Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Insurance Is Priced After a Breach
Transcript
- Lucas: Okay, so you run a mid-sized company, you get breached, and you think the worst is over once you contain it. But then renewal comes around and your cyber insurance premium jumps sixty percent. And you're sitting there thinking — wait, we actually fixed the vulnerability. Why are we being punished? Luna: And the frustrating part is, that's completely normal. But most CISOs don't understand why until it's too late. Lucas: Right. So today I want to get into the actual mechanics of how insurers price a policy after a breach. Because it's not just about 'oh, you're riskier now.' There's a whole system of data, loss runs, and even how the policy is structured that determines your new premium. Luna: And I think a lot of people are surprised to learn that your own claim history is just the starting point. It's not the whole story. Lucas: Exactly. So let's start with the most concrete piece: the loss run report. If you've ever had to file a claim, your insurer produces a loss run — a ledger of every dollar paid out, plus reserves for expected future costs. And here's the thing — that report doesn't just summarize what happened. It's the first thing the underwriter looks at when you come up for renewal. Luna: And a loss run isn't just about the final number, right? It's about the severity of the incident, the type of attack, how long it took to respond... Lucas: Exactly. And underwriters are trained to read between the lines. A ransomware claim where you paid the ransom? That's a red flag. A ransomware claim where you refused and restored from backups? That signals a mature response capability. Same attack vector, but the loss run tells two completely different stories. Luna: So the loss run is almost like your security posture's report card, but it's graded by an actuary. Lucas: That's a great way to put it. Now, here's where it gets really interesting — the premium increase isn't just a function of your claim. It's also driven by what's happening in the broader market. August 2026, we're in a hard market for cyber insurance. Rates have been climbing for years, driven by ransomware losses and systemic risk. So even if you had zero claims, you'd still see a double-digit increase just because the market's repricing. Luna: So a breach might only be the trigger, not the sole reason for the hike. Lucas: Precisely. And that's a key insight for CISOs: when you go into renewal, you're negotiating against a market that's already nervous. Your claim is just one factor in a larger risk pool. Insurers look at their entire portfolio — if they've paid out a lot of ransomware claims across their book, they're going to raise everyone's rates to cover that. Luna: So it's almost like you're penalized for the sins of your peers. Lucas: To some extent, yeah. But there's another layer that's even more important — the structure of your policy itself. Most cyber policies are written on a claims-made basis, which means coverage is triggered when a claim is made during the policy period, not when the breach occurs. And here's the kicker: after a breach, insurers often change the terms at renewal. They might switch you from per-incident coverage to aggregate coverage, which caps the total payout for the year, not just per event. Luna: Oh, that's a huge shift. So instead of a million dollars per incident, you get a million dollars total for the year, and that's it. Lucas: Exactly. And once you've had one claim, the insurer knows you're more likely to have another. So they want to cap their total exposure. And that's why even a 'successful' recovery can still lead to a painful renewal — it's not just the premium that changes, it's the coverage itself. Luna: So what can a CISO actually do to fight back? Because it's not like they can just say 'we promise we're better now.' Lucas: Well, that's exactly the question. And the answer lies in data — but not just your data. Insurers are increasingly using third-party threat intelligence to validate your security posture. They're looking at whether you've implemented multi-factor authentication, whether you've patched critical vulnerabilities, whether you've segmented your network. If you can show measurable improvements, you have leverage. Luna: But it's not just about showing them your latest pentest report, right? It's about showing them something that aligns with their risk models. Lucas: Right. And that's where it gets really sophisticated. Some insurers are now using real-time threat telemetry — they might subscribe to the same dark web monitoring feeds you use, or they analyze your external attack surface themselves. They can see if you've left a forgotten S3 bucket open or if your certificate is about to expire. So the underwriter might know more about your external posture than your own security team does. Luna: That's a little unsettling, but it also means you can proactively clean up your external exposure before renewal. Lucas: Exactly. And that's a concrete action a CISO can take. Before you even enter renewal discussions, do an external attack surface review. Fix the dangling DNS records, close the open ports, update the outdated TLS certificates. Because the underwriter is going to see those, and they're going to factor them into your risk score. Luna: So it's almost like you're preparing for an audit, but the auditor is an algorithm. Lucas: In a sense, yes. But here's another piece that a lot of people overlook: the quality of your incident response plan itself. Insurers love to see that you have a tested IR plan, that you've done tabletop exercises, that you have a relationship with a breach counsel and a forensic firm. Because when they underwrite, they're not just pricing the probability of a breach — they're pricing the expected cost of a breach. And a well-prepared company can reduce that cost significantly. Luna: So they're essentially rewarding you for being organized and for having a plan that can contain the blast radius. Lucas: Exactly. And that's why some CISOs are now negotiating their renewal like a business deal, not a compliance checkbox. They bring a binder of evidence: their incident response exercise results, their vulnerability management metrics, their security awareness training completion rates. And it works. I've seen companies get their increase reduced from thirty percent to ten percent just by presenting that kind of data. Luna: And that's a huge win, because ten percent is still an increase, but it's something you can budget for. Lucas: Right. And the key is to start early. Don't wait until 30 days before renewal. Start the conversation three or four months out. Ask your broker for the underwriter's risk appetite. Find out what specific factors they're weighting this year. That gives you time to close the gaps that matter most to them. Luna: So it's almost like you're managing your insurer as a stakeholder, not just a vendor. Lucas: Exactly. And that's a shift in mindset that's becoming critical. Because the insurance market isn't going to soften anytime soon, and the CISO who treats renewal as a strategic engagement is going to get a much better outcome than the one who just signs whatever the broker sends over. Luna: And if you're listening and you're building or running a security program, this kind of practical advice is exactly why we keep the show ad-free. If you find value in what we do, you can support us at buy me a coffee dot com slash fexingo. It keeps us going and lets us dig into topics like this without any sponsor pressure. Lucas: Yeah, it's a small way to say thanks and it genuinely helps. But back to the pricing mechanics — because there's one more number that's really interesting here. The concept of a 'loss ratio' is central to how insurers set rates. If they're paying out eighty cents for every dollar they collect in premiums, they're going to raise rates for everyone. So your individual claim is part of a much larger statistical picture. Luna: So even if you have a clean record, you're still affected by the losses of the entire pool. Lucas: Exactly. And that's why some CISOs are now pushing for risk transfer alternatives like captive insurers. If your company is large enough, you can set up your own captive insurance company and take on a portion of the risk yourself. That gives you more control over pricing and coverage, but it requires a serious balance sheet and a long-term commitment. Luna: But for most companies, that's not an option. So what's the practical takeaway for the average CISO at a mid-sized firm? Lucas: I'd say there are three things. First, understand that your premium is not just about you — it's about the market and the insurer's portfolio. Don't take the increase personally. Second, use data to your advantage. Get that external attack surface cleaned up, document your IR readiness, and present it to the underwriter. And third, start the conversation early. The longer you have, the more you can influence the outcome. Luna: And the worst thing you can do is remain passive and just accept whatever renewal comes your way. Lucas: Exactly. Because the insurer is not your enemy — they're a risk partner. But like any partnership, it works best when both sides understand the other's incentives. And once you understand how the pricing works, you can actually use it to your strategic advantage. You can turn insurance from a cost center into a driver for better security investment decisions. Luna: So the next time you hear about a company's premium doubling after a breach, you'll know it's not just about the breach itself — it's a complex equation with a lot of variables. Lucas: Yeah, and that's the episode. I hope this gives you a clearer picture of what's happening behind the scenes when that renewal letter lands in your inbox. Thanks for listening, and we'll see you next time.