Latest / NOXTalks / Cyber Insurance: Who Pays When the Chiller Gets Hacked?

Transcript

Cyber Insurance: Who Pays When the Chiller Gets Hacked? · NOXTalks

• 0:07
  SPEAKER_00: Welcome to Knox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
• 0:14
  SPEAKER_00: Today we're diving into a scenario that's uncomfortably real.
• 0:18
  SPEAKER_00: It's 3 p.m.
• 0:19
  SPEAKER_00: on a scorching Tuesday.
• 0:20
  SPEAKER_00: The chiller stops responding.
• 0:22
  SPEAKER_00: Elevators glitch.
• 0:24
  SPEAKER_00: Tenants are sweating, meeting rooms feel like freezers, and the access system is behaving oddly.
• 0:31
  SPEAKER_00: It looks like mechanical failure until it doesn't.
• 0:34
  SPEAKER_00: It's a cyber incident hitting your building automation.
• 0:37
  SPEAKER_00: And the question lands just as hard, who pays when the chiller gets hacked?
• 0:42
  SPEAKER_00: Here's the shift many teams miss.
• 0:45
  SPEAKER_00: A building automation system isn't just controls.
• 0:48
  SPEAKER_00: It's the operational layer that moves air, water, and people.
• 0:52
  SPEAKER_00: That makes it a tempting target.
• 0:54
  SPEAKER_00: Legacy devices, flat networks, and uneven upgrade cycles widen the attack surface.
• 1:00
  SPEAKER_00: Even with encrypted BAS communications, adoption across portfolios is patchy.
• 1:06
  SPEAKER_00: Severe industrial cyber events have been modeled to cause losses in the hundreds of billions.
• 1:11
  SPEAKER_00: That's not just downtime, that's balance sheet pain.
• 1:14
  SPEAKER_00: So, who actually pays?
• 1:16
  SPEAKER_00: It comes down to how your policies are written, today, not when you bought them.
• 1:21
  SPEAKER_00: Property or equipment breakdown.
• 1:23
  SPEAKER_00: If your policy clearly covers cyber-cause physical damage, you may be protected.
• 1:29
  SPEAKER_00: Burn drives, a fried chiller, and the business interruption that follows.
• 1:33
  SPEAKER_00: But many property forms remove silent cyber after ransomware waves.
• 1:38
  SPEAKER_00: Some carriers sell add-ons, others exclude it.
• 1:41
  SPEAKER_00: The exact wording decides whether you're fixing gear or writing a very large check.
• 1:47
  SPEAKER_00: Standalone cyber insurance.
• 1:49
  SPEAKER_00: Great for incident response, forensics, privacy duties, and business interruption.
• 1:55
  SPEAKER_00: Watch the trapdoors.
• 1:57
  SPEAKER_00: Many cyber policies exclude bodily injury and property damage unless you add endorsements.
• 2:02
  SPEAKER_00: Triggers matter.
• 2:03
  SPEAKER_00: If business interruption only kicks in for a security failure, you might be stuck when a system fails without a confirmed intrusion.
• 2:11
  SPEAKER_00: Waiting periods, often 8 to 12 hours, can make those first hours uninsurable unless you negotiate it differently, and confirm coverage for outages at your BAS cloud platform or integrator.
• 2:24
  SPEAKER_00: General liability, many forms carve out electronic data and cyber, creating limbo for third-party claims tied to physical effects from a cyber incident.
• 2:33
  SPEAKER_00: Not always excluded, but often enough to surprise people.
• 2:37
  SPEAKER_00: Technology errors and omissions.
• 2:40
  SPEAKER_00: This is what your integrator or managed service provider should carry.
• 2:44
  SPEAKER_00: If a misconfiguration or sloppy remote access played a role, this coverage is designed to respond.
• 2:50
  SPEAKER_00: Smart owners require it in contracts, set meaningful limits, often around 5 million, and name themselves as additional insureds.
• 2:59
  SPEAKER_00: Why is the market shifting?
• 3:01
  SPEAKER_00: Exclusions tied to nation-state activity are tightening.
• 3:05
  SPEAKER_00: Insurers fear systemic events that hit many customers at once.
• 3:10
  SPEAKER_00: And disclosure rules are pushing cyber into the boardroom.
• 3:13
  SPEAKER_00: Insurance can't be a later conversation.
• 3:16
  SPEAKER_00: How to look better to underwriters and actually cut risk.
• 3:20
  SPEAKER_00: Focus on five levers.
• 3:22
  SPEAKER_00: Real network segmentation between building systems and the rest of the enterprise.
• 3:27
  SPEAKER_00: Tightly manage remote access with multi-factor and no-shared accounts.
• 3:31
  SPEAKER_00: A live asset inventory with basic monitoring, tested offline backups, and an incident response plan that covers building systems and safe manual operation.
• 3:42
  SPEAKER_00: Contracts matter as much as firewalls.
• 3:44
  SPEAKER_00: Bake cyber and technology liability requirements into vendor agreements.
• 3:49
  SPEAKER_00: Call out minimum capabilities for secure configuration.
• 3:52
  SPEAKER_00: Document where you'll use encrypted BAS communications.
• 3:55
  SPEAKER_00: And define terms like cyber event, system failure, and service provider outage.
• 4:02
  SPEAKER_00: So claims don't stall over semantics.
• 4:04
  SPEAKER_00: When you sit with your broker at renewal, bring four fast questions.
• 4:09
  SPEAKER_00: Does property or equipment breakdown clearly cover cyber-cause physical damage and the resulting business interruption?
• 4:16
  SPEAKER_00: Yes or no?
• 4:17
  SPEAKER_00: Can business interruption on the cyber policy be triggered by system failure or human error, not just a confirmed attack?
• 4:25
  SPEAKER_00: Does coverage extend to outages at BAS cloud platforms, integrators, and manufacturer portals?
• 4:32
  SPEAKER_00: What are the waiting periods and sublimts and any carve-outs for widespread outages?
• 4:36
  SPEAKER_00: If you've got 90 days to level up, here's a quick plan.
• 4:40
  SPEAKER_00: Map the BAS ecosystem, controllers, gateways, remote paths, and cloud dependencies, and sketch your trust zones.
• 4:48
  SPEAKER_00: Lock down remote access with multi-factor and a jump host.
• 4:53
  SPEAKER_00: Retire shared credentials.
• 4:55
  SPEAKER_00: Segment traffic and prioritize encrypted BS communications where hardware supports it.
• 5:00
  SPEAKER_00: Prove you can restore, take and test an offline backup of configs and databases.
• 5:06
  SPEAKER_00: Turn on basic monitoring, update the incident plan with a building systems playbook, and align contracts with the coverage you expect from vendors.
• 5:14
  SPEAKER_00: Checklists help you avoid incidents.
• 5:16
  SPEAKER_00: Tuned risk transfer covers the bill when prevention fails.
• 5:20
  SPEAKER_00: When a building outage can snowball from comfort to safety to reputation in a single afternoon, the smart move is to line up both.
• 5:27
  SPEAKER_00: When the chiller gets hacked, your wording, your controls, and your contracts decide whether it's a bad day or a bad quarter.