any, any policies, processes, or procedures that you currently have and really give you a good NIST rated risk score and help you build that roadmap of where you are today, where you should be, and how to get there.

Love it, love it. Awesome. Thank you guys so much. That hits us at the bingo. Um, what a great discussion, diving deep into this. You need to solve this problem. Your, your clients need this problem to be solved. So thank you guys so much for joining. Speartip.com, reach out, definitely want to go talk to them. Fifthwallsolutions.com, msp.com. Go on and talk to them as well. Thank you all so much for joining. You have questions, send them our way. We're happy to give them to you. Same with the recording. Until next time, my friends, thank you guys so very much.

Thanks everyone.

Thank you.