Modern Insurance Magazine Issue 65

INSURTECH
Google
Cloud
QMonica, more and more corporations are securing
cyber insurance policies in the event of an attack or
data breach. While insurance does not eliminate the
need for proactive and resilient cyber controls, it does offer
a ‘safety net’ for potential financial loss, according to a new
report from Google Cloud’s Office of the Chief Information
Security Officer (CISO).
How is the role of the CISO evolving to address the growing
volume of cyberattacks? And what sort of collaboration
needs to happen with the Chief Financial Officer in order to
mitigate cyber risk?
A
Cyber-related risk is one of the top concerns
facing organizations today, now with frequent
board-level engagement on the topic. This
rapid shift in awareness around cyber-related risk
has encouraged the CISO to evolve from a technical
security expert to more of an enterprise risk manager,
one that’s responsible for translating cybersecurity
threats and vulnerabilities into business-relevant terms
for the benefit of executive leadership and the Board of
Directors.
Historically, the Board are used to understanding risk
in terms of dollars, largely due to the role of the Chief
Financial Officer (CFO) in relation to how they quantify
risk for the organization. While the CISO is primarily
responsible for actually mitigating the risks and securing
an organization’s environment, a CISO and CFO can
collaborate in order to tell a better story together.
Leveraging the skills of an actuary or financial analyst
can develop a cyber model which can translate risk
into dollars, something which is easier for leadership
to digest and track over time. Further quantified cyber
risk allows organizations to think about their return on
investment in security, and translate their risk into risk
transfer or insurance discussions.
QWhat about Artificial Intelligence? Is it a friend, foe, or
both?
AI is at an inflection point for digital security,
and if leveraged correctly, it can be an incredible
A tool to help organizations improve their security
posture and reduce toil. That being said, a lot of how
AI plays out – with regards to whether it’ll be a friend
or foe – depends on how we collectively work together.
Security professionals and policymakers must boldly
take action to shape the direction of the technology in a
way where it tilts the odds in favor of cyber defenders.
At Google, we often talk about the Defender’s Dilemma
– a challenge in cybersecurity where attackers need just
one successful attack to break through the best defenses.
Meanwhile, for defenders, there’s no margin for error.
Based on Google’s experience deploying AI at scale, we
believe that AI can actually reverse this dynamic. This
would eventually enable both security professionals and
defenders to scale their work in threat detection, malware
analysis, vulnerability detection, vulnerability fixes, and
incident response.
AI can, and is, being leveraged to detect malware in
real time. For example, Gmail blocks more than 100
million phishing attempts every day, and a lot of that has
been powered by AI for decades. Google Play Protect
also scans over 100 billion apps for malware and other
issues. We have a number of tools across our product
suite, particularly within Google Cloud, that leverages
AI to predict where an attacker could strike, what cloud
resources would be exposed, and the possible blast radius
of a successful attack. This means that cloud customers
can better secure weaknesses in their environment.
QWhat were some of the top trends to emerge from
Google’s recent Cyber Day?
We hosted Cyber Day as a way for us to share
our cybersecurity investments with the insurance
A market. A few key themes emerged that we hope to
see as general trends within the technology and insurance
space.
1. Secure by Design
First, we strive to develop infrastructure and products that
are secure by design. Google Cloud puts significant effort
into shipping products with secure default configurations
out of the box, so customers don’t have to spend as much
time reconfiguring for security. We also provide security
tools and define blueprints for customers, so that their
cloud implementations are secure from the start.
This is important to the insurance industry as cyber
insurers are often on the hook for a loss, regardless of
where the breach occurred. We’re at a time where insurers
are starting to look at the investment that technology
providers put into security, as they consider whether
to differentiate pricing for their policyholders based on
which technology provider or software a company is
using.
68 | MODERN INSURANCE