SCORE Session 2 — Cyber Insurance
A necessary component for your cyber operations
Why cyber liability coverage has become harder to obtain, what carriers now require before they will underwrite a small organization, and why the qualification process is itself a useful forcing function.
432162ef-91b9-425a-942c-4654f3176d74-0 Welcome everyone. 71a15b24-1e22-487b-af73-486e7ed9aec5-0 Looks like we have about 24 people in our room today. 689c6ce1-8157-4874-bc9d-665ad7a0b8f5-0 Welcome, Cyrus. bc342212-baae-4dfc-b874-ed1ab8674602-0 Thank you, of course for always being here for us in bc342212-baae-4dfc-b874-ed1ab8674602-1 our series. 9255bc9a-fa2f-4424-919e-6a6ebfb90d99-0 I would love to see in the chat, just a little check in. 7d1a93af-dc20-465f-ba9f-7623f1201d2b-0 Where is everybody coming from? 52f7afdc-bd44-4314-90cb-911f1db8460e-0 Where are you joining us from today? 77044ef2-0485-4c19-9ef5-5f8358260382-0 Yes, if you can hear me fine.
62274245-ef09-46f6-b6e0-485d33ccd617-0 It's always a pleasure to be here. 674627a3-541a-4c28-acaa-fac1382c6ec1-0 Microphone check work. 8a766fe6-e442-4efa-a9d4-8f6c8642ed55-0 Fantastic, Cyrus. d3d117e1-7ce6-450a-b618-ca63c89a2ef8-0 Thank you very much. 09111873-d93e-4d4d-a83c-8da5f39795ff-0 And we see some folks coming from Michigan. ba5ddad6-3d97-4672-9d9e-b253ae252e25-0 Hi Tanya, Brenda from Cary, is it Carrie or Carrie? ce303a11-f853-4485-975e-3e29ec82cb49-0 I don't know if I know Cary, IL myself. 1689821e-79ff-4b5d-a46a-ae4217a8aa50-0 Chicago.
6c8dd8a3-ed3b-41fc-917a-24dc21966edb-0 Hello from Mount Dora, FL, Vernon Hills, Oak Park, that's my neck of the woods, 6c8dd8a3-ed3b-41fc-917a-24dc21966edb-1 NYC, some more Michigan people and we see 6c8dd8a3-ed3b-41fc-917a-24dc21966edb-2 Libertyville, IL. 3dadb5a1-3a3c-450e-b8b9-d4c29edfde5a-0 So we have almost 30 people in our chat and we're 2 minutes after. 9aadf5f7-79f1-4e82-b409-4497c3578a5a-0 So I'm going to go ahead and get us kicked off here with our web webinar and 9aadf5f7-79f1-4e82-b409-4497c3578a5a-1 I really am excited to kick off our second session of the Data Defenders and 9aadf5f7-79f1-4e82-b409-4497c3578a5a-2 SCORE Mentor Chicago Cybersecurity series.
f8d38fac-502c-40e5-93bc-2bd9526e9fa1-0 Today we're going to be covering what cyber insurance actually does, f8d38fac-502c-40e5-93bc-2bd9526e9fa1-1 what it doesn't cover, how underwriters evaluate your business f8d38fac-502c-40e5-93bc-2bd9526e9fa1-2 and how to align your with your incident response plan. bac29ab7-8255-43cb-a1bd-e7721fea0ec0-0 So if you were here for our first session, we talked about having a plan and then bac29ab7-8255-43cb-a1bd-e7721fea0ec0-1 today's question is does your coverage match that plan? 459e6d1d-da2d-4673-a336-4b214a857132-0 My name is Stacy Perovsky. 225b43c0-6440-4ef9-a88a-930985edfe70-0 I am on the SCORE Event Committee.
77749d9d-9067-4a4d-90ab-1c5284d4f685-0 I'll be your host for today along here with Mr. 2df73804-d281-41a0-8fa4-915b39b66523-0 Cyrus Walker, who is the founder and CEO of Data 2df73804-d281-41a0-8fa4-915b39b66523-1 Defenders. 098568e9-6937-402f-abde-bde5f8232bc6-0 And Cyrus is the founder and CEO of Data Defenders. 1c64236d-bfac-4251-a967-36a00c7c6f93-0 He is an internationally recognized and published expert on electronic voting 1c64236d-bfac-4251-a967-36a00c7c6f93-1 security and as an experienced cybersecurity industry executive.
fc7dfd8c-3252-4339-b926-456ebd7ad043-0 Cyrus served as a subject matter expert in cyber terrorism and incident response fc7dfd8c-3252-4339-b926-456ebd7ad043-1 Management for the Cyber Defense Analysis Center at the University of Arkansas. f5ded537-09dc-463a-b5b1-a0b8d486c5bc-0 He has trained over 5000 federal, state, and local law enforcement professionals f5ded537-09dc-463a-b5b1-a0b8d486c5bc-1 from numerous agencies across the United States. b851a6a7-c56c-4b44-83e4-96df0cb0e328-0 Before I turn it over to Cyrus, I just want to I'm going to let you about b851a6a7-c56c-4b44-83e4-96df0cb0e328-1 score and what we do. 7a6f4bc2-263f-4d62-a0cd-32d8b2ea5773-0 We have chapters all across the country.
f1fb6e57-586d-41c4-ace9-c827ddb25724-0 We are a nationwide network of nearly 8000 volunteers. 18e3bd0a-81b0-4e3a-9bc5-ab6b687a0bd5-0 We've been around for 60 years and we are a resource partner to the US Small 18e3bd0a-81b0-4e3a-9bc5-ab6b687a0bd5-1 Business Administration. 159c5dff-9a8a-4ec0-a3e1-721004b21655-0 And what we do, what our purpose is, it's to help small businesses get off the 159c5dff-9a8a-4ec0-a3e1-721004b21655-1 ground and grow. 13a23029-833d-4f7c-a69c-aff0a33adc0a-0 It's truly as simple as that. 7b86dfb7-6e19-4706-9f76-e01c3ae716f3-0 All of us volunteer to be mentors.
8c0dcf1f-6c44-477a-b412-0f725444f100-0 We're here to help people achieve their vision of owning and operating small 8c0dcf1f-6c44-477a-b412-0f725444f100-1 businesses. 95944978-64c1-435c-8782-5b400a5f9ead-0 Our vision is that no one should be alone on this entrepreneurial journey and that 95944978-64c1-435c-8782-5b400a5f9ead-1 everyone should have the resources that they need to thrive as a small business 95944978-64c1-435c-8782-5b400a5f9ead-2 owner.
4addf0f7-e5f0-4483-8326-3fb82870560a-0 Many SCORE mentors have been in business themselves as entrepreneurs and as 4addf0f7-e5f0-4483-8326-3fb82870560a-1 corporate executives and then many are retired and then some of us are still 4addf0f7-e5f0-4483-8326-3fb82870560a-2 actively working. c1dd3990-5935-483a-b255-aa83c51122aa-0 We all volunteer and give back our time and experience to help others just like c1dd3990-5935-483a-b255-aa83c51122aa-1 you and get you started and off the ground. cab52f61-fa86-4dab-bd36-717292862195-0 And we do that in two ways. 9bfacfbd-2da8-4bcc-a5ca-2ca27d4b4eea-0 We have education like this webinar and we have mentorship.
f0b5b44a-ad2b-47b4-959e-6d5b10d600e4-0 And that mentorship starts by going to ww. www.score.org/chicago. 7981456f-57a7-494d-9388-1970d69efbad-0 I see some of us are not in the Chicago area. a88336e8-133d-49f7-91c9-dcfbfd1ef170-0 And you do and would have a SCORE chapter close to you and you can certainly go to a88336e8-133d-49f7-91c9-dcfbfd1ef170-1 the main website to to search for that mentor as well. 56014835-82e1-4777-bbb3-d4e72180c9db-0 And I, the, there's two ways that we mentor you and, 56014835-82e1-4777-bbb3-d4e72180c9db-1 and bring you this the success.
fc68da25-1381-490b-9768-4d436ee0cf58-0 And I, I really want you to know that it could fc68da25-1381-490b-9768-4d436ee0cf58-1 be one-on-one. e75db79f-550d-498a-be17-36ddab010374-0 It can be once a week, once a month. ef8d2835-53f5-4007-9b35-69888f8f5313-0 Our mentors really are there to help you through that process. 4a1e654f-7cba-4caf-8f63-e1f611c418b5-0 And being a small business person, it's not easy and you're going to 4a1e654f-7cba-4caf-8f63-e1f611c418b5-1 encounter those obstacles, one being our cybersecurity. 6765b893-8b3c-40d6-849e-a4f1c62268b7-0 And Cyrus is here to help you with that.
abdb0469-25f2-4243-9ca2-95baddac5e44-0 I'll be monitoring the chat and we will also conduct AQ and A at the end of the abdb0469-25f2-4243-9ca2-95baddac5e44-1 presentation where we can use that chat also. b690d810-bd17-45f9-9a1c-6e87334670ca-0 And we can also unmute you too. 4a710a5c-9fc0-4d3e-8e09-0a564255b773-0 So with that, I'm going to turn it over to Cyrus Walker. e51074ba-1f5c-4e93-ba27-2579f693272c-0 Welcome, Cyrus. bd6c774f-9a1f-4956-9520-2abc6aeb7e57-0 Thank you. 1843a3d8-fe98-4469-9014-e73e2e29ed17-0 Well, good afternoon, everyone, and thank you for joining us for session 1843a3d8-fe98-4469-9014-e73e2e29ed17-1 two of the SCORE Chicago Cyber Security Series.
99ccc3be-bea9-4f5a-a1cf-b6280a367394-0 Today we'll be talking about cyber insurance, 99ccc3be-bea9-4f5a-a1cf-b6280a367394-1 what it is and what it actually covers and what it doesn't. d25d3e32-ab65-4a76-8cde-644da199d016-0 And why does it become a necessary part of running your Business Today? 4447da5c-0819-4e08-9399-7bac0e87af36-0 My goal is to make this a practical session, and by the end of this session, 4447da5c-0819-4e08-9399-7bac0e87af36-1 I want you to understand what risks small businesses actually face. 7a32c312-bd3b-4484-b2f2-218f04467ad8-0 Our insurers evaluate your business.
5363d760-dacf-4924-9a18-2add1212e17c-0 What can Boyda claim and what steps you can take immediately to improve your 5363d760-dacf-4924-9a18-2add1212e17c-1 protection and reduce your cost. d9e49db1-cb0e-415c-9228-103ee01348b6-0 So let's go ahead and get into it. ceacced3-c6e3-4b32-b1ae-9d75029d4a66-0 For those of you that haven't met me again, I'm Cyrus Walker, the founder, ceacced3-c6e3-4b32-b1ae-9d75029d4a66-1 CEO Beta defenders. e5773be9-93ec-4883-9e21-24373d785301-0 I've spent 30 years working in cybersecurity, digital forensics, AI, e5773be9-93ec-4883-9e21-24373d785301-1 network engineering, and technology leadership.
d40a8850-a9d5-4eec-99f2-2277d03193ba-0 I previously served as the department chair for the Cyber Security and Computer d40a8850-a9d5-4eec-99f2-2277d03193ba-1 Forensics Department at the City Colleges of Chicago, d40a8850-a9d5-4eec-99f2-2277d03193ba-2 and I've worked with organizations including the Department of Homeland d40a8850-a9d5-4eec-99f2-2277d03193ba-3 Security on incident management initiatives. a04e3642-f516-4f0b-827b-dcc0a52861a8-0 I'm a certified computer forensic examiner, a04e3642-f516-4f0b-827b-dcc0a52861a8-1 and I've been fortunate to contribute commentary and expertise across national a04e3642-f516-4f0b-827b-dcc0a52861a8-2 media outlets over the years.
e8f20b66-1570-4672-986d-7f15f63cbbbd-0 Most importantly for today's conversation, I spent a great deal of time helping e8f20b66-1570-4672-986d-7f15f63cbbbd-1 business owners respond to cyber incidents and I can tell you from e8f20b66-1570-4672-986d-7f15f63cbbbd-2 experience that financial, that the financial side of recovery is e8f20b66-1570-4672-986d-7f15f63cbbbd-3 often what determines whether a business survives or not. 3698e1a2-16d8-42c4-80e5-f1627613d380-0 Real quick, where are we going with this series? 4c7d0888-57a7-46ef-bf02-2219896fd3c2-0 This is session two-part of a larger six part cybersecurity series we're doing 4c7d0888-57a7-46ef-bf02-2219896fd3c2-1 throughout 2026.
c437b3d7-625a-4c38-a9c5-46c45b5fce40-0 Back in March, we covered incident response planning, c437b3d7-625a-4c38-a9c5-46c45b5fce40-1 focusing on what to do after an attack occurs. b603dbc1-1b05-4b5e-bee4-a56ebf01f802-0 Today we're focusing on cyber insurance, and July we'll go deep into ransomware, b603dbc1-1b05-4b5e-bee4-a56ebf01f802-1 specifically how attacks happen, how organizations respond, b603dbc1-1b05-4b5e-bee4-a56ebf01f802-2 and what recovery actually looks like. 0ef2a8a5-4ad7-4bb9-801f-69e49f6305f6-0 Later this year, we'll cover cybersecurity awareness, 0ef2a8a5-4ad7-4bb9-801f-69e49f6305f6-1 phishing, and the human side of cyber risk.
990a6423-fad7-46c5-932d-1c6c066a643e-0 Each session builds on the last, but today's presentation can absolutely 990a6423-fad7-46c5-932d-1c6c066a643e-1 stand on its own. bcad2f46-a662-4f2a-ada6-e5a319db98c1-0 Back in March, we talked about what to do when an attack bcad2f46-a662-4f2a-ada6-e5a319db98c1-1 happens. 5351f1cd-c97e-45de-b983-b0056ea4a42c-0 Today I want to ask a different question. 51942d8a-e1db-4db1-b155-5cc823be752f-0 If an attack happens tomorrow, could your business recover? 6e68e6c7-9103-49e1-aebe-b4e1d66c4e02-0 Most small businesses believe they are reasonably prepared, 6e68e6c7-9103-49e1-aebe-b4e1d66c4e02-1 but the numbers tell a very different story.
43f32dde-0d3d-4c1d-9748-57ff144d2263-0 A lot of businesses had some form of prevention plan, 43f32dde-0d3d-4c1d-9748-57ff144d2263-1 but very few are truly confident they could respond effectively to a serious 43f32dde-0d3d-4c1d-9748-57ff144d2263-2 incident. 5ad9d5de-746f-4df1-807c-558d5f7cf79b-0 Looking at some of the statistics, 86% of businesses had a prevention plan. e4893370-7c7a-4d26-8812-c63399a20176-0 Only 23% were very confident that plan could actually work.
7d468c4e-664a-4997-9fdb-9849cd6f60bc-0 Less than one in three small businesses carry insurance, 7d468c4e-664a-4997-9fdb-9849cd6f60bc-1 even among those are already breached, and even fewer care dedicated 7d468c4e-664a-4997-9fdb-9849cd6f60bc-2 cybersecurity coverage at about 17%. 9908bee5-2f62-4202-9af3-d8d0f42ed857-0 That means businesses are operating with a dangerous assumption that their 9908bee5-2f62-4202-9af3-d8d0f42ed857-1 existing insurance will somehow protect them. dddb6b81-95c7-4284-8e95-1baa032783c9-0 And in many cases, it won't. 7035f591-d7ce-4034-b86f-23140445ded4-0 One of the biggest misconceptions we see is the coverage assumptions.
8c55e75b-1e5c-4b7d-af1a-228e69fcaae3-0 Gap business owners pay insurance premiums every year, 8c55e75b-1e5c-4b7d-af1a-228e69fcaae3-1 so naturally they're believing they are covered for major events. 1ee44e28-1c76-4fed-bf74-eb16b4b91e93-0 Then ransomware hits, they call their insurance company and 1ee44e28-1c76-4fed-bf74-eb16b4b91e93-1 they discover that policy excludes cyber related losses entirely. 61d27572-d643-4d36-a012-6e5c7e237e74-0 Traditional business policies were designed for things like accidents, 61d27572-d643-4d36-a012-6e5c7e237e74-1 property damage, theft, and bodily in design for ransomware, 61d27572-d643-4d36-a012-6e5c7e237e74-2 data breach, or network compromises.
0b42076e-81db-4582-b7c5-1b299319e2ef-0 And because only a small percentage of businesses carry dedicated cyber 0b42076e-81db-4582-b7c5-1b299319e2ef-1 insurance, most organizations are financially 0b42076e-81db-4582-b7c5-1b299319e2ef-2 exposed without realizing it. 17f30428-8aad-4828-9522-de3325037c9d-0 The worst time to learn that your policy excludes cyber insurance is during the 17f30428-8aad-4828-9522-de3325037c9d-1 time of a crisis. de7d8196-5f5d-4180-9b0f-878087907035-0 How many of you currently have business insurance? dbdb3168-313e-4880-b209-9dd38bda381a-0 Most business owners do.
ff655028-772f-4b02-995f-830b926b7b63-0 You pay your premium every year you renew your policy and naturally assume that if ff655028-772f-4b02-995f-830b926b7b63-1 something catastrophic happens, your insurance company will be there to ff655028-772f-4b02-995f-830b926b7b63-2 help. 43dd3a02-70c7-4c71-a16d-fc3e86e76240-0 That's a reasonable assumption, but when it comes to cyber attacks, 43dd3a02-70c7-4c71-a16d-fc3e86e76240-1 it often is the wrong one. 2745365b-11a7-4a68-9817-0e0f9eafda60-0 Here's the gap.
d378f2e7-4602-440f-9d25-a3ceb6e45878-0 Traditional business insurance policies were built to cover physical world risk, d378f2e7-4602-440f-9d25-a3ceb6e45878-1 property damage, theft, accidents, reliability claims. b96ae0ba-5ceb-4597-bcaa-62da0093f9dd-0 They were not designed to cover ransomware, data breaches, b96ae0ba-5ceb-4597-bcaa-62da0093f9dd-1 or the cost of recovering from a cyber attack. 22d04be4-7e70-47b4-99c2-3264c9b8f6b9-0 Yet industry research shows that at least one in four small business owners 22d04be4-7e70-47b4-99c2-3264c9b8f6b9-1 incorrectly believes their existing policy covers those events. 436f4fdd-04d9-411e-a151-69c18eccf852-0 Then ransomware strikes.
6510b83c-7937-45a4-997c-84eea45e2712-0 Systems are locked, operations stop, and they discover that the coverage they 6510b83c-7937-45a4-997c-84eea45e2712-1 thought they had does not exist. 14edb75f-db40-4c7e-98e8-f690397b8b60-0 Meanwhile, only 17% of small businesses carry 14edb75f-db40-4c7e-98e8-f690397b8b60-1 dedicated cyber assurance, compared to 70 to 80% of large 14edb75f-db40-4c7e-98e8-f690397b8b60-2 corporations. a96a488d-f813-4f30-8cc1-cd9f091518f1-0 That means the vast majority of small businesses are financially exposed a96a488d-f813-4f30-8cc1-cd9f091518f1-1 without realizing it.
9d9b850a-10fa-45b7-8d2f-7131968400c4-0 The problem isn't just the attack itself, it's finding out on the worst day 9d9b850a-10fa-45b7-8d2f-7131968400c4-1 possible that you're responsible for every dollar of recovery cost. e9f580bd-749f-4609-b247-013e8425deff-0 One of the biggest mistakes business owners make is believing that a cyber e9f580bd-749f-4609-b247-013e8425deff-1 attack is something that only happens to large corporations.
31c74852-8b8d-401f-99ea-5d0f42d39575-0 The reality is that small and family owned businesses are increasingly 31c74852-8b8d-401f-99ea-5d0f42d39575-1 becoming targets because attackers know they often have fewer resources, 31c74852-8b8d-401f-99ea-5d0f42d39575-2 fewer security controls, and less ability to absorb a financial 31c74852-8b8d-401f-99ea-5d0f42d39575-3 loss. 0c03c4d0-b465-4e4b-856b-e2082ade468f-0 The story on this slide is not about a Fortune 500 company. 70f7e16f-04dd-4696-8343-7bde921f841e-0 It's about a family owned business that has successfully operated for 158 years 70f7e16f-04dd-4696-8343-7bde921f841e-1 and employed hundreds of people.
6ce4764d-099d-41e7-82a9-33a4730a4f91-0 It had survived economic downturns, industry changes, 6ce4764d-099d-41e7-82a9-33a4730a4f91-1 and generations of leadership. 57aa51cf-1320-4c71-9f22-7377ad93d213-0 What it could not survive was a ransomware attack. b7339886-1430-4f89-a3f0-ade925d27fe2-0 The attack itself began with something remarkably simple, b7339886-1430-4f89-a3f0-ade925d27fe2-1 a single compromise employee password. dc51c97b-17e3-4f12-a8bc-f1bfead1b12c-0 From that one point of entry, attackers gained access. 3ed1e5a3-08d3-40a9-800e-c7bc4a0f4732-0 The critical systems encrypted essential business data and destroyed backups.
1381b43c-463c-4071-9fcb-0cb5b1b1da6f-0 Operations came to a halt. c62e35ba-6096-4b86-b2cb-1684c61bed77-0 The company suddenly found itself unable to serve customers, c62e35ba-6096-4b86-b2cb-1684c61bed77-1 manage or conduct normal business activities. ad69ff7a-e26d-4cd8-aa90-4bba540eaf0d-0 While technical breach was severe, the real damage came from the inability ad69ff7a-e26d-4cd8-aa90-4bba540eaf0d-1 to recover quickly and observe the financial impact that follow. 9f494bfa-093c-4c63-9596-c91feac168c3-0 This case is especially relevant today because many businesses are entering what 9f494bfa-093c-4c63-9596-c91feac168c3-1 experts call a transition window.
523060d8-89d2-430f-b79f-2409f5bcef1f-0 Over the next decade, approximately 12 million baby boomer 523060d8-89d2-430f-b79f-2409f5bcef1f-1 owned businesses will change ownership, representing nearly $10 trillion in 523060d8-89d2-430f-b79f-2409f5bcef1f-2 assets. ec3b040e-4116-40c8-ad71-530bd7410a5c-0 During these transitions, new employees, family members, ec3b040e-4116-40c8-ad71-530bd7410a5c-1 advisors and vendors often gain access to systems and sensitive information. 97fb834c-0358-4921-8b2c-42a83bfadea3-0 At the same time, owners are focused on succession planning 97fb834c-0358-4921-8b2c-42a83bfadea3-1 business sales.
5e69d3c8-3777-4d20-84c1-068cdc4b2b86-0 These periods create distractions and security gaps that cyber criminals 5e69d3c8-3777-4d20-84c1-068cdc4b2b86-1 actively seek to exploit. 3b078e48-ab6e-430a-a14a-716db8fae6a1-0 The lesson from this incident is not simply that cyber attacks happen. 6b3ffb5c-7066-418f-af9d-232d9a81c36f-0 It's that recovery requires more than technology. d738f4f9-ccc2-410b-9da5-982ed25f1c33-0 It requires preparation, financial resilience, d738f4f9-ccc2-410b-9da5-982ed25f1c33-1 and the ability to continue operating after an attack occurs. 6e351e9e-1ecf-465e-a203-be314fb33761-0 The company here did not fail because 1 password was compromised.
c4c8ea14-e301-4d79-8e2d-cf47a91d04da-0 It failed because there was insufficient protection in place to withstand the c4c8ea14-e301-4d79-8e2d-cf47a91d04da-1 consequences that follow for every business owner planning a transition, c4c8ea14-e301-4d79-8e2d-cf47a91d04da-2 sale, or succession. 4c9c44f2-fde1-493e-adf5-b05c73535c44-0 This serves as a reminder that cybersecurity and cyber insurance are not 4c9c44f2-fde1-493e-adf5-b05c73535c44-1 just technology issues, they're business survival issues.
bc3e8578-ee84-4557-82e7-5d6b127bcbec-0 Over the past several years, the cyber insurance market has undergone bc3e8578-ee84-4557-82e7-5d6b127bcbec-1 a significant transformation following a wave of costly ransomware attacks and bc3e8578-ee84-4557-82e7-5d6b127bcbec-2 record-breaking cyber losses and sure has dramatically increased premiums and bc3e8578-ee84-4557-82e7-5d6b127bcbec-3 tighten their underwriting standards as a result. 840e4eec-04c7-4bca-9ba1-e58116832817-0 The good news for business owners is that those premiums that have increased have 840e4eec-04c7-4bca-9ba1-e58116832817-1 begun to stabilize.
6967b43a-5187-4f98-a903-47a65e805058-0 Today, the median annual premium for a business 6967b43a-5187-4f98-a903-47a65e805058-1 with fewer than 250 employees is approximately $17140, 6967b43a-5187-4f98-a903-47a65e805058-2 down from more than $2100 just a few years ago. 8f4e8904-265e-4d3e-92aa-b5cfc3398870-0 At a glance, it appears that cyber insurance is 8f4e8904-265e-4d3e-92aa-b5cfc3398870-1 becoming more affordable, and in many cases, it is. 3e28b15a-cd8c-449d-b8fb-b1ece57fad7e-0 However, more premiums do not mean easier access 3e28b15a-cd8c-449d-b8fb-b1ece57fad7e-1 to coverage.
b600692a-c873-4040-aad4-635ede9165f6-0 Insurance cares have fundamentally changed how they evaluate cyber risk and b600692a-c873-4040-aad4-635ede9165f6-1 the past Obtaining coverage often involve completing a simple application and b600692a-c873-4040-aad4-635ede9165f6-2 checking a few boxes. 3673f1a8-a00a-4a94-bf04-e8392cc24825-0 Today, underwriters expect organizations to 3673f1a8-a00a-4a94-bf04-e8392cc24825-1 demonstrate that critical security controls are actually in place.
07f1a5ee-8147-428e-8d7e-e7c46e0cd494-0 Requirements such as multi factor authentication, 07f1a5ee-8147-428e-8d7e-e7c46e0cd494-1 endpoint detection and response, secure backups, patch management, 07f1a5ee-8147-428e-8d7e-e7c46e0cd494-2 incident response plans, and employer security awareness training 07f1a5ee-8147-428e-8d7e-e7c46e0cd494-3 that become the new baseline increasingly ensures want evidence, not promises. 7b6b103f-7e02-4580-9992-d91c50196766-0 At the same time, the regulatory environment continues to 7b6b103f-7e02-4580-9992-d91c50196766-1 evolve and 2025 alone, nearly 100 security related bills were 7b6b103f-7e02-4580-9992-d91c50196766-2 passed across the dozens of states.
5c0538b8-d9d8-4f55-9681-6aa528d55dbd-0 Laws such as New York's Shield Act, California's Consumer Privacy Act, 5c0538b8-d9d8-4f55-9681-6aa528d55dbd-1 and Maryland's Online Data Privacy Act reflect A broader trend toward increased 5c0538b8-d9d8-4f55-9681-6aa528d55dbd-2 accountability for how organizations protect sensitive information. 492c1f2e-caad-443c-8fee-bd9bcc37590e-0 While there's still no universal requirement for businesses to carry cyber 492c1f2e-caad-443c-8fee-bd9bcc37590e-1 insurance, governments are making it clear that 492c1f2e-caad-443c-8fee-bd9bcc37590e-2 cyber security is no longer optional.
d4247cf2-4dca-49c8-8228-8e59b910c2a2-0 Businesses that collect, store and process customer data are d4247cf2-4dca-49c8-8228-8e59b910c2a2-1 expected to demonstrate reasonable security practices. 9471d550-9890-4769-857d-7b06ac8af8d4-0 Take away is that the window for obtaining affordable cyber insurance 9471d550-9890-4769-857d-7b06ac8af8d4-1 remains open, but it is narrowing. 072534c2-d72c-4c14-bacb-1318f529d71f-0 Carriers are lowing prices for organizations that can't prove they are 072534c2-d72c-4c14-bacb-1318f529d71f-1 managing cyber risk effectively, while making coverage more difficult and 072534c2-d72c-4c14-bacb-1318f529d71f-2 more expensive for those that cannot.
82d53103-33fd-4b56-8009-293595f35307-0 The businesses that invest in security controls today are not only reducing 82d53103-33fd-4b56-8009-293595f35307-1 their chances of cyber incident, they're also positioning themselves for 82d53103-33fd-4b56-8009-293595f35307-2 better coverage, lower premiums, and fewer obstacles during the 82d53103-33fd-4b56-8009-293595f35307-3 underwriting process. 90c2d8f2-20ba-4f2c-bb13-5eb092dcbc3c-0 In today's market, cyber insurance is no longer just 90c2d8f2-20ba-4f2c-bb13-5eb092dcbc3c-1 something you buy and is something that you must qualify for.
e907c6d0-1dee-4a8b-b4df-b320e385805a-0 One of the biggest sources of confusion in the cyber insurance market is that the e907c6d0-1dee-4a8b-b4df-b320e385805a-1 term cyber insurance is often used to describe 2 very different types of e907c6d0-1dee-4a8b-b4df-b320e385805a-2 coverage. f3ccf725-9c05-4df6-a750-3f28e5aebeac-0 The 1st is cyber liability insurance, which is designed for organizations that f3ccf725-9c05-4df6-a750-3f28e5aebeac-1 use technology in their daily operations, which today means virtually every f3ccf725-9c05-4df6-a750-3f28e5aebeac-2 business on this planet.
8fb12f8a-b002-4695-93a8-9f21301580b5-0 This policy helps cover costs associated with a cyber incident, 8fb12f8a-b002-4695-93a8-9f21301580b5-1 including data breaches, ransomware attacks, business interruption, 8fb12f8a-b002-4695-93a8-9f21301580b5-2 forensic investigations, legal expenses, and customer notification requirements. d00024ac-6d18-40c0-8afe-894d1dbc8ef4-0 The second type of coverage is technology errors and omissions insurance.
fbf00ce1-cf4c-40c6-a202-f61dd6d46f67-0 Often called Tech Eno, this policy is designed for businesses fbf00ce1-cf4c-40c6-a202-f61dd6d46f67-1 that provide technology products or services to others, fbf00ce1-cf4c-40c6-a202-f61dd6d46f67-2 such as software companies, managed service providers, consultants, fbf00ce1-cf4c-40c6-a202-f61dd6d46f67-3 and technology contractors. b9e39fc7-ffae-4ca5-ae43-5c678d2ba194-0 Rather than covering your own losses from cyber attacks, b9e39fc7-ffae-4ca5-ae43-5c678d2ba194-1 Techie and all protect your business when a client claims that your product, b9e39fc7-ffae-4ca5-ae43-5c678d2ba194-2 service or professional advice cause them financial harm.
e5f6b1eb-db56-494f-90f0-f1cd8c6419fe-0 It addresses claims involving service failures, software defects, e5f6b1eb-db56-494f-90f0-f1cd8c6419fe-1 professional errors, and network security incidents that e5f6b1eb-db56-494f-90f0-f1cd8c6419fe-2 impact their parties. 6a28a6db-96c5-4c94-a378-c475f7fe46bd-0 The distinction is more important because many businesses assume one policy 6a28a6db-96c5-4c94-a378-c475f7fe46bd-1 automatically provides protection for all claims. 2e62a234-052c-4263-9bba-bb30c4aa09b3-0 In reality, they serve very different purposes.
3d7a9194-3309-4edc-b396-87534bffc4e9-0 Most small businesses need cyber liability insurance because they store 3d7a9194-3309-4edc-b396-87534bffc4e9-1 data, use technology, and face cyber threats every day that 3d7a9194-3309-4edc-b396-87534bffc4e9-2 develop, manage or provide technology services to 3d7a9194-3309-4edc-b396-87534bffc4e9-3 clients, mainly both cyber liability and tech 3d7a9194-3309-4edc-b396-87534bffc4e9-4 P&O coverage. 509f70c8-1ad1-4bd2-a818-dfe6bc49dc66-0 Understanding which risk you are trying to protect your business against is the 509f70c8-1ad1-4bd2-a818-dfe6bc49dc66-1 first step toward purchasing the right protection.
81b37ea0-d0b4-4eba-a82c-fefee6e7550a-0 When most business owners hear the term cyber insurance, 81b37ea0-d0b4-4eba-a82c-fefee6e7550a-1 they often assume it simply means coverage for data breach. 5bd8405d-9bd4-4ffd-add4-e8b4b409b1f5-0 In reality, cyber liability policy is designed to 5bd8405d-9bd4-4ffd-add4-e8b4b409b1f5-1 address a wide range of financial and operational consequences that follow a 5bd8405d-9bd4-4ffd-add4-e8b4b409b1f5-2 cyber incident. 9c7ec6a6-953f-4f79-96e3-c0e8d47e42bd-0 The coverage is generally divided into two categories.
2a05f4a0-47b4-40ee-a17a-8aa4b3fc4f64-0 First party coverage which protects your business directly, 2a05f4a0-47b4-40ee-a17a-8aa4b3fc4f64-1 and 3rd party coverage which protects you when others hold you responsible for 2a05f4a0-47b4-40ee-a17a-8aa4b3fc4f64-2 damages resulting from an incident. 3a2698dd-c833-4a26-90a4-8fd180f93360-0 First party coverage focuses on helping your organization recover.
39c2ec47-767f-4a20-975d-eebdd60a9adb-0 It may pay for a forensic investigations to determine what happened, 39c2ec47-767f-4a20-975d-eebdd60a9adb-1 data recovery and restoration, breach notification expenses, 39c2ec47-767f-4a20-975d-eebdd60a9adb-2 crisis communication, business interruption losses, 39c2ec47-767f-4a20-975d-eebdd60a9adb-3 and even certain ransomware and extortion related costs. 02090443-04ce-40bc-8e20-5879007fad6d-0 In other words, first party coverage is designed to help 02090443-04ce-40bc-8e20-5879007fad6d-1 your business survive and resume operations after an attack.
e4d51c6e-c2b6-4055-8dbb-73186073f553-0 These are often the most immediate and visible cost organizations face following e4d51c6e-c2b6-4055-8dbb-73186073f553-1 a cyber incident. a89e996f-4eda-4455-b626-24638034d7f8-0 Third party coverage addresses the legal and regulatory consequences that can a89e996f-4eda-4455-b626-24638034d7f8-1 arise when customer, employee, or business partner information is a89e996f-4eda-4455-b626-24638034d7f8-2 compromised.
76f08469-f076-41d8-8c72-5f35a9c7aee8-0 This can include regulatory investigations, legal defense costs, 76f08469-f076-41d8-8c72-5f35a9c7aee8-1 settlements, privacy related lawsuits, payment industry payment card industry 76f08469-f076-41d8-8c72-5f35a9c7aee8-2 claims, and other liability resulting from a 76f08469-f076-41d8-8c72-5f35a9c7aee8-3 breach. 3fdffada-62ff-47c6-a478-721a2f830503-0 Together, first and third party protections form a 3fdffada-62ff-47c6-a478-721a2f830503-1 foundation of a cyber liability policy.
8b979ff7-a15a-4f7b-9dc4-082fb4dc193a-0 However, not all policies provide the same 8b979ff7-a15a-4f7b-9dc4-082fb4dc193a-1 coverage, which is why it is critical to carefully 8b979ff7-a15a-4f7b-9dc4-082fb4dc193a-2 review policy terms and exclusions before purchasing coverage. b7e5d6d5-2c6d-499a-9034-523ddd2ebd20-0 2 Policies with similar premiums can provide very different levels of b7e5d6d5-2c6d-499a-9034-523ddd2ebd20-1 protection when an incident occurs. 36312ca5-6a61-447f-97c3-acbf5e63eb33-0 When people think of cyber insurance, they naturally focus on the financial 36312ca5-6a61-447f-97c3-acbf5e63eb33-1 losses that follow a breach.
5a9747bb-a1ab-4abd-a98a-11b6f22970cc-0 Things like legal costs, forensic investigations, 5a9747bb-a1ab-4abd-a98a-11b6f22970cc-1 business interruptions, and recovery expenses. 55bc168e-bdef-487f-aba2-845f4c09fdba-0 Those are important, and many of those costs can be insured. 5dd6d321-ee44-4932-8a87-055b12320b6f-0 What is often overlooked, however, is the damage that cannot be easily 5dd6d321-ee44-4932-8a87-055b12320b6f-1 measured or reimbursed. 9734b43f-642c-4cac-b0c2-b813d7100ef1-0 One of the most important points about cyber insurance is understanding what it 9734b43f-642c-4cac-b0c2-b813d7100ef1-1 cannot fully replace.
810a3195-17b4-4868-b07c-18a70518dc2e-0 While a policy may help cover recovery cost, it cannot restore trust overnight. ec852287-01ad-44f4-8302-7a0a76360fcb-0 The statistics here are telling. 09167d60-49bc-46f5-8d9a-ca6356feb69b-0 89% of small and medium sized businesses that experience a cyber breach reported 09167d60-49bc-46f5-8d9a-ca6356feb69b-1 reputational damage as well. 7cdeaf8f-8ad3-4316-b12d-5148af2eaadd-0 30% lost customers, 25% received negative social media 7cdeaf8f-8ad3-4316-b12d-5148af2eaadd-1 reviews, and 29% reported difficulty winning new 7cdeaf8f-8ad3-4316-b12d-5148af2eaadd-2 business after the incident.
781d956d-a525-4104-a37d-113e55ea6c8d-0 Even more concerning, the average time required to fully 781d956d-a525-4104-a37d-113e55ea6c8d-1 recover a damaged reputation was 279 days, or more than nine months. 4515d847-268e-4f20-89a0-77e1a7e17287-0 For family owned businesses, these numbers take on an even greater 4515d847-268e-4f20-89a0-77e1a7e17287-1 significance. 0a4e2e13-9b42-43d4-9955-641ba99fc6f5-0 In many cases, the business owner's name, reputation, 0a4e2e13-9b42-43d4-9955-641ba99fc6f5-1 personal credibility are directly tied to the company. 275cc196-5d83-4cfc-9153-d90d66280fd2-0 A cyber incident is not viewed simply as a technology failure.
4d14ea26-1780-4b33-951b-589fcbfd6ccd-0 It becomes a public test of the owner's judgment and ability to protect customers. e0ce10d8-3991-4726-ad76-12dc6dd21986-0 A business may spend decades building trust within its community, e0ce10d8-3991-4726-ad76-12dc6dd21986-1 only to see that trust question after a single breach. 681d0a11-c924-4ab2-baa5-12af36a16631-0 As noted here, for family business, the name above the door is often the 681d0a11-c924-4ab2-baa5-12af36a16631-1 brand itself. 90ff0172-8c70-4bc2-bb95-a2ea8dccd4c5-0 The long term impact can be substantial.
8720944d-24fb-475c-98a2-d39223d42a4b-0 According to the data, 47% of businesses that experience a cyber 8720944d-24fb-475c-98a2-d39223d42a4b-1 incident reported challenges attracting new customers, 8720944d-24fb-475c-98a2-d39223d42a4b-2 up significantly from 20% the previous year. 48416846-3249-4238-a1ad-158e4802945e-0 That trend suggests customers are becoming more aware of cybersecurity risk 48416846-3249-4238-a1ad-158e4802945e-1 and are more selective about who they trust with their information. 893f8713-7904-450b-88a1-1a7e20f6684b-0 The lesson is clear.
de2f46d6-e70b-4c46-b353-c37c5d8250f9-0 Cyber insurance can help offset financial losses, de2f46d6-e70b-4c46-b353-c37c5d8250f9-1 but it cannot fully ensure your reputation, de2f46d6-e70b-4c46-b353-c37c5d8250f9-2 your relationships or your legacy. 120476fd-767e-4b46-a323-6df7b931ad36-0 These assets must be protected through strong cybersecurity practices, 120476fd-767e-4b46-a323-6df7b931ad36-1 effective incident response planning, and a commitment to maintaining customer 120476fd-767e-4b46-a323-6df7b931ad36-2 trust before the incident even occurs.
e5dc04e3-33dd-4cda-bc0a-335b68d02977-0 This is the info that matters the most for anyone who thinks they're already e5dc04e3-33dd-4cda-bc0a-335b68d02977-1 covered. 56f1925a-8d33-41bc-b15d-7554044f6a3a-0 Starting in 2014, the Insurance Service Office, 56f1925a-8d33-41bc-b15d-7554044f6a3a-1 the body that sets standard policy language, 56f1925a-8d33-41bc-b15d-7554044f6a3a-2 introduced mandatory endorsements that specifically remove cyber coverage from 56f1925a-8d33-41bc-b15d-7554044f6a3a-3 general liability or CGL and business owner policies. d1175768-6a05-43c0-92e9-3baaf246cb71-0 Be These aren't technicalities buried in the fine print.
22d2dbfc-cc1b-4239-91aa-82988a82c89e-0 They are intentional. 2e0eeeb1-7eed-4212-91a1-1415d71c665b-0 They are explicit and the courts have consistently upheld them. 4a7a16af-796e-4297-bee8-e981247ffbe6-0 If your BOP was written after 2014, assume cyber events are excluded, 4a7a16af-796e-4297-bee8-e981247ffbe6-1 but don't assume verify. 02e367a5-30f6-4df9-bb3f-9d7fdbcefbe3-0 Here are some examples of cases where courts have ruled against customers. 82cf868c-ccc5-4159-bbcf-746abfbac6ee-0 EMOI versus Owners Insurance Ohio 2022 was when this case occurred.
9a14ff5c-913f-4a8a-9548-3c9dea81bb5f-0 The Moi Services was a medical software support company in Ohio that provided 9a14ff5c-913f-4a8a-9548-3c9dea81bb5f-1 appointment scheduling, records management, 9a14ff5c-913f-4a8a-9548-3c9dea81bb5f-2 and billing services for healthcare offices. 23072117-4459-4051-a57b-df04bf6a96f3-0 In 2019, this company suffered A ransomware attack 23072117-4459-4051-a57b-df04bf6a96f3-1 after hackers gained access to its systems and encrypted critical files. fa7f2b45-e7d2-4d62-b3c8-45ab086b6f10-0 The attackers demanded 3 Bitcoin worth $35, fa7f2b45-e7d2-4d62-b3c8-45ab086b6f10-1 000 at that time in exchange for a decryption key.
9744d461-603d-42c1-b764-e6da9c51d45a-0 The Emoi paid the ransom, recovered most of its systems, 9744d461-603d-42c1-b764-e6da9c51d45a-1 and then filed a claim with its business Insurance Business Owners Insurance 9744d461-603d-42c1-b764-e6da9c51d45a-2 Company. 32524d3f-ca92-43a1-b0b8-2ef834e6cc24-0 The insurer denied the claim, arguing that the company's policy only 32524d3f-ca92-43a1-b0b8-2ef834e6cc24-1 covered direct physical losses or damage to cover property. 5c87010e-0471-40dd-b6d4-4e50f3d16d1f-0 Emoi argued that the ransomware attack had effectively damaged the software 5c87010e-0471-40dd-b6d4-4e50f3d16d1f-1 because the system became unusable.
58ef924a-7409-4df8-bc7a-4a84401c34ee-0 The dispute eventually reached the Ohio Supreme Court, 58ef924a-7409-4df8-bc7a-4a84401c34ee-1 and in late 2022 the Supreme Court ruled in favor of the insurer. c192b59d-3efc-4c30-aa92-ca61602e7ef0-0 The court concluded that software is intangible and does not have physical c192b59d-3efc-4c30-aa92-ca61602e7ef0-1 existence, meaning it cannot suffer physical damage c192b59d-3efc-4c30-aa92-ca61602e7ef0-2 under the language of the policy.
f211c9d5-fea9-4df0-a816-2bd770134529-0 Because the attack damaged data and software but not the actual computer f211c9d5-fea9-4df0-a816-2bd770134529-1 hardware, the court held that losses were not f211c9d5-fea9-4df0-a816-2bd770134529-2 covered under the business owners policy. 2dab9ebd-0445-4db5-89d6-bb8c8e3f24db-0 The case became an important example in cyber insurance discussions because it 2dab9ebd-0445-4db5-89d6-bb8c8e3f24db-1 reinforced a critical point for businesses. 7630ad95-320a-40e6-a08a-db0b4825f9ab-0 Traditional business insurance policies are often not designed to cover 7630ad95-320a-40e6-a08a-db0b4825f9ab-1 ransomware or cyber attacks.
6fa4ca88-f124-4e19-9788-d896170e986e-0 Courts increasingly require businesses to carry dedicated cyber insurance if they 6fa4ca88-f124-4e19-9788-d896170e986e-1 want protection for digital incidents. 8870d4ec-34e0-45da-bb44-3e2c06e13092-0 Another case, Home Depot versus Steadfast, occurred last year. 6f3cc0b8-ca37-4ad4-b956-b1a2940b0b76-0 In 2014, Home Depot suffered one of the largest 6f3cc0b8-ca37-4ad4-b956-b1a2940b0b76-1 retail data breaches in U.S. c628f83a-1e76-4489-96e6-20fe8ca031fa-0 history after hackers stole payment card information from more than 50 million c628f83a-1e76-4489-96e6-20fe8ca031fa-1 customers.
850aa6e5-7165-4821-8aa2-43583454a275-0 Banks and financial institutions were forced to cancel and reissue millions of 850aa6e5-7165-4821-8aa2-43583454a275-1 credit cards, reimburse fraudulent charges and increase 850aa6e5-7165-4821-8aa2-43583454a275-2 fraud monitoring. 7c134c0e-d404-4508-a9f8-4eacad57b9a8-0 Home Depot ultimately paid about 170 million to settle related claims.
9d7bd4cd-3603-45b6-8f60-2e30dc8f587c-0 After exhausting the limits of its stand alone cyber insurance policy, 9d7bd4cd-3603-45b6-8f60-2e30dc8f587c-1 Home Depot sought additional coverage under its traditional commercial general 9d7bd4cd-3603-45b6-8f60-2e30dc8f587c-2 liability policies issued by Steadfast Insurance and others. 0e3d248a-a64a-4ae6-adaf-a47e0d72e5fd-0 The insurers denied the claim, arguing that the policies specifically 0e3d248a-a64a-4ae6-adaf-a47e0d72e5fd-1 excluded losses involving electronic data.
84accadf-a12b-4e4e-8d27-295251fd43f6-0 Home Depot argued that the claims involve physical credit cards that had to be 84accadf-a12b-4e4e-8d27-295251fd43f6-1 replaced, not just digital information. f9986f74-fa9d-4566-a5a9-f107570d3c32-0 In 2025, the US Court of Appeals in the 6th f9986f74-fa9d-4566-a5a9-f107570d3c32-1 Circuit ruled in favor of the insurers. 724cab8b-baf3-451e-a805-fef6ed4784ac-0 The court concluded that the losses arose from stolen electronic payment data, 724cab8b-baf3-451e-a805-fef6ed4784ac-1 which fell squarely within the policies. ef5f816b-9311-4a11-a589-74ce996d87b2-0 Electronic exclusions.
58720f85-d1aa-4b8c-86b8-926f30b78c38-0 The case became an important example of how courts increasingly distinguished 58720f85-d1aa-4b8c-86b8-926f30b78c38-1 between traditional business insurance and dedicated cyber insurance coverage. b7120647-c407-4515-8b9f-3c28c5580f10-0 Last case we'll look at National Inc versus State auto. 8e147436-f3fd-4417-bfdf-2a7c5f795b36-0 What happened in 2020? 2e7ba12c-a6cc-4def-b1b8-f22479dee9d2-0 National Inc and Stinch, a small Maryland embroidery company, 2e7ba12c-a6cc-4def-b1b8-f22479dee9d2-1 suffered A ransomware attack in 2016 after malware infected its computer 2e7ba12c-a6cc-4def-b1b8-f22479dee9d2-2 systems.
579ece20-c68f-424f-8c19-fb71ec903292-0 The attack corrupted software and disrupted business operations, 579ece20-c68f-424f-8c19-fb71ec903292-1 forcing the company to spend thousands of dollars replacing servers, 579ece20-c68f-424f-8c19-fb71ec903292-2 reinstalling software, restoring data and recovering its 579ece20-c68f-424f-8c19-fb71ec903292-3 networks. b786447d-00a0-4d99-9166-6e6889213b44-0 When the company filed a claim under its business owners policy, b786447d-00a0-4d99-9166-6e6889213b44-1 state auto insurance denied much of the coverage, b786447d-00a0-4d99-9166-6e6889213b44-2 arguing that the software and electronic data were not considered physical damage.
fbbd5db5-9b28-40bb-8710-e152c7f99036-0 In 2020, a federal court in Maryland largely sided fbbd5db5-9b28-40bb-8710-e152c7f99036-1 with National Inc, ruling that the ransomware attack caused fbbd5db5-9b28-40bb-8710-e152c7f99036-2 a form of direct physical loss of or damage because the company's systems fbbd5db5-9b28-40bb-8710-e152c7f99036-3 could no longer function normally without extensive restoration. 4dfe3370-c81b-4bdc-b639-94fc74e23a18-0 The case became important because it showed that some older business policies 4dfe3370-c81b-4bdc-b639-94fc74e23a18-1 could still provide limited cyber related coverage.
b9e90c15-1a52-4dcc-81ea-62c2292042f7-0 However, insurers later tighten policy language b9e90c15-1a52-4dcc-81ea-62c2292042f7-1 and exclusion specifically to prevent small or similar claims under traditional b9e90c15-1a52-4dcc-81ea-62c2292042f7-2 business owner policies in the future. 4e9a9d56-ee77-4480-a3c0-5c308823f6fe-0 One of the biggest changes in the cyber insurance market of the last few years is 4e9a9d56-ee77-4480-a3c0-5c308823f6fe-1 that carriers no longer view cybersecurity as a simple questionnaire.
092633e4-2b83-4e7b-b90e-cfb02f743724-0 In the past, organizations could often obtain coverage 092633e4-2b83-4e7b-b90e-cfb02f743724-1 by answering a series of application questions and checking a few boxes. 600002af-e4d1-49d8-a429-c45571de6853-0 Today's cyber insurance has become a controlled base contract. 6356e40f-aaa8-4b33-8cd2-049cfa9f0820-0 Insurers increasingly verified the security measures that applicants claim 6356e40f-aaa8-4b33-8cd2-049cfa9f0820-1 to have in place and that they expect those controls to be implemented, 6356e40f-aaa8-4b33-8cd2-049cfa9f0820-2 documented and maintained.
bc7f38d8-1f60-46dc-978f-edb7eafdd252-0 In many cases, the difference between a paid claim and a bc7f38d8-1f60-46dc-978f-edb7eafdd252-1 denied claim comes down to whether these baseline requirements were actually in bc7f38d8-1f60-46dc-978f-edb7eafdd252-2 place when an incident occurred. 47d3e479-8f60-448a-8cbf-2c96f06dc582-0 5 controls shown here have become the foundation of modern cyber underwriting. 5bf48f41-4386-4257-a5f4-98f59d324e0c-0 Multi factor authentication most of you have already heard of is now considered 5bf48f41-4386-4257-a5f4-98f59d324e0c-1 mandatory. a1c93d94-21d8-4fac-9402-f45c9b9b71da-0 Virtually all users and systems.
bafa4e3a-77bf-4a9a-afc2-b08b868f8d45-0 Endpoint detection and response tools provide continuous monitoring for devices bafa4e3a-77bf-4a9a-afc2-b08b868f8d45-1 from malware and malicious activity. c93266f7-ada2-4208-a0ed-3394cfb85a7b-0 Curious also expect organizations to maintain tested air gap or immutable c93266f7-ada2-4208-a0ed-3394cfb85a7b-1 backups that can survive a ransomware attack. 8829f51c-9820-461f-8055-ab040ba1db48-0 Rapid patch management is equally important because unpatched 8829f51c-9820-461f-8055-ab040ba1db48-1 vulnerabilities remain one of the most common ways attackers gain access to 8829f51c-9820-461f-8055-ab040ba1db48-2 business networks.
5520bd65-4db2-4253-9e4a-c19cfbed6a6d-0 And in fact, outdated or unsupported systems have been 5520bd65-4db2-4253-9e4a-c19cfbed6a6d-1 linked to approximately 22% of denied insurance claims. a9a6ac12-ed77-4779-9530-6e9d20ef5ad0-0 The 5th requirement, A documented incentive response plan, a9a6ac12-ed77-4779-9530-6e9d20ef5ad0-1 ties all the others together. a6980963-9d2e-4f8e-a94d-910ee1bea4eb-0 We covered incident response plan development in our March session. 05931e7f-713c-495b-9333-555e4389c241-0 To look back at that session, you can visit Scores or Data Defenders 05931e7f-713c-495b-9333-555e4389c241-1 YouTube channel for a detailed refresher.
1286a069-f83c-4870-8647-d43a6f886c67-0 Please recall, however, from that session that insurers want 1286a069-f83c-4870-8647-d43a6f886c67-1 evidence of an organization's ability to have those security controls in place. 086d6440-3efa-4ac6-8e9b-2220c51e78ef-0 They also want a clear plan for responding when something goes wrong. dd91d09d-022c-4469-8ec0-9f3a55563a21-0 And a written and tested incident response plan demonstrates preparedness, dd91d09d-022c-4469-8ec0-9f3a55563a21-1 reduced risk, and can positively impact both dd91d09d-022c-4469-8ec0-9f3a55563a21-2 underwriting decisions and premium costs. 54cdc2d8-c4d0-4c4f-be4d-017e36d9e738-0 The take away is simple.
b8236048-55cb-4754-b972-8661b9fd2313-0 These controls no longer considered best practices or recommendations for many b8236048-55cb-4754-b972-8661b9fd2313-1 carriers. e5656351-b3db-4e61-bea4-59b3237b489b-0 They have become contractual conditions of coverage and the minimum requirements e5656351-b3db-4e61-bea4-59b3237b489b-1 for obtaining cyber insurance at a reasonable cost. bf299361-d08f-4f0d-a518-cf74f3e4f608-0 For those of you who attended our March session on incident response planning, bf299361-d08f-4f0d-a518-cf74f3e4f608-1 I want to connect to that discussion directly to today's topic.
b510d0b9-1860-4e72-ab49-4ed611a9b88e-0 At that time, we focus on operational readiness, b510d0b9-1860-4e72-ab49-4ed611a9b88e-1 how to detect an incident, contain the damage, recover systems, b510d0b9-1860-4e72-ab49-4ed611a9b88e-2 and learn from the event afterward. 35b68569-a4f4-4e44-9fb9-9cc7a04b849d-0 Many business owners don't realize it is that incident response plan is an 35b68569-a4f4-4e44-9fb9-9cc7a04b849d-1 extremely important security document. 3a2b6144-44be-4935-b826-712070b423d9-0 It's also something insurance underwriters increasingly view as 3a2b6144-44be-4935-b826-712070b423d9-1 evidence that your organization is a lower risk customer.
301c3242-7425-442c-9600-ff307bc3db18-0 From an insurance perspective, a documented and tested incentive 301c3242-7425-442c-9600-ff307bc3db18-1 response plan can have a direct financial impact. d2719af2-ef2a-4d5c-b545-253303f49685-0 Organizations that can demonstrate a current incident response plan often d2719af2-ef2a-4d5c-b545-253303f49685-1 qualify for faster underwriting, fewer policy exclusions, d2719af2-ef2a-4d5c-b545-253303f49685-2 and in some cases, premium reductions of 10 to 20%.
4ea2d8a1-4c4e-4f36-9e5f-334d2335c5b1-0 By contrast, businesses that cannot show a documented 4ea2d8a1-4c4e-4f36-9e5f-334d2335c5b1-1 IRP may face higher premiums, additional exclusions, 4ea2d8a1-4c4e-4f36-9e5f-334d2335c5b1-2 and even difficulty obtaining coverage at all. 0a7faea6-66d9-4801-acfb-3cb4ae6da8bd-0 Underwriters want to know if an incident occurs. 16a9a056-35bc-4f84-a261-a4dea85b5195-0 Your organization has a structured process in place for responding quickly 16a9a056-35bc-4f84-a261-a4dea85b5195-1 and minimizing losses. 604e5a5e-4713-49c4-b8ab-e34acbd1debf-0 The key take away here is that preparedness has measurable business 604e5a5e-4713-49c4-b8ab-e34acbd1debf-1 value.
6dabf4ad-a9e0-4dc8-a99b-23fd99ac8221-0 The work you put in to developing an incident response plan today is not 6dabf4ad-a9e0-4dc8-a99b-23fd99ac8221-1 simply about compliance or checking the security box. ff766024-d20a-41a6-b4e9-1f8ea34110ad-0 It is directly. 6b444315-39aa-4418-a846-6c96a7c4a016-0 It is about directly affecting your insurability and the cost of your 6b444315-39aa-4418-a846-6c96a7c4a016-1 coverage. 44cc9d16-d8d7-4ef3-8f46-14b7bf27d134-0 But today's cyber insurance market carriers are looking for evidence that 44cc9d16-d8d7-4ef3-8f46-14b7bf27d134-1 organizations are prepared to respond effectively when something goes wrong.
05991462-a23c-4b0b-8b75-d734ebf47210-0 A documented and tested IRP demonstrates that preparedness make it one of the most 05991462-a23c-4b0b-8b75-d734ebf47210-1 valuable cybersecurity investments a small business can make. 0ea2e7b6-e43d-4b21-b361-976ae649a49c-0 One of the most encouraging developments in the cyber insurance market is that 0ea2e7b6-e43d-4b21-b361-976ae649a49c-1 good cybersecurity practices can directly reduce your cost of coverage.
5c406afa-4c61-408b-96d6-a7fabed1a5e7-0 Insurance carriers increasingly reward organizations that demonstrate strong 5c406afa-4c61-408b-96d6-a7fabed1a5e7-1 security controls because those businesses are less likely to experience 5c406afa-4c61-408b-96d6-a7fabed1a5e7-2 a cyber incident. 390aa066-34a2-40cc-9523-8f51b192b910-0 The numbers here that we show illustrate that relationship clearly. 7af82a2b-ce9c-4da6-a75d-0ef28b2e04eb-0 Multi Factor authentication, or MFA by itself, 7af82a2b-ce9c-4da6-a75d-0ef28b2e04eb-1 can result in a premium discount of up to 18 to 22% from major carriers.
d6990980-cea9-45fd-abbb-3d1f24ef384f-0 Some studies show that organizations using MFA pay 20 to 40% less than similar d6990980-cea9-45fd-abbb-3d1f24ef384f-1 businesses that do not have MFA in place. 5297dc5a-37f2-4311-97f4-4fa3e95705d7-0 Perhaps most importantly, MFA is estimated to prevent approximately 5297dc5a-37f2-4311-97f4-4fa3e95705d7-1 99% of account takeover attacks, making it one of the highest valued 5297dc5a-37f2-4311-97f4-4fa3e95705d7-2 security investments a business can make. 0b5fd00d-a522-4b0f-bee8-a5837bacb45d-0 The savings becomes even more significant when organizations implement a full 0b5fd00d-a522-4b0f-bee8-a5837bacb45d-1 security program.
8efa3815-a4a2-4cc1-b028-2ebea8d3e5ba-0 Businesses that combine MFAEDR tested backups, 8efa3815-a4a2-4cc1-b028-2ebea8d3e5ba-1 employer security awareness training, and a document IRP often see premium 8efa3815-a4a2-4cc1-b028-2ebea8d3e5ba-2 reductions ranging from 20 to 50%. a944addd-8ac1-4ada-9109-802a674da8dc-0 Some mature organizations may qualify reductions up to 60%.
f4a57904-a145-4373-898f-7a474ec06e61-0 Considering that the median annual insurance premium for businesses with f4a57904-a145-4373-898f-7a474ec06e61-1 fewer than 250 employees is approximately $17140, f4a57904-a145-4373-898f-7a474ec06e61-2 those savings can be substantial while simultaneously improving the f4a57904-a145-4373-898f-7a474ec06e61-3 organization's ability to prevent and respond to attacks. 46025932-20ff-430f-ab97-b9032032c7dc-0 The contrast would be clear when we look at organizations that lack these controls.
6f1e6127-e702-48fc-af20-bdb339f94650-0 Businesses without cybersecurity safeguards often face higher premiums, 6f1e6127-e702-48fc-af20-bdb339f94650-1 more policy exclusions, and in some cases, difficulty obtaining coverage at all. c775fb20-4cf7-46fd-9f18-154ab963e1b2-0 Even worse, if a claim is denied because required c775fb20-4cf7-46fd-9f18-154ab963e1b2-1 controls were not actually in place, the organization may be forced to absorb c775fb20-4cf7-46fd-9f18-154ab963e1b2-2 the full cost of the incident out of pocket.
f7537791-4f51-49db-a6fb-41414e774bb3-0 With the average small business breach costing anywhere from 25 to $250,000, f7537791-4f51-49db-a6fb-41414e774bb3-1 the financial math becomes difficult to ignore. 816a10bd-435a-4504-9345-3d8fe4c7a9b9-0 A relatively modest investment in security controls not only reduces risk, 816a10bd-435a-4504-9345-3d8fe4c7a9b9-1 but also lowers insurance costs and improve the likelihood that coverage will 816a10bd-435a-4504-9345-3d8fe4c7a9b9-2 be available when it is most needed.
f311b581-f9ce-4c0c-9fb0-7268da527235-0 One of the most important lessons about cyber insurance is that purchasing a f311b581-f9ce-4c0c-9fb0-7268da527235-1 policy does not automatically that a claim will be paid. 8c4c9fd9-9c93-4a9d-b300-d2809a64bcc3-0 In fact, insurers denied claims for specific 8c4c9fd9-9c93-4a9d-b300-d2809a64bcc3-1 reasons that are often preventable. da4be9db-8aa9-42f9-abcc-13b5758aee31-0 The first is application misrepresentation.
4b51df7d-c06e-4b37-99ed-47f52069c100-0 In the Travelers versus ICS case, a company executive certified that multi 4b51df7d-c06e-4b37-99ed-47f52069c100-1 factor authentication had been deployed throughout the organization when it had 4b51df7d-c06e-4b37-99ed-47f52069c100-2 not. 3799d49c-b36d-4f67-a2b5-36287f5bcd82-0 When a cyber incident occurred, the insured discovered the discrepancy, 3799d49c-b36d-4f67-a2b5-36287f5bcd82-1 avoided the policy from the inception, leaving the company with no coverage. 229480e8-bfe6-4a6d-8b42-243dae4a6e79-0 The lesson is simple. ada37d0d-b991-4da5-81c2-998e0945bbbf-0 Every answer on an insurance application must be accurate and verifiable.
d489aae7-d29d-41c3-ab27-2f2648eb3f74-0 The second major reason claims are denied is 30 to maintain required security d489aae7-d29d-41c3-ab27-2f2648eb3f74-1 controls after the policy is issued. b8b384c8-a25b-491f-94f7-cd3f68cd776b-0 The City of Hamilton, ON learned this lesson the hard way when b8b384c8-a25b-491f-94f7-cd3f68cd776b-1 a cyber claim was denied because of required MFA control had not been b8b384c8-a25b-491f-94f7-cd3f68cd776b-2 implemented despite being the policy requirement, b8b384c8-a25b-491f-94f7-cd3f68cd776b-3 the city ultimately absorbed more than $18 million in losses. c9a427bc-dc40-42c1-ad1d-fb2fd351e736-0 The third denial category involves excluded events.
3e92ce5d-e944-4b35-9d36-97cf08cc15bf-0 Some attacks, such as nation state cyber operations may 3e92ce5d-e944-4b35-9d36-97cf08cc15bf-1 fall under war exclusions, and we're certainly experiencing that 3e92ce5d-e944-4b35-9d36-97cf08cc15bf-2 today with what's going on between the US and Iran and even before that, 3e92ce5d-e944-4b35-9d36-97cf08cc15bf-3 Russia and Ukraine.
5bc19579-2994-401c-9dee-db3a8a7b4f9e-0 While business e-mail compromise and social engineering fraud often requires 5bc19579-2994-401c-9dee-db3a8a7b4f9e-1 separate endorsements, in fact, business e-mail compromise and social 5bc19579-2994-401c-9dee-db3a8a7b4f9e-2 engineering incidents account for roughly 60% of cyber insurance claims that are 5bc19579-2994-401c-9dee-db3a8a7b4f9e-3 frequently excluded from standard coverage. e8afcaf2-fa05-4fca-aeb8-c2ef1278dee9-0 The 4th and final category involves actions taken after an incident occurs. 19311812-d7fe-48c2-bd77-b22a52cc4b5d-0 The statistics on this slide are particularly revealing.
30a68bfb-21db-493e-9efc-25be56f8e720-0 17% deny claims involved late notification to the insurer, 30a68bfb-21db-493e-9efc-25be56f8e720-1 while 44% involved in adequate documentation. 65e16fd0-88b5-433d-853d-a32b663ae051-0 Many policies also require insurers to approve certain actions, 65e16fd0-88b5-433d-853d-a32b663ae051-1 including ransomware negotiations and payments. d7cb0377-8fc0-4373-ad60-43fcfb01c866-0 If an organization pays a ransom without notifying its carrier or fails to d7cb0377-8fc0-4373-ad60-43fcfb01c866-1 document its response properly, coverage may be denied even though a d7cb0377-8fc0-4373-ad60-43fcfb01c866-2 ballot policy was in place.
957ba80a-463e-4a31-830b-a0bd2b070ec7-0 The take away is that cyber insurance that is not simply something you buy and 957ba80a-463e-4a31-830b-a0bd2b070ec7-1 file away. f9e69715-f75a-4bed-882f-c2df213875e1-0 It is an ongoing contractual relationship that requires accurate disclosures, f9e69715-f75a-4bed-882f-c2df213875e1-1 maintain controls, awareness of exclusions and discipline f9e69715-f75a-4bed-882f-c2df213875e1-2 incident response procedures if you expect a claim to be paid when you need f9e69715-f75a-4bed-882f-c2df213875e1-3 it most.
8f306d36-4e28-4bb9-97e8-f0d1b226a66e-0 At the end of the day, cyber insurance is really a financial 8f306d36-4e28-4bb9-97e8-f0d1b226a66e-1 decision, and here we put that decision into 8f306d36-4e28-4bb9-97e8-f0d1b226a66e-2 perspective. 3ab59489-9597-4ad9-8b10-f5cf7407beb7-0 When a cyber incident occurs, the costs add up extremely quickly.
092ab3e3-bc9f-4dc3-bff8-1a41ee377605-0 A business may face IT recovery expenses ranging from 10 to $50,000, 092ab3e3-bc9f-4dc3-bff8-1a41ee377605-1 legal and regulatory costs that can exceed $100,000 or more, 092ab3e3-bc9f-4dc3-bff8-1a41ee377605-2 customer notification expenses, ransomware demands, 092ab3e3-bc9f-4dc3-bff8-1a41ee377605-3 and significant downtime losses that can range from 8 to $74,000 per day. 4ab816f1-cd06-4a20-9ebd-e36239880b7b-0 When all these factors are combined, the average uninsured cyber incident for 4ab816f1-cd06-4a20-9ebd-e36239880b7b-1 a small business can easily cost from anywhere between $25,000 to 250, 4ab816f1-cd06-4a20-9ebd-e36239880b7b-2 000 or more.
7ff2838d-a959-4792-a640-c2fad9adb591-0 The statistics become even more sobering when we look at how these cost effect 7ff2838d-a959-4792-a640-c2fad9adb591-1 small businesses. f91a2ee0-c3cc-403a-a1b8-cbaf3df3ca5d-0 According to the data shown here, one in five small businesses would be f91a2ee0-c3cc-403a-a1b8-cbaf3df3ca5d-1 forced to close if a cyber incident cost them just $10,000. ef9c10cd-5dbd-482b-9693-a5636d2bf477-0 At a loss of $50,000, that member rises dramatically, ef9c10cd-5dbd-482b-9693-a5636d2bf477-1 with 55% of small businesses reporting they would not survive the financial ef9c10cd-5dbd-482b-9693-a5636d2bf477-2 impact.
a03949ec-9784-4504-bf89-db5da0a12693-0 These figures help explain why so many cyber incidents become business ending a03949ec-9784-4504-bf89-db5da0a12693-1 events, not just because the attack itself was a03949ec-9784-4504-bf89-db5da0a12693-2 catastrophic, but because the organization lacked the a03949ec-9784-4504-bf89-db5da0a12693-3 financial resources to absorb the financial losses that followed. 104f34a9-458d-4886-a1be-0ecc4c868a07-0 Compare those numbers to the cost of coverage.
00d425b4-bc68-4215-b439-22937b90c385-0 The median annual insurance premium for businesses with Tier 250, 00d425b4-bc68-4215-b439-22937b90c385-1 as we stated earlier, is $17140, and organizations with strong security 00d425b4-bc68-4215-b439-22937b90c385-2 controls may pay even as little as 1000 to $1500 per year. 951bb753-f787-418a-b25e-59fd473f47af-0 Even businesses with weaker security postures often pay far less than the cost 951bb753-f787-418a-b25e-59fd473f47af-1 of a single incident. ff32832c-f5ff-4225-bedf-bc8fcbd32b33-0 The mass shown here tells a powerful story.
88db0a07-e97b-4b81-b2e4-c4a8dc3364e5-0 A1 side ransom that can cost an equivalent of 15 to 150 years of 88db0a07-e97b-4b81-b2e4-c4a8dc3364e5-1 insurance premiums. 83a33686-7ab4-48b9-a8d9-1e271d1b46b1-0 Whether viewed as risk management, business continuity, 83a33686-7ab4-48b9-a8d9-1e271d1b46b1-1 or financial protection, the economic argument for cyber insurance 83a33686-7ab4-48b9-a8d9-1e271d1b46b1-2 is difficult to ignore. 35d87e62-3060-4580-b403-e2b292692174-0 Far more tangible businesses that no longer exist. 72fd3ea3-1b8d-4547-8cc3-c70c6f09cf75-0 These are not hypothetical examples of worst case scenarios.
5ac3f9df-26ea-4dbb-94c1-155c3be0b54d-0 They are real organizations that suffer ransomware attacks that ultimately close 5ac3f9df-26ea-4dbb-94c1-155c3be0b54d-1 their doors. 25f9bea5-4d83-43e2-98cc-a9b4c097cb6d-0 According to the research cited here, approximately 60% of small businesses 25f9bea5-4d83-43e2-98cc-a9b4c097cb6d-1 shut down permanently within six months of a serious cyber attack. 66d65a0e-5688-4cd9-9a4a-d7d05addb64f-0 Behind this that statistic are employees, customers, families, business owners, 66d65a0e-5688-4cd9-9a4a-d7d05addb64f-1 and communities whose livelihoods have been significantly affected.
f9714dae-e452-474b-b0a5-0128de55984b-0 Wood Ranch Medical was a small healthcare practice in Simi Valley, f9714dae-e452-474b-b0a5-0128de55984b-1 CA that became a widely cited example of how destructive ransomware can be for f9714dae-e452-474b-b0a5-0128de55984b-2 small businesses. 8835fc6a-dbe8-45f2-a05c-84880e2687d4-0 In 2019, attackers infiltrated the clinic's 8835fc6a-dbe8-45f2-a05c-84880e2687d4-1 systems and encrypted both electronic health records and it's data backups.
c5fee31c-bf71-4c7d-8a86-d9e4045c8863-0 Without access to patient records, scheduling systems, billing information, c5fee31c-bf71-4c7d-8a86-d9e4045c8863-1 or recoverable backups, the practice could no longer safely c5fee31c-bf71-4c7d-8a86-d9e4045c8863-2 operate. 5d0c8220-ddf3-47f7-94f2-b3cfcd1910aa-0 Nearly 6000 patients were affected as a result, 5d0c8220-ddf3-47f7-94f2-b3cfcd1910aa-1 and after months of attempting to recover, Wood Ranch medical announcement would 5d0c8220-ddf3-47f7-94f2-b3cfcd1910aa-2 primarily close in December 2019.
aa44e0ac-2705-4ed2-8b95-fb657985906e-0 The incident became an important cautionary example of type of security aa44e0ac-2705-4ed2-8b95-fb657985906e-1 discussions because it demonstrated that ransomware is not simply an IT issue, aa44e0ac-2705-4ed2-8b95-fb657985906e-2 it can become a business in the event. 76d47825-fe33-44d0-9086-ef94c3e806ec-0 The case highlighted the critical importance of secure backups, 76d47825-fe33-44d0-9086-ef94c3e806ec-1 tested recovery plans, incident response preparation, 76d47825-fe33-44d0-9086-ef94c3e806ec-2 and financial resilience through cyber insurance and continuity planning.
a58e09e1-f98d-4782-a866-edf98a2c904f-0 Brooks ENT, hearing, a small medical practice in Battle Creek, a58e09e1-f98d-4782-a866-edf98a2c904f-1 MI, suffered A ransomware attack in 2019 as a58e09e1-f98d-4782-a866-edf98a2c904f-2 well that devastated the organization's operations. d32af67b-99c2-4e37-a4ca-cb92921f7d3f-0 Attackers gained access to the clinic systems and demanded approximately $6500 d32af67b-99c2-4e37-a4ca-cb92921f7d3f-1 in ransom. cae59a99-f274-4bdc-a6df-246257f64dd9-0 The practice refused to pay, hoping to recover its systems cae59a99-f274-4bdc-a6df-246257f64dd9-1 independently.
c7382e24-9d5d-463a-8467-24f31a914978-0 In response to the attackers permanently deleted patient records, c7382e24-9d5d-463a-8467-24f31a914978-1 appointment schedules, and critical operational data, c7382e24-9d5d-463a-8467-24f31a914978-2 leaving the clinic unable to continue functioning normally. 987eb1c4-2ccc-4ca6-9111-00611915ce52-0 Without access to its records or viable recovery path, 987eb1c4-2ccc-4ca6-9111-00611915ce52-1 Brookside ENT was forced to shut down permanently. 87ccc910-a0cb-453f-ac7c-7c4fe1083432-0 The Co owners ultimately retired earlier than planned and patients lost continuity 87ccc910-a0cb-453f-ac7c-7c4fe1083432-1 of care and access to historical medical information.
e489e88b-8217-4dd8-95a6-8335b0f650a6-0 The incident became a widely referenced example of how even relatively small e489e88b-8217-4dd8-95a6-8335b0f650a6-1 ransom demands CNF catastrophic consequences for small businesses and e489e88b-8217-4dd8-95a6-8335b0f650a6-2 healthcare providers that lack resilient backups, e489e88b-8217-4dd8-95a6-8335b0f650a6-3 tested recovery procedures and sufficient cyber preparedness.
8aeb049a-0a7a-4690-90ef-95c7cefc9ec2-0 Lastly, The Heritage Company, a 61 year old debt collection agency 8aeb049a-0a7a-4690-90ef-95c7cefc9ec2-1 based in Arkansas, suffered ransomware attack in 2019 as 8aeb049a-0a7a-4690-90ef-95c7cefc9ec2-2 well that crippled his operations during the holiday season. 4f6b178d-54c6-46bf-9223-77d6997d467f-0 The attack disrupted the company's systems, 4f6b178d-54c6-46bf-9223-77d6997d467f-1 salted normal business activities, and forced leadership into a desperate 4f6b178d-54c6-46bf-9223-77d6997d467f-2 effort to restore operations.
ac5d2a5e-c1e8-4952-8ba6-0085e2a0939e-0 Although the company ultimately paid the rant and demand, ac5d2a5e-c1e8-4952-8ba6-0085e2a0939e-1 it's IT team was still unable to fully recover critical systems and business ac5d2a5e-c1e8-4952-8ba6-0085e2a0939e-2 functions. 4394f240-2fb6-4ad1-80f8-0e43e2cf243a-0 As damage continued to mount, the company could no longer sustain 4394f240-2fb6-4ad1-80f8-0e43e2cf243a-1 itself and just days before Christmas, approximately 300 employees were informed 4394f240-2fb6-4ad1-80f8-0e43e2cf243a-2 that they would lose their jobs.
c69a28ae-8be1-4eb5-8f9e-908c78beccae-0 Reports later surfaced that the CEO had personally covered employee wages for a c69a28ae-8be1-4eb5-8f9e-908c78beccae-1 period of time in an effort to keep the business afloat. 604ff9c9-18e7-4025-b5a1-339f239736ae-0 The incident became a powerful example for how ransomware can destroy even long 604ff9c9-18e7-4025-b5a1-339f239736ae-1 established businesses, not only through technical disruption, 604ff9c9-18e7-4025-b5a1-339f239736ae-2 but through the cascading financial and operational consequences that followed.
8bc36e88-fa0e-464a-a5e8-07d58c5bf5ef-0 One of the most overlooked consequences of cyber attacks is that the damage often 8bc36e88-fa0e-464a-a5e8-07d58c5bf5ef-1 extends power beyond the business itself. cf090a68-9b88-44df-aeda-1590e132f47f-0 Many owners assume that once a ransom is paid, cf090a68-9b88-44df-aeda-1590e132f47f-1 the system is going to be restored and the incident will be over. 3fb570f5-b003-44dd-a40a-3912864e97aa-0 Unfortunately, the data tells a very different story. d7ec17ba-a1f4-45fc-be05-3ff479a10505-0 According to the studies cited here, approximately 80% of organizations that d7ec17ba-a1f4-45fc-be05-3ff479a10505-1 paid the ransom were attacked again.
20f6ae12-16eb-4886-9186-5d8e12d72cb3-0 Even more concerning, 68% of those repeat attacks occurred 20f6ae12-16eb-4886-9186-5d8e12d72cb3-1 within one month of the original incident. 6d11ab2d-4eb0-4a4c-aefc-fef7c1c191a3-0 And Painter Ransom does not remove you from the attacker's radar. 93ed2c07-b5a0-465d-b6e5-e641d558c524-0 As a matter of fact, it often places you back on the radar. 1c65cf23-6a3a-46cf-925b-613dd0f4b29d-0 The statistics become even more alarming when we look at who conducted these 1c65cf23-6a3a-46cf-925b-613dd0f4b29d-1 follow up attacks.
69976634-f845-4096-932d-24f0d4215639-0 42% of repeat incidents are carried out by entirely different attackers because 69976634-f845-4096-932d-24f0d4215639-1 victim information is frequently shared or sold within criminal networks. 08a92207-35bd-4862-ba91-1f03cdc828ac-0 In other words, Painter Ransom may signal to others that 08a92207-35bd-4862-ba91-1f03cdc828ac-1 you are willing to pay. aaf8769d-e136-40fa-ba74-8989e7b974fa-0 This is why cybersecurity agencies around the world consistently warn that ransom aaf8769d-e136-40fa-ba74-8989e7b974fa-1 payments do not guarantee recovery and may actually increase future risk.
bd65f1a0-46ec-4d19-9883-f21a78e44015-0 The decision to pay can feel like a way out of a crisis, bd65f1a0-46ec-4d19-9883-f21a78e44015-1 but the data suggests it often creates new vulnerabilities rather than bd65f1a0-46ec-4d19-9883-f21a78e44015-2 eliminating them. 3e84c0af-a776-45f2-a217-3bb98d04fbf8-0 The personal consequences can be just as significant as the business impact for 3e84c0af-a776-45f2-a217-3bb98d04fbf8-1 sole proprietors and closely held businesses. 7f109caf-44fc-4659-af60-e2812abd1e54-0 Companies of personal finances are often closely connected.
242b85d7-a28b-4176-9dde-99da7b6c0d98-0 A breach may expose not only business records, but also Social Security numbers, 242b85d7-a28b-4176-9dde-99da7b6c0d98-1 tax information, banking details, and personal credit. 44064bb5-4c88-4d2f-a14a-537acaf008a7-0 24% of breach victims experience identity theft in the following year. 7e9f0580-156d-4687-be6e-3c2343890b8c-0 Unlike personal credit, business credit generally cannot be 7e9f0580-156d-4687-be6e-3c2343890b8c-1 frozen. 776ca824-fcfa-447d-89f0-02a43641b7ec-0 It can only be monitored. e7816902-be59-4534-8066-cf6d988abbcf-0 That reality makes preparation even more important.
eb9d08ef-6554-4d57-afa0-7445b2293fb0-0 The cyber incident is not simply an operational event. 0cdb2b55-4da4-45bf-939d-96d84797e341-0 It can become a long term personal financial issue that follows. 26177012-33d2-479e-8652-ac5c5c87790a-0 It follows an owner long after the technical recovery has been complete. 5bbeb4f1-2449-4a1d-a9eb-b6f989738cbd-0 So far, we've discussed the cost of cyber 5bbeb4f1-2449-4a1d-a9eb-b6f989738cbd-1 incidents, the consequences of inadequate coverage, 5bbeb4f1-2449-4a1d-a9eb-b6f989738cbd-2 and the challenges organizations often faced after an attack. f91c6482-8d51-4c8c-aa35-4d229e3f82eb-0 Let's shift a little bit and focus on something more encouraging.
ce459311-15b4-471e-b0da-d10c45d0defb-0 The measurable value of preparation data consistently shows that organizations ce459311-15b4-471e-b0da-d10c45d0defb-1 that invest in cybersecurity before an incident experience significantly lower ce459311-15b4-471e-b0da-d10c45d0defb-2 cost afterwards. d8c58a0b-5ad5-4b5e-a353-aedf42db3eb0-0 According to the research highlighted here, d8c58a0b-5ad5-4b5e-a353-aedf42db3eb0-1 small businesses with an active incident response plan can reduce breach related d8c58a0b-5ad5-4b5e-a353-aedf42db3eb0-2 costs by approximately 50%.
695908e3-9a9f-4ca4-a27b-c91d4016e4eb-0 Organizations with managed security monitoring and response capabilities can 695908e3-9a9f-4ca4-a27b-c91d4016e4eb-1 reduce overall security related costs by 50 to 70% compared to businesses that are 695908e3-9a9f-4ca4-a27b-c91d4016e4eb-2 unprepared. 2f7956e9-6327-4f31-ae3f-d34897521460-0 The reasons these savings occur is straightforward. 7da721b5-eaca-49cc-a55a-41f3f9b69c58-0 Businesses with active monitoring can detect threats faster, 7da721b5-eaca-49cc-a55a-41f3f9b69c58-1 and faster detection leads to faster containment. c2b9e860-e0f1-41fb-80bc-1a5257f319cf-0 Noted here.
02026880-bca6-4966-93c1-89c1093eee50-0 Organizations using active monitoring achieve threat detection speeds that are 02026880-bca6-4966-93c1-89c1093eee50-1 up to 96% faster, while businesses with tested incident 02026880-bca6-4966-93c1-89c1093eee50-2 response plans experience 35% more effective crisis response. 877eb347-d49f-42b2-980d-9dcee61a5fea-0 Every hour an attacker remains undetected increases potential damage recovery costs 877eb347-d49f-42b2-980d-9dcee61a5fea-1 and business disruption.
45e493dc-276a-4d94-8a71-126e4fca057a-0 By reducing detection and response times, organizations significantly limit the 45e493dc-276a-4d94-8a71-126e4fca057a-1 scope and cost of the incident before a major crisis occurs. cabce7d4-9470-4851-af18-fac0fb5ebc3e-0 The broader principle I work is that every layer of preparedness strengthens cabce7d4-9470-4851-af18-fac0fb5ebc3e-1 the next. 9cce7a02-2d6b-4b4a-bd36-9cefc78ae296-0 A man of security operations center helps identify threats quickly. 50832f58-2944-48d9-8129-8ddfb2f8cbd8-0 A testament to the response plan helps contain and recover from those threats 50832f58-2944-48d9-8129-8ddfb2f8cbd8-1 efficiently.
2f996683-7e37-45fa-9f51-cbf223740c2b-0 Cyber insurance provides financial protection for the risk that remains. b84a7d24-3d49-441b-ae40-bd0e1a6e4540-0 Together, these layers transform unpredictable b84a7d24-3d49-441b-ae40-bd0e1a6e4540-1 cyber losses into manageable business risk. 668c887e-408a-41ba-8faf-5628c9a4e434-0 Faster containment leads to lower recovery costs. e69b8b84-e8b4-4cdb-9939-54fea945dee1-0 Lower recovery costs leads to smaller insurance claims. f06eb16f-ca5a-41a7-8fdc-8f5506908213-0 The smaller insurance claims helps keeps future premiums under control.
497687ba-a7f6-49aa-980d-e00a634dd0ce-0 The organizations that consistently recover best from cyber incidents are not 497687ba-a7f6-49aa-980d-e00a634dd0ce-1 necessarily ones that avoid attacks. 5b12ec49-07de-4224-a0ee-bb97a2ca5325-0 They're the ones that are prepared for them before they happen. 44cc1153-4baa-4ca8-959f-7a37dac3a91a-0 As we conclude today's session, I want to leave you with a simple idea. 911187f0-6deb-4a99-8970-79f64c2ae325-0 Before you decide what insurance cyber insurance to buy, 911187f0-6deb-4a99-8970-79f64c2ae325-1 you need to understand what you're actually insuring.
44a6cad2-9804-4056-9a4d-97eae9ae1f6f-0 Cyber insurance is often more effective when it is built on a clear understanding 44a6cad2-9804-4056-9a4d-97eae9ae1f6f-1 of your risk. 5fb302cb-f706-4a65-acfb-231c78883885-0 The goal is not simply to purchase a policy, 5fb302cb-f706-4a65-acfb-231c78883885-1 it's to make informed decisions that protect your business financially and 5fb302cb-f706-4a65-acfb-231c78883885-2 operationally. cf475f8a-7645-444e-9445-fcab22a9e49e-0 When an incident occurs, the first action item is to review your cf475f8a-7645-444e-9445-fcab22a9e49e-1 current business owner policies or general liability policy.
e07fbd08-6c02-4cee-825e-7a5dd1aef6d6-0 Don't look at the declarations page. a6e2d8d1-e461-40c0-8dca-b61ad2e898ee-0 Look at the cyber exclusions, electronic data exclusions and a6e2d8d1-e461-40c0-8dca-b61ad2e898ee-1 endorsements such as the CG21O6 and BP15O Four. be7a3fca-169a-4851-9402-bf8be0a564fa-0 Many business owners are surprised to learn that cyber insurance are be7a3fca-169a-4851-9402-bf8be0a564fa-1 specifically excluded from their existing coverage. c61bba60-3c00-424f-8483-0080a9c9a972-0 If you're unsure what your policy covers, call your broker and ask a direct c61bba60-3c00-424f-8483-0080a9c9a972-1 question.
f56d13db-cdf9-40dd-8b4b-d69ef19914cb-0 If my business is hit with rant over tomorrow, am I covered? 40f47458-49af-422a-858b-cfa2fedcfddc-0 The second action item is to document your current security controls. 1d5c088b-148f-4223-9142-19ef7d27c06f-0 Can you demonstrate that you have multi factor authentication enabled? 13bc1c27-84fb-4088-81dc-f9c1460a599f-0 Tested backups? a6d3ba88-304e-4e59-bceb-70f0135d22ce-0 A documented incident response plan in place? c4622a68-4cc2-4513-b584-60edf398fde8-0 If not, those gaps should become your immediate c4622a68-4cc2-4513-b584-60edf398fde8-1 priorities before applying for coverage.
0e67ca68-3982-470a-857b-9f4d323dc6b6-0 The third action item to speak with an independent broker who specializes in 0e67ca68-3982-470a-857b-9f4d323dc6b6-1 cyber insurance. 0d18247b-087a-4e3f-99f2-32b19bb8f205-0 Cyber coverage has become a highly specialized field, 0d18247b-087a-4e3f-99f2-32b19bb8f205-1 and the policy that is right for your business may not be offered by the same 0d18247b-087a-4e3f-99f2-32b19bb8f205-2 agent who handles your property or liability insurance. 439620c4-b129-4291-bae9-d37ced5d29b6-0 Obtain quotes from multiple carriers.
ab1fbd44-4ae3-4ead-9b3f-bd971db96b99-0 Review the applications and the questions carefully and make sure every response ab1fbd44-4ae3-4ead-9b3f-bd971db96b99-1 can be supported by documentation. 58dc1a4e-d595-4cce-a12b-29e4b9c71c79-0 Businesses that obtain the best coverage and the best pricing are usually the ones 58dc1a4e-d595-4cce-a12b-29e4b9c71c79-1 that approach this process deliberately. b3f9e5e4-07f2-408e-b67e-c1d9ca20874a-0 They understand their risk and can demonstrate that they have taken b3f9e5e4-07f2-408e-b67e-c1d9ca20874a-1 reasonable steps to manage them.
b2e41320-26a5-4aa5-b652-de4bb361d660-0 So as we wrap up here, moving the Q& A in March, b2e41320-26a5-4aa5-b652-de4bb361d660-1 we offer some resources that you can get access to help you in your preparation. 92fcfab5-2a86-4d86-a682-174e75682a8e-0 The Cyber Incident Management plan template that we prepare for small 92fcfab5-2a86-4d86-a682-174e75682a8e-1 businesses. ecbe98c2-76b5-422b-a5ba-ab54674b33cf-0 You can go to our side and download that template and use it to quickly craft your ecbe98c2-76b5-422b-a5ba-ab54674b33cf-1 incident response plan.
1023b390-fa74-4ab2-adcb-8d1fc980e9c5-0 You can also go to the Nyack Consumer Resource Center for information on cyber 1023b390-fa74-4ab2-adcb-8d1fc980e9c5-1 insurance frameworks as well as to the FTC business guidance site. b93849c7-3593-4cc2-940c-a574d17147f3-0 Next session is on the July 23rd. fb1afd9e-1231-4539-a662-b50e6cbd9560-0 We're going to go deeper into ransomware. 3f17d960-c4d8-4f18-afd3-48e4e14fb96e-0 We talked a lot about that today, not as an abstract threat, 3f17d960-c4d8-4f18-afd3-48e4e14fb96e-1 but as a specific and financial operational reality that small businesses 3f17d960-c4d8-4f18-afd3-48e4e14fb96e-2 face.
75d6051e-62df-467b-9575-7d406129a013-0 We'll look at what it cost, what the decisions to pay or not to pay 75d6051e-62df-467b-9575-7d406129a013-1 actually means, and why the coverage decisions you make 75d6051e-62df-467b-9575-7d406129a013-2 before an attack determines whether you'll survive one. c4855c01-8306-46c6-a3e1-fbf752831f52-0 It's free and it's online as well as this one. 288d4171-803b-4819-91d2-8a9ab15891cc-0 If you found today's session valuable, share with another small business owner 288d4171-803b-4819-91d2-8a9ab15891cc-1 who should be in the room quickly to help us to improve the series. 669e7daa-5e0b-4b49-bd80-325c4de8afcf-0 We are open for questions.
116f81b1-3ab2-4032-84ca-094b8cfddc0e-0 We want to ask you to take two minutes to fill out our survey. 5dd4203c-ba8c-4a37-ad90-9c3044660eb6-0 Our session survey, which you'll see the QR code in the next 5dd4203c-ba8c-4a37-ad90-9c3044660eb6-1 slide is anonymous. 46123d79-9cbb-46f3-85c2-f5ad18dbad19-0 It's only 5 questions and it'll help us to understand needs that we can 46123d79-9cbb-46f3-85c2-f5ad18dbad19-1 incorporate into further series.
d1a7891e-3ba7-4774-9c7e-d5092d7239a6-0 For the components of this series, here's the QR code that you can take a d1a7891e-3ba7-4774-9c7e-d5092d7239a6-1 quick picture of and I believe Score will send that out to all the attendees of d1a7891e-3ba7-4774-9c7e-d5092d7239a6-2 this session today. 71dd4358-ee32-45f8-b949-96815f471195-0 And with that, we can go in the Q& A if there are any questions about what 71dd4358-ee32-45f8-b949-96815f471195-1 we covered today or even the last session that we covered in March. c2e01604-9cbc-4c10-b612-6daae0e7bc12-0 Awesome. 19462e35-67a8-4ee9-be96-e965de6ebf69-0 Cyrus, I can help you out with that a little bit.
940f33c7-e1ea-4768-b077-2727cb90e06d-0 I see some questions here if I scroll back from Brenda out there. b8fe28f8-0be5-439f-8af2-411b175216e4-0 Do you recommend a particular endpoint scanner like a Falcon or a Centennial one, b8fe28f8-0be5-439f-8af2-411b175216e4-1 etcetera? 8cd039c8-a2c0-4c34-9d01-859e6b0dbd99-0 Stacey, can you repeat that question? e090a96f-49e7-4d5d-8dc3-5ed2034f2d40-0 Sure it is. 9fa9595d-c228-4127-b301-e1e1f50bfe3c-0 Do you recommend a particular endpoint scanner, a Falcon Centennial 1, 9fa9595d-c228-4127-b301-e1e1f50bfe3c-1 something like that? fb5ff1f5-0162-4129-87cd-603184359ed7-0 No, we are, we tend to be technology agnostic.
5098a86a-6ab8-4c69-80bb-c3728c977ab7-0 It really depends on your technology environment. 23ee3538-f6f3-4109-8ebf-d0d43e5e1d9b-0 Anything from Microsoft's MDR to I believe you're talking about crowd 23ee3538-f6f3-4109-8ebf-d0d43e5e1d9b-1 strikes. cf1286cc-da01-4840-a708-c352fefddbd1-0 Crowd strikes, Falcon, EDR Seven. 0472541c-d87d-4b0e-9e4e-c8b0ddcc0939-0 Well, those are all pretty good EDR solutions 0472541c-d87d-4b0e-9e4e-c8b0ddcc0939-1 and there are many more on the market. 233a605c-866d-4805-901c-51c8762ce8d6-0 So Juniper, Cisco, they all offer EDR applications.
0cf87775-c609-4f46-b14c-c4a1a2391a3b-0 It just depends on the complexity of your environment, 0cf87775-c609-4f46-b14c-c4a1a2391a3b-1 your ability to manage it because it's one thing to install it, 0cf87775-c609-4f46-b14c-c4a1a2391a3b-2 it's another thing to manage it. cba12b68-f857-49fc-a46a-e28c01ec029f-0 And then the cost, what do you, what is your budget allow for you if you cba12b68-f857-49fc-a46a-e28c01ec029f-1 for instance have Microsoft 365, you more than likely get MDR as a part of cba12b68-f857-49fc-a46a-e28c01ec029f-2 that.
0633995f-d4fc-4cd8-9742-a3685ca684a0-0 So if cost is an issue for you, you might want to consider using the 0633995f-d4fc-4cd8-9742-a3685ca684a0-1 Microsoft variant. d9ba76a6-0c8a-4acb-8a4e-a25caf97809f-0 Otherwise, any of those software solutions are just d9ba76a6-0c8a-4acb-8a4e-a25caf97809f-1 as good. 892b0964-8c4e-435c-bfec-21a74b0a07f2-0 Awesome, thank you. 46d59778-7869-4def-99ce-f368ffa97843-0 A lot of feedback in just an excellent presentation, 46d59778-7869-4def-99ce-f368ffa97843-1 so helpful and just a really important and somebody even said, 46d59778-7869-4def-99ce-f368ffa97843-2 I just didn't realize how important this topic was.
d0cb8c87-eb0e-44cf-b140-bde67dd3b95d-0 So thank you so much for sharing all of these great resources and information. 755f0acc-c0d4-4e3d-9a79-d602d367e449-0 We are at the top of our hour. b8e057fb-0fff-4ffe-963c-6006d5b58055-0 I can stay on for a couple minutes if Cyrus can and the you had a question in b8e057fb-0fff-4ffe-963c-6006d5b58055-1 the Q& A where can go over those and maybe take b8e057fb-0fff-4ffe-963c-6006d5b58055-2 5 minutes to do that.
9d0f020d-75a2-44b4-8f2f-aac9cf44035d-0 So otherwise if you're going to pop off, I did mention in the chat that you will 9d0f020d-75a2-44b4-8f2f-aac9cf44035d-1 be receiving all of these these resources with the in the e-mail that you 9d0f020d-75a2-44b4-8f2f-aac9cf44035d-2 registered today, registered with today, you'll receive a recording recorded 9d0f020d-75a2-44b4-8f2f-aac9cf44035d-3 version of this along with the deck presentation and of course that QR code 9d0f020d-75a2-44b4-8f2f-aac9cf44035d-4 to give your feedback directly to Cyrus and team.
b6a0c21b-3074-4d35-8984-4a4cbe4d0de9-0 So I'll just jump into a quick question from Bo and how is the cyber insurance b6a0c21b-3074-4d35-8984-4a4cbe4d0de9-1 policy covered for AI and a gentic agentic AI for small business websites b6a0c21b-3074-4d35-8984-4a4cbe4d0de9-2 and related online services? 417ebab3-f3ee-4572-a68c-4684c87ba4a3-0 So AI is so new insurance companies have not yet caught up to the nuances of 417ebab3-f3ee-4572-a68c-4684c87ba4a3-1 issues that occur or the risk that exists with AI.
cffd1040-c3c0-4450-8333-3311d837af21-0 What I would if you are concerned about risk, cffd1040-c3c0-4450-8333-3311d837af21-1 make sure that you document response activities in your incident response plan cffd1040-c3c0-4450-8333-3311d837af21-2 that shows that you've identified those risks and that you're putting in place to cffd1040-c3c0-4450-8333-3311d837af21-3 deal with any risks that might come up as a result of the use of AI.
b61d600c-7ad5-4b7d-8ab1-9212967d27a3-0 But right now, insurance companies have not caught up in b61d600c-7ad5-4b7d-8ab1-9212967d27a3-1 the language and of course, when they do catch up, b61d600c-7ad5-4b7d-8ab1-9212967d27a3-2 it's more than likely going to be than excluding this or that because of the b61d600c-7ad5-4b7d-8ab1-9212967d27a3-3 risk associated with AI. 3b82918c-010e-4ee8-acdc-d284ce5eab09-0 Thanks for sharing that and having such relevant information available. 3fd0ed47-7a14-49f0-bcd1-17a9ee2fa38c-0 There was definitely an AI interest out there and in our questions. 4b613c4f-c729-4ffe-b723-38206ecb3223-0 The next question comes from Angie.
e4b9d115-f326-4350-beb4-f2fbe99bed51-0 I am an e-commerce business. cda53ae8-05ca-4248-8696-c8423479373b-0 How do I make sure my site and hosting company has MFA in place along with the cda53ae8-05ca-4248-8696-c8423479373b-1 EDR plus IRP plus backup, Cyrus suggested for lower premiums, cda53ae8-05ca-4248-8696-c8423479373b-2 the question might be answered. d6a0c69e-77cb-47a2-88c8-d644054f831e-0 OK, got it. 8e8f6b6b-4c64-4cd9-9cb6-e0e61524d3f2-0 No, that's just like, was it answered? 0801e16a-4cae-4042-885b-34a3c89c4a2f-0 Was it not answered? 63433ec5-085a-41ee-a0ef-e849168c34be-0 I'm not sure.
3e8648fc-ce6c-4ee3-ba9c-2edaec07deaa-0 But essentially how do I make sure my site and company, 3e8648fc-ce6c-4ee3-ba9c-2edaec07deaa-1 my site and hosting company has the MFA in place. 15afb4bc-feb6-4194-8674-7348ce8dc0e3-0 So Angie, what you're talking about is vendor risk 15afb4bc-feb6-4194-8674-7348ce8dc0e3-1 management and we're going to talk a little bit about that in one of our other 15afb4bc-feb6-4194-8674-7348ce8dc0e3-2 series. a44f2bb2-839e-4912-acd2-21524571b99a-0 And basically what that is you preparing a list of these types of questions and a44f2bb2-839e-4912-acd2-21524571b99a-1 sending it to your vendor who provides your hosting solutions.
68cf5813-5f38-4338-9e60-d3930192d798-0 They should be able to effectively respond to the questions that you have in 68cf5813-5f38-4338-9e60-d3930192d798-1 that, that that risk questionnaire that 68cf5813-5f38-4338-9e60-d3930192d798-2 highlights things like do you have EDEDR or an IRP in place? b7241cba-f2e0-4800-a40b-f4138c4bd12f-0 What are your backups look like? fb08b53b-f3a1-4680-b362-a4e9c9c34d60-0 How are you protecting my business?
8a38873a-b37c-4a0d-a8a8-b3e1e91699cd-0 Most technology companies to understand vendor risk management and have prepared 8a38873a-b37c-4a0d-a8a8-b3e1e91699cd-1 for it, they might even have some of that 8a38873a-b37c-4a0d-a8a8-b3e1e91699cd-2 information on their websites and FAQ portion of their website or not.
bd8df6d5-68bd-4cdc-9732-15575717cd5c-0 But if they don't just simply call up the business Rep that you dealt with and bd8df6d5-68bd-4cdc-9732-15575717cd5c-1 setting up your site or call Technical Support to ask them these questions and bd8df6d5-68bd-4cdc-9732-15575717cd5c-2 they should be able to guide you to a place where they've already provided bd8df6d5-68bd-4cdc-9732-15575717cd5c-3 these answers.
5a4e3249-800d-4e3b-80b2-454296dee053-0 But if it's not explicitly put in your your solution, if you, for instance, 5a4e3249-800d-4e3b-80b2-454296dee053-1 haven't bought an EDR or backup solution, then you'll need to have that 5a4e3249-800d-4e3b-80b2-454296dee053-2 conversation with them in order to determine what they do in order to 5a4e3249-800d-4e3b-80b2-454296dee053-3 protect your business relationship with them. be997c57-4579-4f19-a91a-f4c69deae921-0 Thank you for that. 00069c8f-c0a3-4027-840c-00c90d0e968e-0 As you chat through this, I'm just looking at some questions and 00069c8f-c0a3-4027-840c-00c90d0e968e-1 some things.
afbb9f25-913b-4ae6-be61-dbacbe6d9f95-0 Try to navigate here with the one minute. 8c57641d-1c8b-42fb-991b-2f42524ed9f2-0 I'm going to stop us here if that's OK with everyone. 9513e471-b403-47e5-acf3-8c20c98e57e5-0 I do see one question in here that says which policy is for data recovery and 9513e471-b403-47e5-acf3-8c20c98e57e5-1 which policy is for monetary damages. 67396536-65b0-47b6-90f3-f60833004727-0 Is there one policy that includes coverage for both? 9535334b-1859-402c-9c8a-02c0f4cdd7e5-0 Yeah. 5fdae22a-ea46-4471-af6c-b19e62bc6a04-0 So as we talked about the cyber liability and the tech Eno, 5fdae22a-ea46-4471-af6c-b19e62bc6a04-1 it depends on what your business is.
caf54507-6759-47d9-90a1-440a5e8c19e2-0 The cyber liability piece would cover both data recovery and the and the what caf54507-6759-47d9-90a1-440a5e8c19e2-1 was this? c3b29f05-225c-45cd-8269-2479b4777b8a-0 What was the second part of that question? f7f3b3d4-dd69-4c13-b2c7-a002e7d17804-0 It was sorry, is there one policy that includes f7f3b3d4-dd69-4c13-b2c7-a002e7d17804-1 coverage for both? 3c6ddcdb-a79c-409a-b30e-b99e4c98dfa0-0 Yes. e2b14195-6920-4b52-a1dc-e0c6582eabb0-0 So your cyber liability would include coverage for both. 01f1e05d-bb82-4f25-8d76-5f78a792a9b1-0 But again, it depends on what your business is.
ce045117-f506-40b0-9954-20b51253c259-0 If you are a technology provider like we are, ce045117-f506-40b0-9954-20b51253c259-1 we have both cyber liability and techie and in place to cover us both in our ce045117-f506-40b0-9954-20b51253c259-2 service delivery and in our use, our own use of technology. bc89730b-f44b-43ce-9edd-2e968d1ae314-0 But the cyber liability policy should cover both of those. 49ccbb6c-989b-4a99-8c3a-341f725f2cd8-0 Perfect. ce7793d9-cef5-4a58-8c6b-b19c00cd6fc8-0 Thank you so much. 12ef2173-5b7f-456e-b073-ed2560a895fa-0 Cyrus. 0120c95d-8cad-4ec5-a9a0-d5a6b90ac524-0 I am just putting in my e-mail address in the chat.
22cb357a-141b-40a0-aaf0-1afd3fb0bbb0-0 I've noticed that some people were interested in the March session and 22cb357a-141b-40a0-aaf0-1afd3fb0bbb0-1 receiving that recording. 4d7fdf90-7e4a-4118-85e0-6ec3c8fb296b-0 So I can certainly forward that out if you shoot me an e-mail and I know I got 4d7fdf90-7e4a-4118-85e0-6ec3c8fb296b-1 an e-mail address from someone already. bba9cae7-995f-491e-8a2c-d384248cec11-0 So that's fantastic.
f67444b0-aed5-4c51-a233-be5147f0b79f-0 And I'm certain that a lot of the answers to your questions are available in the f67444b0-aed5-4c51-a233-be5147f0b79f-1 resources that Cyrus shared, particularly some of those end resources f67444b0-aed5-4c51-a233-be5147f0b79f-2 with those specific websites and obviously at Data Defenders. 74333556-3716-4b11-b1ea-5c9af26aee0d-0 So I am going to conclude this session today and we look forward. ef2f408b-5568-4ad1-af1a-eb097875682a-0 You see a question here and someone did go up to the resource page.
f5725fc5-5e3f-4d0e-9221-81311715cc88-0 The incident response plan template is in the white paper section of the resource f5725fc5-5e3f-4d0e-9221-81311715cc88-1 page, IRP and white papers. b25bed83-35b9-4a83-ab4e-b4355e9bded8-0 I'll just make a note of that in the chat here. 10e717d8-f7df-4deb-80f4-3a8517881788-0 So if somebody's on and they can see it. aa8aac30-72db-4d1b-b066-54892b738a07-0 Perfect. b413aa45-ac23-4cc0-a5c0-c686636daa00-0 Thanks for responding to that so quickly too. 9aeec6c2-97ef-49dd-be2f-8443a5669668-0 Yes, thank you, Cyrus. f2e2c4af-21af-4ce5-b2a5-6736a66f5956-0 Thank you everyone. a223c1d5-d7d8-4560-9707-ead23d2962e1-0 I appreciate the time.
e8183ffa-4698-4ca2-b531-57bf6a11188d-0 Please sign up for Cyrus's next sessions. 5b97e0cb-140a-44a8-96ae-c22abb37cd02-0 You will see the announcement both through Cyrus's channels and of course, 5b97e0cb-140a-44a8-96ae-c22abb37cd02-1 SCORE sends out all of those amazing webinars that we have available. d202a87a-937f-416e-81b1-057b795442fc-0 So, so sign up and if you shoot me an e-mail, d202a87a-937f-416e-81b1-057b795442fc-1 I'll get you the old ones. 6d955a9e-2e55-4546-97cc-3b6113f7bb1c-0 And I hope everyone enjoys the rest of their day. eaf6075b-32e1-4b56-bb9c-01fe21233678-0 Thank you so much for joining and this will conclude the session. 3b53dee5-02c0-4bcf-a2d7-cfcfa534932b-0 Thanks again.
edb1b813-4cbd-406f-87ae-5df8b14f8724-0 Thanks, Cyrus. 4483c581-9ed4-49ca-af5b-7ba4836788eb-0 You're welcome. 874952b2-0046-48bd-aa9a-a54f41ae45df-0 Bye.