Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Insurance Premiums Are Priced After a Breach
Transcript
- Lucas: So, Luna, you renew your cyber insurance every year, you get a questionnaire, you fill it out, you pay the premium. But what actually happens when you make a claim? What does that renewal look like the year after a breach? Luna: That's the question I'd ask if I were a CISO. I know premiums go up, but how do they decide how much? Is it just a flat increase or is there actual data behind it? Lucas: It's surprisingly structured, actually. I've been looking into a case from a mid-sized logistics company—let's call them SwiftMove, not their real name. They had a ransomware attack back in the spring, and their renewal quote this year came back at double the previous premium. Doubling sounds steep, but the interesting part is how the insurer got there. Luna: So they didn't just pull a number out of a hat? There's a formula? Lucas: Right. The first thing the underwriter looks at is the loss history, but more importantly, they look at the root cause. Was it a one-off human error, or was there a systemic issue? In SwiftMove's case, the breach started with a phishing email that an employee clicked on. That alone might have been seen as a fluke. But when the underwriter dug into the claims report, they found the attacker had been inside the network for eleven days, moving laterally across systems. That's not a fluke, that's a detection failure. Luna: So the length of dwell time matters? That seems like a pretty clear signal of weak monitoring. Lucas: Exactly. And that's why the insurer wanted to know what they've done since. Did they implement multi-factor authentication everywhere? Did they bring in a managed detection and response provider? Did they run tabletop exercises? The answers to those questions feed directly into a risk score, and that score drives the renewal premium. Luna: But what if a company does all the right things after a breach? Does their premium still go up? Lucas: It can still go up, but the increase is usually more modest. In SwiftMove's case, they had actually invested in endpoint detection and response before the attack, but they hadn't configured it properly. The logs were being generated but not monitored. So the insurer saw that as a gap in implementation. They raised the premium but also required the company to hire a 24/7 security operations center provider as a condition of renewal. Luna: So the insurer basically forced them to improve their security posture as part of the policy. That's kind of interesting. Lucas: It's becoming more common. The cyber insurance market is hardening, and carriers are getting more prescriptive. They're not just pricing risk anymore, they're shaping it. And that's actually a bigger theme we could talk about all day. But before we get into that, let me just say something about how we keep this show going. Luna: Go ahead—if today's conversation is useful for what you're building or running, we love hearing that. And the way we keep it ad-free is through listener support. Lucas: Yeah, it's simple. If you've gotten value from a specific episode, maybe the breakdown of how a breach affects your insurance quote, you can support the show at buy me a coffee dot com slash fexingo. That's what keeps these episodes accessible to everyone. Luna: No pressure, just appreciate you being here. Now, back to that theme of insurers shaping security. I've heard that some carriers are actually offering premium discounts for companies that have certain controls in place. Lucas: They are. And it's not just the basics like multi-factor authentication anymore. We're seeing insurers ask about things like cyber deception, threat hunting, even zero-trust architecture. The more they can tie a premium to a measurable control, the better they can price the risk. And this is trickling down, because a company that can show a strong security posture can negotiate a lower premium, even after a breach. Luna: So it's not all doom and gloom for a company that's been hit. It's about telling a story of improvement. Lucas: Right. The underwriter isn't just looking at the incident, they're looking at the response. Did the company have a plan? Did they execute it well? Did they communicate quickly? In SwiftMove's case, they had a solid incident response plan, they had a retainer with a forensics firm, and they were able to get their systems back online in three days. That impressed the underwriter. It was the detection failure that hurt them, not the recovery. Luna: So the timeline of the response matters too. The longer it takes to get back online, the worse the premium increase? Lucas: Generally, yes. Because every day of downtime is more business interruption, more potential third-party liability, more reputational damage. Insurers are now just as interested in your business continuity plan as they are in your firewall logs. They want to know that if you get hit, you can keep operating. Luna: That makes sense. So, in practice, how does a company actually negotiate with an insurer after a breach? Is it just through the broker? Lucas: Brokers are key, but the smartest companies bring their CISO into the renewal meeting. If the CISO can walk through the root cause, the remediation steps, and the improvements since the incident, that goes a long way. Insurers appreciate transparency. One of the things that hurts companies is being vague or delayed in providing information. In cyber insurance, the quality of the data exchange matters as much as the size of the claim. Luna: So you're saying that post-breach, the insurance renewal conversation is almost like a second chance to prove your security maturity. Lucas: Exactly. And that's why I think cyber insurance is becoming less of a financial safety net and more of a strategic driver. We're seeing boards pay more attention to security because the cost of insurance is now a meaningful line item. If a company can't get affordable coverage, that's a red flag for investors and customers alike. Luna: Do you think we'll get to a point where cyber insurance is like car insurance, where your driving record—or in this case, your security record—directly determines your rate, and there's a shared database of incidents? Lucas: We're not there yet, but we're moving in that direction. Some carriers are pooling data on claims and near-misses, and there are startups building risk scoring platforms that insurers can use. The challenge is that every company's environment is different, so it's hard to create a standardized risk model. But the trend is definitely toward more data-driven underwriting. Luna: It feels like the insurance industry is almost forcing better cybersecurity through financial incentives. Is that a good thing? I mean, some critics say that cyber insurance can create moral hazard—companies might take more risks because they're covered. Lucas: That was a real concern a few years ago, but I think the hardening market has shifted that. Insurers are now so strict about controls that you can't just buy a policy and forget about it. You have to demonstrate that you're doing the right things. So instead of moral hazard, we're seeing what you might call 'security improvement through policy requirements.' Luna: And that's what happened with SwiftMove. They had to hire a 24/7 SOC. Did they see benefits beyond the insurance premium? Lucas: Actually, yes. They told me that having that SOC provider gave them much better visibility into their network, and they were able to detect a minor intrusion attempt just six weeks after the renewal. They stopped it before it turned into anything serious. So the insurance requirement ended up paying for itself in a very direct way. Luna: That's a great story to bring to any CFO who's complaining about the cybersecurity budget. Lucas: Exactly. And that's the kind of argument that resonates with boards. If you can say, 'This investment reduced our insurance premium by fifteen percent and helped us stop a potential attack,' that's a lot more compelling than just 'we need to buy this tool for compliance.' Luna: So what would you say is the one takeaway for a CISO who's about to go through a renewal after a breach? What should they focus on? Lucas: I'd say, don't wait for the renewal to start the conversation. Engage with your broker and your underwriter soon after the incident. Share your incident response report, your lessons learned, and your remediation plan. Show them that you're not just checking boxes but actually improving. And be prepared to negotiate. The first quote isn't always the final one, especially if you can demonstrate you're a better risk than the data suggests. Luna: It sounds like the insurance renewal is almost as stressful as the breach itself. Lucas: It can be, but it's also an opportunity. And I think that's a perspective shift worth having. Cyber insurance shouldn't be a passive purchase; it should be an active part of your security strategy. The more you understand how it works, the better you can use it to your advantage. Luna: That's a great note to end on. For anyone who wants to dig deeper, we'll have links to some of the resources we mentioned on the show page. Lucas: And if you have a story about your own insurance renewal after a breach, we'd love to hear it. You can reach us on social—we're @FexingoBusiness across platforms. Thanks for listening, and we'll catch you next time.