Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Insurance Is Reshaping Security Spending
Transcript
- Lucas: If you work in cybersecurity, you've probably noticed a shift in the last couple of years: insurance companies are starting to ask really specific questions before they'll write a cyber policy. Luna: Yeah, it used to be a pretty straightforward form. Do you have a firewall? Check a box, get covered. Now it's much more granular. Lucas: Exactly. And that shift is actually changing how companies spend on security. So today I want to look at the cyber insurance market as a kind of forcing function — how it's pushing organizations toward better practices, sometimes faster than regulations do. Luna: I like that framing. Let's start with the numbers. What's the size of the cyber insurance market now? Lucas: Global premiums hit about $15 billion in 2025, up from roughly $10 billion in 2022. The growth is driven partly by more awareness, but also by insurers raising rates and requiring more proof of security controls. Luna: And what kind of controls are they looking for? I've heard multi-factor authentication is now basically table stakes. Lucas: It is. MFA, endpoint detection and response — that's e d r — and backup strategies that are offline or immutable. If you don't have those, you either can't get coverage or your premium is punitive. Luna: So it's like a compliance checklist, but from the private sector instead of the government. Lucas: That's a good way to put it. And because insurance is a contractual relationship, companies tend to take it seriously. A breach without coverage can be existential for a mid-sized firm. Luna: Right. There was that case in 2024 — a regional hospital chain got hit with ransomware, and their insurer denied the claim because they hadn't implemented MFA on all remote access. The hospital ended up paying $5 million out of pocket. Lucas: I remember that. It sent a signal across the industry that insurers are actually auditing now. They're not just taking your word for it. Luna: That leads to my next question: are we seeing companies create dedicated roles for managing cyber insurance? Like a cyber insurance officer or something? Lucas: Yes. Larger enterprises are starting to form internal teams that sit between the CISO and the risk management department. They handle the application process, the evidence gathering, and the relationship with the broker. Luna: So it's becoming a function, not just a once-a-year procurement exercise. Lucas: Exactly. And that's meaningful because it means cybersecurity spending is being influenced by insurance requirements in real time. If an insurer says 'we need you to deploy endpoint detection across all servers by next quarter,' that becomes a budget priority. Luna: Which is interesting because previously, spending was driven by fear of breach or compliance. Now it's driven by a contractual obligation with a clear financial penalty if you don't meet it. Lucas: Right. And the insurers themselves are getting smarter. They're using data from their own claims to model risk. For example, they know that companies with e d r have a 40 percent lower likelihood of a ransomware payout. So they adjust premiums accordingly. Luna: That's a powerful incentive. If your premium drops by 20 percent because you install a specific tool, the ROI calculation changes. Lucas: It does. And some vendors are even partnering with insurers to offer discounted policies if you use their products. That's a new dynamic — the security vendor becomes a channel for insurance. Luna: But there's a risk there too, right? If insurers start favoring certain vendors, it could create a monoculture. Lucas: That's a real concern. If everyone uses the same endpoint tool because the insurance says so, a vulnerability in that tool becomes systemic. Regulators are starting to look at this. Luna: Yeah, the European Insurance and Occupational Pensions Authority — EIOPA — has flagged that as a potential systemic risk. They're worried about concentration in the cyber insurance market. Lucas: So the market is still maturing. But for the average business, the message is clear: your security posture directly impacts your cost of insurance, and that link is only getting tighter. Luna: And if you're a startup or a small business, what's the practical advice? How do you even start the conversation with an insurer? Lucas: First, get a broker who specializes in cyber. They'll know which carriers are writing policies right now and what they're looking for. Then, before you apply, make sure you have MFA enabled, a backup strategy, and some form of endpoint detection — even a basic one. Luna: That's solid. And don't lie on the application. Insurers are doing more post-breach audits. Lucas: Absolutely. Misrepresentation can void a policy. It's better to be honest about gaps and work on a remediation plan. Luna: So we've talked about how insurance shapes spending. But what about the other direction — how does security spending affect the insurance market? Are insurers more willing to cover companies with strong security? Lucas: Yes, increasingly. Some carriers offer 'cyber maturity' discounts. If you can show you have a dedicated security team, regular penetration testing, and incident response drills, you may get better terms. Luna: That creates a virtuous cycle: better security leads to lower premiums, which frees up budget for more security. Lucas: Exactly. And we're starting to see insurers offer value-added services, like free post-breach legal advice or access to a panel of incident responders. It's becoming a more holistic relationship. Luna: It's a far cry from ten years ago when cyber insurance was just a paper product. Lucas: Yeah, it's evolved fast. And I think it's going to keep evolving, especially as more data becomes available about what actually works. Luna: Before we wrap, I want to ask about the future. Do you think cyber insurance will eventually become mandatory, like auto insurance? Lucas: It's possible for certain sectors — critical infrastructure, healthcare, maybe finance. Some countries are already discussing it. But for most businesses, I think the market will continue to nudge rather than force. Luna: And if you're a listener who's not yet in the market, when should you start thinking about cyber insurance? Lucas: As soon as you have any digital revenue or handle customer data. Even a small breach can be devastating. Get a quote, even if you don't buy right away — it'll give you a sense of what insurers expect. Luna: Good advice. Lucas, thanks for breaking this down. Lucas: Thanks, Luna. And if today's episode was useful to you and you want to keep it ad-free, buy me a coffee dot com slash fexingo helps. Luna: Yeah, it really does. A few listeners chipping in makes a big difference for us. Lucas: So on that note — let's keep the conversation going. Next time, we'll look at how security teams are using AI to automate incident response. That's a whole different ballgame. Luna: I'm already curious. See you next time.