Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Your Cyber Insurance Premiums Are Spiking
Transcript
- Lucas: The numbers coming out of the reinsurance market this quarter are stark. We are seeing cyber insurance premiums for mid-market companies jump by over thirty percent compared to last year, and that is not even factoring in the deductibles which have doubled in some cases. Luna: That sounds like a shock to the system for any CFO trying to forecast next year's operating expenses. Lucas: It is a shock because most boards still treat cybersecurity as an IT problem rather than a financial one. When you look at the loss ratios for pure-play cyber insurers, they are sitting at roughly one hundred and ten percent, meaning they are paying out more in claims than they are collecting in premiums. Luna: So the carriers are essentially losing money on every policy they write right now. Lucas: Exactly. And when a carrier loses money, they do two things: they raise prices or they stop writing policies altogether. We are seeing both happening simultaneously. Some major underwriters have completely pulled out of the small business segment, leaving a massive gap in the market. Luna: What is driving those losses? Is it just bigger hacks? Lucas: It is bigger hacks plus a new variable: regulatory fines. In the second half of twenty twenty five, several high-profile data breaches triggered multi-million dollar penalties from state attorneys general and federal regulators. Those fines are now being counted as insurable losses in many jurisdictions, which has blown up the average claim size. Luna: I did not realize fines were becoming a standard part of the payout structure. Lucas: They are. And here is the thing that catches people off guard: the definition of 'covered event' is shrinking. Carriers are adding stricter requirements for what constitutes a valid breach. If you cannot prove you had multi-factor authentication enabled on all remote access points, they might deny the claim entirely. Luna: That feels like a trap. You buy insurance hoping it covers you, but the fine print excludes the basics. Lucas: It is a trap if you read it too late. The shift here is that insurers are no longer just assessing your risk; they are actively auditing your defenses before they will issue a quote. They want to see your incident response plan, your backup rotation schedules, and your employee training logs. Luna: So the insurance company is basically doing your CISO's job for you. Lucas: In a way, yes. They are forcing standardization. If you want affordable coverage, you have to look like everyone else in terms of security hygiene. But that standardization is expensive to implement, especially for smaller firms without dedicated security teams. Luna: This feels like it’s going to squeeze out the very companies that need protection the most. Lucas: Precisely. A regional hospital network or a mid-sized logistics firm might not have the budget for a full-time security operations center, but they hold enough sensitive data to be a target. Now they face either uninsurable premiums or no coverage at all. Luna: If I am running a business right now, what is the practical move? Do I just self-insure? Lucas: Self-insurance is risky unless you have deep pockets. The alternative is to treat security controls as a line item that directly impacts your bottom line. We are seeing companies negotiate with brokers to bundle cyber risk with general liability, using the stronger safety record to get a better rate on the whole package. Luna: That is an interesting lever. Most people think of these policies as separate silos. Lucas: They are usually separate, but the risk models are connected. A company with strong physical security and good employee vetting often scores lower on cyber risk assessments too. It is about showing the insurer that you are a holistic operator, not just a target. Luna: Are there specific metrics that seem to move the needle on price? Lucas: Backup immutability is huge. If you can prove your backups are air-gapped and immutable against ransomware encryption, you can knock fifteen to twenty percent off your premium. It is a concrete control that proves you can recover without paying a ransom. Luna: That makes sense. It reduces the insurer's potential payout. Lucas: Right. And another big one is endpoint detection and response tools. Insurers used to accept basic antivirus. Now they require EDR solutions that provide real-time visibility into device activity. Luna: So you have to spend money on tech to save money on insurance. Lucas: It is a circular economy of risk management. You invest in defense to lower your cost of capital, which then lets you invest more in defense. Luna: It feels like we are entering a phase where security is no longer optional, it is a prerequisite for doing business. Lucas: That is exactly where we are. Clients are starting to ask vendors for proof of cyber insurance coverage before signing contracts. If you cannot show you have coverage, you might lose deals. Luna: That changes the sales dynamic completely. Lucas: It does. Security becomes a competitive advantage. The vendor who can demonstrate robust coverage and low-risk posture wins the bid because the buyer feels safer. Luna: I love that angle. It turns a cost center into a revenue driver. Lucas: For now. But keep an eye on the supply chain aspect. We are seeing carriers start to demand visibility into your own vendors. If your biggest supplier gets breached, your claim might be denied if you didn't vet them properly. Luna: That pushes the responsibility back onto the buyer again. Lucas: It does. It means you are responsible for the security of your entire ecosystem. That is a heavy lift for most procurement teams. Luna: Is there any light at the end of the tunnel for pricing? Lucas: Not really in the short term. The global loss pool is still depleted from the pandemic-era spike. It takes years to rebuild capital reserves. We are likely looking at three to five years of elevated premiums before things stabilize. Luna: So businesses need to plan for a permanent increase in overhead. Lucas: They do. And that requires a shift in mindset. Security is not a project; it is a utility. Like electricity or payroll. You pay for it because you operate. Luna: Do you think we will see more companies form captive insurance pools? Lucas: Yes. Large enterprises are already forming captives to insure themselves. It is a way to bypass the volatile commercial market. As the commercial market tightens, captives will become more common even among mid-size players. Luna: That seems like a sophisticated play. Not everyone has the resources to set that up. Lucas: No, it requires significant legal and actuarial expertise. But for a consortium of similar businesses, it might be worth exploring. It gives them control over their own risk profile. Luna: Control is everything when the market is this unpredictable. Lucas: Absolutely. The key takeaway is to engage with your broker early. Do not wait until renewal season to look at your options. Understand what controls drive your price and build those into your annual budget. Luna: Practical advice. Start with the controls, let the price follow. Lucas: Exactly. Build the defense first, then ask for the discount. Luna: Before we go deeper into the technical side of those controls, if today was actually useful to you, the way these stay ad-free is listener support — buy me a coffee dot com slash fexingo. Lucas: Yeah, if these conversations help you navigate the financial side of technology, your support keeps us going. Thank you for listening. Luna: It really helps keep the lights on for the show. Lucas: Back to the topic. Let us talk about those backup immutability controls. Why is that specific feature so prized by insurers right now? Luna: Because it breaks the ransomware loop. If they cannot encrypt your backups, they have no leverage. Lucas: Right. Ransomware works by encrypting your live data and your backups. If you have immutable storage, the attacker hits a wall. They cannot touch your recovery point. Luna: So the insurer sees a zero probability of needing to pay out a full recovery cost. Lucas: Or at least a drastically reduced one. You might only pay for the initial breach response, not the months of downtime. That saves the carrier millions. Luna: It shifts the risk from catastrophic failure to manageable incident. Lucas: Exactly. And that is why it commands such a high discount. It is the single most effective technical control for reducing loss severity. Luna: Makes me wonder if we will see insurance products that are cheaper but require more hands-on management from the client. Lucas: We definitely will. We are moving toward a model where the insured is more active in their own defense. The insurer provides the framework, but you execute the checks. Luna: It puts the power back in the operator's hands, but also the burden. Lucas: Always both. There is no free lunch in risk management. Just different ways of paying for it. Luna: One last question on the regulatory side. How much are those fines actually impacting the premiums? Lucas: It is hard to quantify precisely, but it is a growing factor. In some sectors, like healthcare, the fines are so large they dominate the loss ratio. That drives up the base rate for everyone in that sector. Luna: Collateral damage from regulation. Lucas: Unavoidable collateral damage. Businesses need to budget for compliance costs separately from security costs, even though they overlap. Luna: Good distinction to make. Compliance protects the license to operate; security protects the assets. Lucas: Both are essential. But one of them is getting significantly more expensive. Luna: Which one should we watch closer in the coming quarters? Lucas: Watch the availability of coverage. Price is one thing, but if you cannot find a carrier willing to write the policy, price doesn't matter. Luna: Scary thought. Availability is the new scarcity. Lucas: Exactly. And that is the story of cyber risk right now. Luna: How do we prepare for a world where protection is harder to find? Lucas: By building resilience that does not depend on external insurers alone. Diversifying your risk transfer strategies. Luna: Resilience over reliance. Lucas: That is the goal.