Modern Insurance Magazine Issue 65

INSURTECH
Capgemini
AXA XL
QCaitlin, it was so great to catch up recently and
hear your perspectives on the current state of
cybersecurity. How have things changed in recent
years from an underwriting perspective?
A
Hi Megan! Likewise, it was great speaking with
you, and I’m excited to be here to chat with you
today.
Things have changed dramatically in cyber insurance
over the last few years. The hard cyber insurance
marketplace started after an influx of ransomware
attacks in 2019. This hard market lasted through 2022,
driven by the frequency and severity of these claims.
Significant losses forced cyber insurers to increase rates,
as well as analyzing the cybersecurity posture of each
insured under scrutiny.
Now we are back in a soft market, where there’s a lot
of insurer competition driven by lofty new business
goals. Rates have significantly dropped year after
year; meanwhile, claims are trending upward. It will be
interesting to see what happens over the next 12 months!
QWhat are some emerging cybersecurity trends that
we should be aware of, and prepare for?
A
A trend seemed to take off at the beginning
of 2023 around some of the state-level
comprehensive privacy laws that are being
passed. At the start of 2024, 15 US states enacted
stricter privacy laws - Connecticut (where I live) being
one of them. It is a significant legal undertaking for
companies to ensure that they are staying ahead and
remaining compliant. On the underwriting side, we like
to understand the different committees and the extent
of legal involvement that companies utilize in order
to remain in compliance. We also saw the SEC cyber
disclosure rules passed last year, which requires public
companies to disclose incidents within 4 business days.
There is a lot going on in the privacy space!
Another trend we have seen is SIM swapping, where
threat actors trick a cellular device company or telecom
carrier into switching the SIM card of an executive
(or an employee with elevated privileges and access,
like an administrator) onto the threat actor’s device.
The attacker collects info on the victim, whether it’s
through social media or phishing, then calls up the cell
phone provider and pretends to be the said individual.
The provider is then duped into switching the victim’s
mobile number to the threat actor’s phone, which
means that the attacker can receive incoming calls and
texts - including authentication codes for multi-factor
authentication (MFA) – in order to gain access to the
network. In general, MFA bypass schemes are on the rise,
particularly given the world of remote working that we
are now living in post-pandemic.
Lastly, I would say Artificial Intelligence (AI) is a very
hot topic. Every company is looking at how they can
incorporate AI into their business, and there are a lot of
unknowns to the potential threats in doing so. We are
seeing threat actors create sophisticated and believable
phishing schemes within large language models, and
copyright can be a very complicated element of AI.
Ultimately, we look for companies to be approaching AI
cautiously, closely tracking any employee usage.
QWhat challenges are companies facing when it comes
to cybersecurity issues?
Vendor management comes to mind immediately
as a continuous challenge within cybersecurity and
A cyber underwriting. We ask questions around how
an insured is vetting third parties prior to working with
them, if questionnaires are completed, how often vendors
are reassessed, and what contract provisions they might
have in place to protect themselves. The supply chain
issue is not something that is going away, and the risk is
still there even when companies have best practices and
procedures in place.
Vulnerabilities with VPN products is also an issue. In
a world where many companies now have a hybrid
workforce, we saw a real increase in VPN vulnerabilities
and related exploitations in 2023. In a similar vein, we’re
seeing an uptick in Cloud-based attacks, with Cloud
environments not being properly configured and secured.
I think there is a misconception that the Cloud is safer
or more secure, but it’s important for companies to have
Cloud security experts on staff, or at least a third-party
Cloud expert to assist in ensuring a safe and proper
management of that environment. While major Cloud
providers do offer many enhanced security features, these
are not enabled by default. Therefore, it’s important for
companies to check that they have a proper handle on
how their Cloud environment is configured, ensuring that
the proper features are turned on.
The cyber workforce shortage is the final issue to mention
here. Companies are struggling in their search for qualified
cybersecurity IT professionals. There’s so much demand
for expertise and experience in this area, and yet there is
a huge talent gap and shortage of trained cybersecurity
professionals. The war on talent can also result in
significant turnover.
70 | MODERN INSURANCE