Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / CISO Liability Insurance Is Changing Cybersecurity Priorities
Transcript
- Lucas: If these conversations are useful for what you're building or running, there's a simple way to keep them going — and it has nothing to do with ads. We deliberately don't run ads on these shows. If you want to support that choice, the link is buy me a coffee dot com slash fexingo. That's it. Low key, no pressure, just a way to keep the signal clean. Luna: Yeah, and I think that matters especially today because we're about to talk about accountability — and the first question is, who's actually on the hook when a breach happens? Lucas: Exactly. So let's talk about something that's quietly reshaping the way CISOs and their boards think about security: directors and officers liability insurance — D&O insurance. Specifically, how insurers are now demanding proof of cybersecurity oversight before they'll write a policy. Luna: And this is personal liability we're talking about, right? Directors and officers can lose their personal assets if a shareholder lawsuit succeeds. Lucas: Right. And the trigger case I keep coming back to is the 2024 shareholder derivative lawsuit against a publicly traded healthcare company — I won't name it because it's still in litigation — after a ransomware attack that took down their patient scheduling systems for almost two weeks. The suit alleged that the board failed to oversee cybersecurity despite repeated warnings from internal audit. Luna: And that's not a hypothetical anymore. It's actually happening. So how are insurers responding? Lucas: They're rewriting underwriting questionnaires. A 2025 survey by the Professional Liability Underwriting Society — PLUS — found that 63 percent of D&O underwriters now require a formal CISO attestation on security controls before they'll bind coverage. They want to see documented evidence that the board has a risk committee, that the CISO reports directly to the board at least quarterly, and that there's a cyber maturity assessment on file. Luna: So the CISO is essentially signing a legal document saying 'yes, we are doing what we say we are doing.' Lucas: Exactly. And the specific metrics insurers are asking for are becoming standardised. Mean time to detect — MTTD — under 48 hours. Penetration testing at least every six months. An incident response plan that has been tabletop-tested within the last twelve months. If you can't show those, your D&O premium can double — or they just decline the application. Luna: But let me push back a little. Isn't there a risk that this becomes just another compliance exercise? The board checks the box, the insurer checks the box, but the actual security posture doesn't improve? Lucas: That's a fair critique. And there's some evidence that checkbox compliance is happening. But I think the difference here is that the consequences are personal. If a CISO signs an attestation and then a breach reveals that penetration testing was actually just a vulnerability scan, that CISO could face personal liability for misrepresentation. That's a much stronger incentive than a corporate fine. Luna: So the threat of personal financial loss changes the calculus in a way that corporate penalties don't always achieve. Lucas: Exactly. And we're starting to see this in budget conversations. A 2026 survey by Gartner — actually, sorry, a March 2026 survey by the cybersecurity consultancy Bishop Fox — found that 41 percent of Fortune 500 CISOs said their board explicitly cited D&O insurance requirements when approving additional cybersecurity funding in the last twelve months. The average increase was about 14 percent over the prior year. Luna: Fourteen percent is significant. Especially at scale — we're talking tens of millions of dollars for some of these companies. Lucas: Right. And I think the trend is not going to reverse. The PLUS survey also showed that 71 percent of underwriters expect to add more specific cybersecurity requirements within the next two years. They're looking at things like requiring a third-party audit of the security program, mandating specific frameworks like NIST CSF or ISO 27001, and even asking for proof that the company has cyber insurance in place as a separate policy. Luna: So D&O insurance is becoming a kind of super-requirement that forces companies to have all the other security foundations in place. Lucas: That's exactly how I see it. And here's a concrete example of how that plays out. One of the big four accounting firms — I'm thinking of Deloitte's 2025 cyber risk report — noted that they're now seeing D&O insurers ask for the specific dollar amount of cyber insurance coverage as part of the application. Why? Because if the cyber insurance limits are too low, the D&O insurer is worried they'll get pulled into a claim that the cyber policy should have covered. Luna: So there's a layering effect. The D&O insurer wants to make sure the cyber insurance policy is adequate so that the D&O policy doesn't become the default backstop for a cyber incident. Lucas: Exactly. And that creates a virtuous cycle: the cyber insurance underwriter already requires certain controls, and now the D&O underwriter is layering on its own requirements. The cumulative effect is that companies are being pushed toward a more rigorous security posture from multiple angles. Luna: But let's talk about the human side. A CISO signing an attestation — what happens if that CISO discovers a gap after signing? Do they have to immediately disclose it to the insurer? Lucas: That's a live question, and it varies by policy. Some D&O policies have a 'known circumstances' clause that requires the insured to disclose any fact or circumstance that could give rise to a claim. If a CISO discovers a material weakness in the security controls after the attestation, they should probably notify the broker immediately. But the legal interpretation is still evolving. I've seen law firm memos advising CISOs to document every finding and every remediation step precisely because of this exposure. Luna: So the CISO's personal risk has gone up significantly in the last few years. Lucas: Significantly. And that's actually pushing some CISOs to demand personal indemnification and separate D&O coverage paid for by the company. There's a survey from the cybersecurity recruitment firm Heidrick & Struggles — their 2026 CISO tenure report — that found that 58 percent of CISOs at Fortune 500 companies now have a personal D&O policy as part of their compensation package. That was only 22 percent in 2022. Luna: So the market is adapting. Companies are essentially buying insurance for the person who signs the attestation. Lucas: Right. And I think that's a rational response. If you want a CISO who is willing to put their name on a legal document attesting to the security posture, you need to protect them from personal ruin if something goes wrong despite their best efforts. The key phrase there is 'despite their best efforts' — the attestation isn't a guarantee of perfection, it's a representation that the controls are in place and functioning as designed. Luna: And the courts will ultimately decide what 'functioning as designed' means. But for now, the trend is clear: D&O insurance is becoming a major driver of cybersecurity investment. Lucas: I think we'll look back at 2024 as the year the D&O market really turned. Before that, cyber was mostly a sub-topic in the broader D&O questionnaire. Now it's the first section. And I expect that within the next two years, most publicly traded companies will have a dedicated cyber risk committee at the board level, purely because the insurance market demands it. Luna: And that's not a bad outcome. We've spent so many episodes talking about how security teams struggle to get board attention. This might be the mechanism that finally locks it in. Lucas: Exactly. It ties security directly to the personal financial interest of the people in the room. That's a powerful motivator. Luna: So for our listeners who are CISOs or security leaders — what's one actionable step from this episode? Lucas: I'd say: request a copy of your company's D&O insurance application and read the cybersecurity section. See exactly what your company is representing to the insurer. If the answers are vague or outdated, that's a risk — not just for the company, but for you personally. Then work with the legal team to align the security program's actual metrics with what the application claims. Close that gap before the next renewal. Luna: That's concrete. And it starts a conversation that most security teams haven't had yet. Lucas: Right. And if you're a board member listening — ask your CISO if they've seen the D&O application. That question alone will surface a lot of useful information. Luna: I think that's a good place to leave it. Thanks, Lucas. Lucas: Thanks, Luna.