Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cybersecurity Insurance Is Reshaping Enterprise Risk Strategy
Transcript
- Lucas: Cybersecurity insurance used to feel like a relatively straightforward transaction. You paid a premium, you got a policy, and if something went wrong, you filed a claim. That world is gone. Luna: Gone how? I mean, companies still buy cyber insurance — if anything, more of them do now than five years ago. Lucas: Absolutely, the market is bigger than ever. According to the Insurance Information Institute, direct written premiums for cyber insurance in the US hit about $14 billion in 2025. But the underwriting process has become brutal. Luna: Brutal in what sense? Are they just raising prices, or is something else changing? Lucas: Both. Premiums have gone up dramatically — we're seeing year-over-year increases of twenty to fifty percent for companies that have had a claim. But the bigger shift is that insurers are now dictating specific security controls. Want a policy? You have to have multi-factor authentication on every external-facing system. You need endpoint detection and response deployed across your environment. You have to have a documented incident response plan and test it at least once a year. Luna: So the insurer becomes a de facto security auditor. That's a huge change in the power dynamic between the carrier and the insured. Lucas: Exactly. And it's not just about checking boxes. Some carriers now use third-party security ratings from firms like BitSight or SecurityScorecard to assess risk before they even quote a policy. If your rating drops below a certain threshold, you might not get coverage at all, or the deductible jumps. Luna: I've heard stories about companies that got a quote, made some security improvements, and then the premium actually came down. That's a positive incentive — but is that common? Lucas: It's happening more, but it's still the exception rather than the rule. Most companies are just trying to meet the minimum bar. I talked to a CISO at a midsize logistics company — let me call them 'LogiCo' — and their premium tripled after a ransomware attack in 2024. They had to spend about $2 million on new security tools just to get back to a place where they could even get quotes from multiple carriers. Luna: So the insurance market is driving a lot of security spending. That's interesting for vendors, but it also raises the question: is this actually making companies more secure, or is it just creating a compliance treadmill? Lucas: That's the central debate. On one hand, having a third party — especially one with financial skin in the game — force basic hygiene like MFA and EDR is clearly a net positive. A lot of small and mid-size companies wouldn't have implemented those things otherwise. Luna: Right, but there's a risk that companies treat the insurance requirements as a ceiling, not a floor. They do exactly what the policy says and nothing more. And if the insurer's checklist doesn't cover something like supply chain risk or insider threats, that gap stays open. Lucas: That's the compliance treadmill problem you mentioned. And it gets worse when you consider that insurers themselves are still figuring out how to model cyber risk. Unlike property insurance, where you have centuries of actuarial data, cyber is relatively new and the threat landscape changes fast. Luna: Which means the underwriters are often conservative. They might overcorrect after a big ransomware wave, and then loosen up again when claims frequency drops. That creates a boom-bust cycle that makes it hard for companies to plan. Lucas: And yet, despite all that, the market keeps growing. More companies are buying coverage, and the average policy limit is increasing. I think the real story here is that cyber insurance is becoming a de facto regulatory force — even without a formal government mandate. If you want to do business with certain partners, you need to show proof of coverage and a certain security posture. Luna: Speaking of which — this is maybe a tangent, but I think it connects. The fact that this show exists, and that we get to dig into these topics every week, is only possible because listeners like you support it. If these conversations are useful for what you're building or running, honestly, if today was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. It's a small gesture that keeps this ad-free and independent. Lucas: Yeah, and we really appreciate it. It makes a difference. So back to the insurance dynamic — one of the newer developments I'm watching is the rise of cyber risk quantification tools. Companies like RiskLens and Kovrr are building models that help organizations estimate their probable maximum loss from a cyber event, which in turn helps them decide how much insurance to buy and where to invest in controls. Luna: That sounds like a more sophisticated approach than just 'get the cheapest policy that meets the minimum requirements.' Are insurers starting to accept those models as part of the underwriting process? Lucas: Some are. A few carriers will give you a discount if you provide a quantified risk assessment that shows you've done the analysis. But it's early. Most underwriters still rely on their own proprietary models and the external security ratings. The quantification tools are more used by the buyers right now — the CFO or risk manager who wants to understand the cost-benefit trade-off of spending $500,000 on a new detection system versus paying a higher premium. Luna: That's the kind of conversation that makes a CISO's job much more strategic. Instead of just being the person who says 'no' to new projects because of security concerns, they can say 'if we spend X on this control, it reduces our expected loss by Y, and that saves Z on insurance.' Lucas: Exactly. And that's where the industry is heading. The insurance market is forcing a level of rigor that many organizations never had. It's not perfect — there are definitely cases where companies get denied coverage unfairly, or where the requirements don't match the actual risk profile. But overall, I think the trend is positive. It's making security a boardroom issue in a way that it wasn't ten years ago. Luna: So what's the one concrete takeaway for a CISO listening today? What should they do differently? Lucas: I'd say: start treating your cyber insurance renewal as a strategic project, not an administrative task. Six months before your policy comes up, review the controls your carrier is likely to require. Run a tabletop exercise. Get a third-party security rating and see where you stand. Talk to a broker who specializes in cyber. The companies that do that are seeing better terms and lower premiums than those that wait until the last minute. Luna: And for the vendors listening — what's the opportunity here? Lucas: Huge. Any security tool that directly maps to an insurance requirement — MFA, EDR, identity and access management, vulnerability management — is going to see continued demand. But there's also a growing niche for tools that help companies prepare for the underwriting process itself: automated evidence collection, policy gap analysis, risk quantification. Those are the areas where I'd expect to see startups emerge over the next couple of years. Luna: It's interesting to think that a few years from now, the conversation might shift from 'do we have insurance?' to 'how do we optimize our insurance posture?' almost like a financial risk strategy. Lucas: I think that's exactly where it's going. The intersection of cybersecurity and insurance is becoming its own discipline. And for anyone in the field, it's worth paying close attention.