Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Cyber Insurance Exclusions Are Rewriting Security Budgets
Transcript
- Lucas: So there's this quiet but massive shift happening in enterprise security budgets, and it's not coming from a breach or a new vulnerability. It's coming from the insurance side. Luna: You mean the exclusions for state-backed attacks? I've seen headlines, but it feels like it's still under the radar. Lucas: Exactly. A major European insurer just proposed excluding coverage for attacks linked to nation-states, and that's a line in the sand. But the real story is how that single clause is now changing what companies are willing to spend on specific security controls. Luna: Before we dive in, quick honest thing — a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making all these episodes. We keep it ad-free because of that. Lucas: Yeah, it's a small group, but it makes a real difference. Anyway, back to the insurance angle — the reason this is so sticky is that most boards still think of cyber insurance as the ultimate safety net. Luna: And when the net starts having holes, the whole risk conversation flips. Lucas: Right. Let's anchor on a specific number. Lloyd's of London, which basically wrote the rulebook for cyber insurance, has been pushing for state-backed attack exclusions since 2023. By 2026, we're seeing actual policies with that clause going live. Luna: So if a company gets hit by something like a SolarWinds-style attack, and it's attributed to a state, the insurer just walks away? Lucas: That's the fear, and it's not hypothetical. The challenge is attribution — it can take months, and sometimes the public attribution is murky. So insurers are building in timeframes and arbitration clauses. But the practical effect is that companies can't assume they're covered for the biggest tail risks. Luna: That sounds like it would force a rethink of what 'transferable' risk really means. Lucas: Exactly. And that's where the security budget angle comes in. CISOs I talk to are now mapping their spending to insurer requirements, not just to best practices. If the policy says you need mature identity and access management, that's suddenly a budget line item. Luna: So insurers are effectively becoming shadow regulators for enterprise security. Lucas: They've been moving that way for a while, but the exclusions make it explicit. Let me give you a concrete example. Take multifactor authentication — insurers have been requiring it for years. But now they're starting to require phishing-resistant MFA, like hardware keys, because sms based MFA is too easy to bypass. Luna: And hardware keys cost money — not just the device itself, but the rollout, the training, the helpdesk support. Lucas: Right. And that's a small example. The bigger ticket items are things like zero-trust architecture, endpoint detection and response on every machine, and segmented networks. Those are all getting baked into policy requirements. Luna: So if you want to keep your premiums reasonable, you have to spend on those controls anyway. It's like the insurer is setting your security roadmap. Lucas: And that's actually not all bad. The problem is when the exclusions carve out the exact attacks you're supposed to be preparing for. State-sponsored actors are the ones with the most resources and the most sophisticated techniques. Luna: So the coverage is there for the smaller stuff, but the catastrophic tail is increasingly on the company. Lucas: Exactly. And that's driving a whole new conversation about cyber reinsurance. Reinsurers are the ones who back the primary insurers. If they're also pulling back from state-sponsored risk, the whole chain tightens. Luna: I've seen some reports that reinsurance rates for cyber are still climbing. Is that still the case in 2026? Lucas: From what I'm hearing, yes — especially for companies with significant exposure to critical infrastructure or those in sectors like manufacturing where OT systems are involved. The pricing reflects both the frequency of attacks and the uncertainty around attribution. Luna: So what's a CISO supposed to do? Just accept the gap and self-insure? Lucas: Some are, but the smarter ones are using the insurance requirements as leverage. They go to the board and say, 'Look, our policy now requires X, Y, and Z. If we don't invest in those, we either pay massive premiums or we're uninsured for the big stuff.' Luna: That's a different way of framing security investment. It's not just risk reduction — it's meeting a contractual obligation. Lucas: And that's a language boards understand. You're not asking for money to avoid a hypothetical attack. You're asking for money to remain insurable. That's a very concrete business risk. Luna: Do you have a real-world example of a company that's done this well? Lucas: There's a mid-sized European logistics firm I've been following. They didn't have the budget for a full zero-trust rollout, but their insurer said they needed at least micro-segmentation for their OT network. So they did that first, and it actually brought their premium down about fifteen percent. Luna: Fifteen percent is meaningful. But that's still a lot of money — and it's money they might not have spent otherwise. Lucas: Right. And that's the quiet reshaping. The policy is becoming a strategic document, not just a financial one. CISOs are starting to treat their insurance policy like a security architecture review. Luna: So the next time we hear about a massive breach, the first question might not be about the vulnerability — it might be about whether the company was even covered. Lucas: Exactly. And that's why I think we're going to see more board-level conversations about cyber risk transfer as a core business function. The era of 'just buy insurance' is over. Luna: It's like the insurance industry finally caught up to the reality that cyber is a systemic risk, not a random event. Lucas: And that's the thing — systemic risk is exactly why reinsurers are so nervous. A single event like a cloud provider outage could trigger claims across hundreds of companies, and that's the kind of loss that makes them rethink the whole model. Luna: So we might see more exclusions for cloud-related incidents too, not just state-backed ones. Lucas: That's a real possibility. Some policies already have sub-limits for cloud provider failures. The next wave might be full exclusions unless you have specific multi-cloud redundancy in place. Luna: That's going to be a huge conversation for security architects. Lucas: It already is. I've had architects tell me they're designing systems not just for resilience, but for compliance with what they think the insurer might require next. It's a bit of a guessing game, but the ones who guess right are going to be in a much better position. Luna: So what's your takeaway for a CISO or a security leader listening right now? Lucas: Read your policy like it's a security requirements doc. Every exclusion, every sub-limit, every condition — that's a signal about where the industry thinks the risk is. And then look at whether your security program is actually aligned with that. Luna: And if it's not, you're either paying more than you should or you're carrying risk you think you've transferred. Lucas: Exactly. And that's a conversation that should happen at the board level, not just in the security team. Because ultimately, this is about whether the company's risk tolerance matches its actual exposure.