Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Using Cyber Insurance Policy Reviews to Reduce Premiums
Transcript
- Lucas: One of the quieter but more consequential shifts I've been tracking over the last eighteen months is how enterprise security teams are treating their cyber insurance policy as something you actively manage — not just a document you renew once a year and forget about. Luna: Right — I've seen that too. Some CISOs are now scheduling policy reviews the same way they schedule penetration tests. It's becoming a recurring process. Lucas: Exactly. And the driving force is pretty straightforward: premiums have been climbing fast — double-digit increases for most mid-size and large companies since 2022. But what's interesting is that the teams doing a thorough policy review are often able to push back. I talked to a CISO at a fintech company last month — about 800 employees, maybe $60 million in revenue — and they managed to cut their premium by 18 percent. That's roughly a hundred and twenty thousand dollars saved. Luna: How? What did the review actually involve? Lucas: So they started by pulling out the insurer's questionnaire — the one you fill out during underwriting — and mapping it against every security control they actually had in place. What you find is that underwriters ask very specific yes or no questions. 'Do you have multi-factor authentication on all remote access?' 'Do you have endpoint detection and response on all servers?' 'Do you have a dedicated incident response retainer?' The team realized they had MFA on their VPN but not on their internal admin portals. That was a mismatch. They fixed it before the renewal. Luna: And that one change — adding MFA to internal admin portals — moved them into a lower risk tier? Lucas: It was one of several adjustments, but yes. They also discovered they had a gap in their EDR coverage — they hadn't deployed it on a specific class of legacy servers that were still running a critical application. The underwriter's questionnaire specifically asked about coverage for 'all production systems,' and they had to answer no because of those servers. So they prioritized rolling out EDR to those servers, even though it was technically challenging. That alone changed the underwriter's risk score by about 12 percent. Luna: That's the part that surprises me — that something as granular as a single server class can affect pricing that much. But I guess insurers are looking at root causes of claims data. Lucas: Exactly. They're increasingly sophisticated about what correlates with actual losses. Ransomware claims have been the biggest driver of premium increases, and insurers know that companies without complete EDR coverage are far more likely to have a breach spread undetected. So they price that risk in. The policy review is essentially a way to correct your risk profile before the insurer corrects your premium. Luna: Let's talk about the actual process. What does a typical policy review look like — who runs it, how often, what's the deliverable? Lucas: There are a few models. Some companies have an internal risk or compliance team do it. Others hire a specialized cyber insurance broker who also offers policy review as a service — they'll audit the policy language, not just the questionnaire. And there's a newer category of third-party firms that audit policy language specifically — they look at exclusions, sub-limits, conditions around 'silent cyber' — that's cyber exposure hidden in property or liability policies that don't explicitly exclude it. Luna: Silent cyber has been a huge issue. There are cases where a company thought they had coverage for a ransomware attack under their general liability policy, but when they filed a claim, the insurer argued it was excluded because the attack was 'directly caused by a computer virus' — which wasn't explicitly covered. Lucas: That's exactly the kind of thing a policy review catches. I was reading about a mid-size retailer in the Midwest that had a business email compromise loss — about $400,000. Their policy had a sub-limit for BEC of only $100,000, and a very narrow definition of what constituted a 'computer fraud' event. If they'd reviewed the policy language before the incident, they could have negotiated a higher sub-limit or clarified the definition. Instead, they recovered only a quarter of the loss. Luna: Ouch. And that's the kind of story that's driving more companies to do these reviews proactively. Because once you have a claim, it's too late to fix the policy language. Lucas: Right. So the standard cadence I'm seeing from CISOs who do this well is: a full policy review sixty to ninety days before renewal, then a quarterly check-in on any changes to the security environment — a new cloud workload, a new acquisition, a new vendor with privileged access — that could affect risk. And they document everything. That documentation becomes evidence for the underwriter that you're actively managing risk, not just ticking boxes. Luna: And if these conversations are useful for what you're building or running — this is a business and technology show where operators meet builders — a couple of dollars a month is genuinely what keeps these going. Lucas: Yeah, it's really simple. If you've gotten something out of this episode or any of the past ones, buy me a coffee dot com slash fexingo is where listener support makes a tangible difference. No pressure at all — just know that it helps us keep the show ad-free and focused on the specific, practical stuff. Luna: Exactly. So back to the policy review — one thing I want to dig into is how you actually negotiate with the insurer. Is it just a matter of showing them your controls and asking for a lower price? Or is there more to it? Lucas: It's more strategic than that. The best approach is to go in with data from the review — a clear gap analysis and a remediation plan. You tell the underwriter: 'Here's where we were last year. Here's what we've fixed. Here's what we're fixing in the next quarter. And here's how our risk profile has improved.' Insurers appreciate that because it reduces their uncertainty. Some will even offer a multi-year lock on pricing if you commit to a control roadmap. Luna: So it becomes a partnership rather than a transaction. I've heard of companies that invite their insurer's underwriter to tour their SOC once a year — let them see the security operations centre, meet the team. Lucas: That's happening more than people realize. One CISO at a healthcare company told me they invite their underwriter to their annual tabletop exercise — the one where they simulate a ransomware attack. The underwriter gets to see how the team actually responds, not just read about it in a questionnaire. That relationship alone led to a 10 percent premium reduction because the underwriter had direct confidence in their incident response capability. Luna: I want to talk about one more angle — what happens when the policy review reveals that a control you thought you had is actually not in place. That must be awkward for the CISO internally. Lucas: It happens more often than you'd think. A classic example: an organization believes they have multi-factor authentication on all email systems, but the policy review shows that the insurer's definition of 'email systems' includes a specific legacy on-premises exchange server that was never configured for MFA. The CISO then has to go to the IT operations team and say, 'We need to fix this — not just for security, but because our insurance coverage for a business email compromise scenario could be at risk.' That's a powerful argument internally. Luna: It reframes the conversation from 'security best practice' to 'contractual obligation.' That tends to get budget approval faster. Lucas: Exactly. And it's not just about avoiding a denied claim — it's about maximizing coverage. Some policies have 'duty to defend' clauses, where the insurer pays for legal defense even if coverage is later disputed. But those clauses often have conditions. A policy review can clarify those conditions so you know exactly what you're buying. Luna: Let's pull back a bit — broader picture. Is this trend likely to continue? Or will cyber insurance premiums eventually stabilize? Lucas: I think the review process is here to stay, regardless of premium trends. Because even in a stable market, coverage gaps can be financially devastating. And insurers are constantly updating their underwriting models — they're incorporating real-time data from threat intelligence feeds, they're looking at the company's external attack surface through scanners. So the bar keeps moving. A policy review isn't a one-time fix; it's an ongoing discipline. Luna: So for a CISO listening, what's the one concrete step you'd recommend taking this week? Lucas: Pull out your current cyber insurance policy — the actual policy document, not just the summary — and read the exclusions section. Then compare it against any security incident you've had in the past two years. Would that incident have been covered under the current policy language? If you're not sure, that's exactly the kind of gap a formal policy review would address. And if you find something concerning, you have time before your next renewal to fix it. Luna: That's good advice. I think a lot of teams assume their policy covers 'cyber incidents' broadly, but the reality is much more granular. The exclusions and sub-limits are where the risk lies. Lucas: Yeah. And the companies that treat their insurance policy as a living document — reviewed, challenged, and aligned with their actual security posture — are going to be far better prepared when the next inevitable incident happens.