Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Insurance Premiums Are Reshaping Enterprise Security
Transcript
- Lucas: So if you're a CISO right now, there's a good chance your biggest budget pressure isn't coming from the board or the threat landscape directly. It's coming from your insurance broker. Luna: That's a strong claim. But honestly, I've heard similar from several security leaders lately. Premiums have been wild. Lucas: Wild is an understatement. Between 2022 and 2023, we saw average premium increases of fifty to one hundred percent year over year for many mid-sized firms. And the carriers didn't just raise prices, they fundamentally rewrote the application process. Luna: What changed on the application side? I remember it used to be a pretty basic questionnaire. Lucas: Yeah, it was almost perfunctory. Now you're seeing detailed technical controls become mandatory. Things like multi-factor authentication on all remote access, endpoint detection and response on every endpoint, and dedicated backup environments that are physically or logically segmented from the production network. If you don't have those, you might not get quoted at all. Luna: And if you do get quoted, the premium reflects the gap. I've seen cases where a company that had a near-miss ransomware event saw their premium double the next year. Lucas: Let's put a specific number on that. I spoke with a manufacturing company, about two thousand employees, revenue around four hundred million. They had a ransomware scare, the attacker got in but their incident response team contained it before encryption. No payout, no data exfiltration. But their insurance renewal went from one hundred fifty thousand to three hundred fifty thousand dollars. Luna: That's a two hundred thousand dollar increase for a near miss. Lucas: Exactly. And their broker told them, if you want to get back down to something reasonable, you need to invest in about two million dollars' worth of security upgrades over the next eighteen months. So effectively, the insurer became a de facto security regulator for that company. Luna: That framing is interesting. Insurance as a compliance driver rather than just a risk transfer mechanism. Lucas: Right. And it's not just premium pressure. Some carriers are now requiring annual penetration tests from approved vendors, and they want to see the results. If you fail a critical finding, they can rescind coverage or add exclusions for certain attack types. Luna: What about the data sharing between insurers and security vendors? I've heard that some EDR companies are feeding telemetry into underwriting models. Lucas: That's happening. There are a few partnerships now where if you deploy a specific security platform, the insurer gets anonymized data on your patch cadence, your alert response times, even your phishing click rates. The idea is to price risk more accurately. But it also raises privacy and competitive concerns. Luna: I can imagine. If your insurer knows your mean time to respond is slower than industry average, that's going to show up in the premium. Lucas: And it might even influence whether you get coverage. This is moving toward a model that looks a lot like workers' compensation insurance, where your experience modification factor directly reflects your past claims history and safety practices. For cyber, that means your past breach or near-miss becomes a quantifiable drag on your balance sheet. Luna: Is that a good thing? It forces discipline, but it also penalizes companies that might have been unlucky versus negligent. Lucas: That's the tension. The insurance industry argues that most cyber incidents are preventable with basic controls, so the premium signal is fair. But there's also a concern that smaller companies will get priced out of the market entirely, or have to accept very narrow policies with high deductibles. Luna: There's a statutory minimum for auto insurance in most states. Do you think we'll ever see mandated cyber insurance for certain industries? Lucas: It's already happening in healthcare. Some hospital systems are required by their state to carry cyber coverage as a condition of licensing. And the SEC's new incident disclosure rules are pushing public companies to at least demonstrate they've assessed the risk. But a broad mandate feels unlikely in the near term. Luna: Let's talk about the market structure. Who are the big players now, and how has the landscape consolidated? Lucas: The biggest pure-play cyber insurers are companies like Beazley, Chubb, and AXA XL. But we've also seen traditional property and casualty insurers enter the space, sometimes through acquisitions. For example, Fairfax Financial bought a significant stake in a cyber managing general agent. The market has hardened considerably after the 2021 ransomware surge. Luna: And what about the reinsurance side? I know that's been a big factor in premium increases. Lucas: Huge factor. Reinsurers, the companies that insure the primary insurers, took massive losses on ransomware claims in 2020 and 2021. They essentially said, we're not going to cover cyber at the same rates anymore. So primary carriers had to either raise premiums or find new reinsurance capacity. That squeeze is what we're still feeling. Luna: So the premium increases are partly a reflection of the insurers' own cost of capital. Lucas: Exactly. And it creates an interesting dynamic where the security improvements that insurers demand, like EDR and MFA, also reduce claims. So in theory, as the market matures, premiums should stabilize. We're starting to see that. Some brokers are reporting that rate increases slowed to the single digits in 2025. Luna: But that assumes the threat landscape doesn't get worse. If we see a new strain of ransomware that bypasses current controls, we could be back to square one. Lucas: That's the risk. And it's why the underwriting process is becoming more dynamic. Some carriers are now doing continuous monitoring of their policyholders' security posture. If your patch compliance drops below a threshold, you get a notice that your coverage may be adjusted. Luna: That's a powerful incentive. It turns insurance from a once-a-year negotiation into a real-time governance tool. Lucas: And it's something I think more security teams should leverage internally. If you can show the board that a specific security control will save two hundred thousand dollars in insurance premiums, that's a much easier conversation than talking about risk in abstract terms. Luna: Speaking of conversations that are easier with concrete numbers, I want to mention something about this show. We keep these episodes ad-free because we think the topic deserves focused discussion without interruption. Lucas: That's true. And we've heard from listeners that they appreciate the no-ads approach. If you find these episodes useful for what you're building or running, you can support the show at buy me a coffee dot com slash fexingo. Luna: It's a small way to keep the podcast sustainable. And we're grateful to everyone who's chipped in so far. Lucas: Alright, back to the insurance angle. One more thing I think is worth highlighting: the emergence of cyber insurance as a driver for sector-wide security standards. Luna: Like what? Are we seeing industry-specific requirements? Lucas: Yeah, in financial services, some insurers are now requiring alignment with the NIST Cybersecurity Framework or the CIS Controls as a precondition for coverage. That's effectively turning those voluntary frameworks into de facto mandates. Luna: So if you're a small bank or credit union, you might not have the resources to implement all those controls, but your insurer is requiring it. Lucas: Right. And that's creating pressure on the vendor community to offer simpler, more affordable security tools that meet the insurance requirements. It's a market-driven compliance ecosystem. Luna: I think we're going to see more convergence between cyber insurance and broader risk management. Maybe even a single risk score that combines financial, operational, and cyber factors. Lucas: That's the direction some analytics firms are moving. They're building models that correlate cyber incidents with stock price volatility, supply chain disruptions, and credit ratings. Insurance is just the entry point for a much larger data integration story. Luna: For now, though, the takeaway for our listeners might be: if you haven't had a serious conversation with your insurance broker about what they require, you should. Because that list is now your de facto security roadmap. Lucas: Couldn't agree more. And on that note, we'll leave you to think about how your own insurance renewal might be shaping your security priorities. Thanks for listening.