[00:00] Guest: Nobody remembers the premium they paid when they're in the middle of a ransomware attack.

[00:04] Guest: A lot of our policies now are actually less than what I pay for my car insurance.

[00:07] Guest: And you can outsource your liability to the MSPs.

[00:13] Danny Wood: Hello and welcome to Insurance Business TV. I'm Danny Wood, news editor of Insurance Business Australia. For this executive insights panel, we're unpacking the state of the Australian cyber market. From SMEs still going without cover to underwriting challenges presented by AI and what good incident response looks like for brokers and their clients. We've assembled a panel of three cyber experts all from underwriting agencies: Michael Lewis, Australian cyber development manager for CFC, Anthony Wall, head of underwriting for Cowbell Australia, and Trent Neil, general manager of Coalition Australia.

[00:51] Danny Wood: Welcome to all of you and let's kick off with you Michael. Why are so many Australian SMEs still going without cyber cover? Is it price, complexity or just refusing to see themselves as a target? Michael, what do you think?

[01:07] Guest: Thanks Danny. Great to be here. It's a combination of all three. But the biggest issue for me is still relevance. SMEs understand they have a cyber risk. A survey we've done recently showed that Australian SMEs still think cyber risk is their number one business risk by far. So they get it's a risk. It's more of a disconnect between the awareness of the risk within their business, how much of a threat it is to their business and then them actually doing something about it.

[01:40] Many SMEs still associate cyber insurance maybe with the large corporates hitting the headlines. The Origin one is the most recent one. But the reality is most of the cyber claims that we see are much more ordinary. It's phishing emails or invoice manipulation, email compromises. They're not always newsworthy, but incredibly disruptive.

[02:01] There's also a perception that cyber insurance is expensive or complicated. I believe as an industry, we probably haven't helped ourselves there over the past years, too often leading with policy language rather than the business outcomes that cyber insurance will provide. For brokers, how they approach the conversation with clients is key to overcoming that disconnect and for insurers it's simplifying the purchase process and policy language, really important to help that disconnect.

[02:35] Danny Wood: Michael thanks very much. Trent, welcome to you to the panel.

[02:39] Guest: Thanks Danny. I kind of agree with what Michael touched on there. It's definitely a combination. Different clients have different motivators at the moment. Speaking with brokers and business owners, I think there's still a disconnect between knowing there's a cyber risk and actually thinking it's going to happen to you.

[03:03] They know there's a risk. They know there's a chance of it happening, but I think it's still very intangible and kind of like stuff happens in the movies, that's not going to happen in real life. I think the challenge is a lot of times cyber incidents for these small businesses are seen as they've done something wrong, and it's not really something they want to talk about.

[03:23] So, I think there's a lot more of these happening with small businesses that just aren't getting talked about. They're getting quietly swept under the rug if they're not insured, or probably if they are insured. So, I think it's a combination of not thinking it's going to happen to them and not realizing how often this is really happening to businesses.

[03:41] But as Michael touched on, still price. People have an expectation it's going to cost tens of thousands of dollars. A lot of our policies now are actually less than what I pay for my car insurance. The market's really changed a lot. It's much more competitive than it used to be. I think people just don't really understand that yet.

[03:51] Danny Wood: Thanks, Trent. Anthony, welcome to the panel and what are your thoughts on this SME conundrum, for want of a better word?

[03:58] Guest: Thanks. Good to be here as well. Not much more to add. I'd probably just echo Trent and Michael's comments. Whilst businesses see the exposure, there's a real lack of urgency to go out and actually buy the policy.

[04:14] I think there's some challenges with brokers. A lot of brokers don't see themselves as cyber security experts. As cyber security becomes more technical, there's a perception that they don't have confidence to talk to clients about the risk. Brokers ask questions about controls or clarifications and if they can't answer them, they don't want to tackle this challenge.

[04:38] So we ask brokers to steer away from the technical piece and more the resilience piece. It's a great time actually to buy cyber at the moment for SMEs. The perception about price was there, but if you look at some of the value-add services that insurers provide, it's cheaper than the price of the premium.

[05:02] Insurers are doing all we can to make things as easy for brokers and clients as possible. We're asking fewer questions than before, relying on our tools, and our platforms are much easier to use and quicker to get quotes. There's a lot there to hopefully change that mindset of SMEs and brokers.

[05:22] Danny Wood: Thanks, Anthony. Let's stick with you for our next question. Cyber risks are changing daily and AI is accelerating that. How do you actually underwrite something that's shifting so fast and do you really think insurance can keep up with it?

[05:39] Guest: Thanks Danny. It's a great question. I look at the history of cyber and how it's evolved. Cyber risk has always been a really rapidly evolving risk, particularly against other classes. I think for the most part insurers have done a really good job in being adaptive and innovative in their underwriting approach.

[06:02] So I think that mindset of underwriting something that is constantly shifting has always been there. Technology and AI are really accelerating that shift. There are so many examples of the way threat actors use AI now, from exploiting new vulnerabilities quicker than they ever had before to using automation and AI in phishing attacks.

[06:24] So for insurers to keep pace, we need to keep evolving. That really means using technology ourselves. I think everyone on this panel will agree the days of traditional proposal forms are over. Agencies are using AI embedded in underwriting processes, scanning tools, dark web monitoring and in-house security experts to monitor the threat landscape.

[07:06] Danny Wood: Thank you. Michael, what are your thoughts on how this risk changes on a daily basis?

[07:14] Guest: Echoing Anthony's comments, cyber's always been at the forefront of innovating products to keep pace. You have no other choice. The AI exposure part of it is probably the key part. Cyber insurers have already underwritten AI exposure for years, and now the market is demanding that we affirmatively clarify that.

[07:44] But what I've always thought is that cyber insurers are insuring the outcomes, not the technology used to facilitate it. So AI is just a tool that defenders or attackers are using, not the attack itself or the outcome from the attack.

[08:02] Cyber insurance policies are generally already picking it up anyway. We believe it's important to keep our products relevant to how our insureds operate today. Criminals are not going to lack for tools to use. We've got to keep pace.

[08:33] Danny Wood: Trent, what about you? How do you see this sort of supercharged cyber risk coming from AI?

[08:42] Guest: Cyber risk is changing faster than it ever has. The AI revolution means we're seeing more vulnerabilities found in the last couple of months than we had in years before that. It's really important to keep pace with that.

[09:00] What we're seeing is that it needs to move to an active insurance model. Rather than just a pen-and-paper proposal form every 12 months, we need continuous monitoring and to let clients know if they've got issues midterm that we can see, so they can do something about them.

[09:19] The days of traditional static insurance are definitely moving away. That said, I'm still worried about the simplest things. AI is going to make things much more complicated and sophisticated, but we're still seeing clients clicking on obvious phishing links, not putting MFA in place and not patching.

[09:43] Threat actors can use AI and do sophisticated attacks, but they don't have to. The simple things still work. So it's both making sure we keep up with the pace of change and also getting the fundamentals right.

[09:58] Danny Wood: Thanks, Trent. Looking at when a breach actually hits, what does good incident response look like for an SME and how much weight should brokers give to claims handling versus the premium itself?

[10:14] Guest: I think everyone's going to agree that premium should be the last thing you think about with an insurance policy. It never is, but you're paying for a promise. The claims service is that promise.

[10:30] Brokers should be putting their weight into the claims service and what they know they'll get out of it. It's also about preventing loss in the first place. It's that continuous monitoring and letting clients know of issues before they happen. If you can avoid the client having a claim entirely, that's the best outcome possible.

[10:54] Danny Wood: Anthony, how about you? How do you balance premium versus claims?

[10:59] Guest: Premium should be the last piece of the puzzle, but obviously it's important. Without a good claims handler, you can have a lot more problems down the track. If claims are not handled efficiently, there might be leakage and unintended coverages issues.

[11:22] Incident response really is an important coverage these days. You really want early engagement if there is an incident because insurers have access to experts to work out what the fire was, put it out quickly and help insureds recover.

[11:43] There are vendors around legal counsel, forensics, incident response and other experts. It's a whole raft of services that can really help SMEs because they don't have the in-house maturity of large companies to handle claims.

[12:04] They should really lean on insurers and the vendors to help them mitigate exposure. It starts before the policy is in place as well. They should understand the incident response plan and the roles and responsibilities within the company.

[12:38] Danny Wood: Michael, what's your view here?

[12:40] Guest: Nobody remembers the premium they paid when they're in the middle of a ransomware attack at 2 a.m. What they remember is when someone picked up the phone, went through the triage and brought in the right experts.

[13:01] The incident response feature of a cyber policy is so important. It's really where we shine and where good versus bad really shines as well. Quicker is better. Having experts on tap for SMEs is critical because they just don't have that capability normally.

[13:30] Danny Wood: Let's go from incident response to prevention. SMEs have lots of things they can do these days. Staff training, penetration testing, vendor risk checks and dark web monitoring. Which of these actually deliver value and how does this differ for SMEs versus large corporates?

[13:57] Guest: All those measures deliver value. The difference is how they get delivered, whether they're ongoing or continuous through the year. For us, 75% of the incidents we see are driven by human error, like clicking on a malicious link, approving a fraudulent payment or sharing credentials.

[14:21] So staff training is really important for both SMEs and corporates. Vendor checks are often overlooked by SMEs. They have fewer vendors to vet, but they don't have the ability, capacity or knowledge to vet them themselves.

[14:43] As SMEs are often the weak link in a supply chain, that can be even more risky. Pen testing is valuable, but it tends to deliver greater ROI once an organization reaches a certain security level.

[15:00] Many SMEs don't have visibility on their exposed assets. Whether it be compromised credentials, vulnerable systems or software in their environment. Services such as vulnerability scanning, threat monitoring and dark web monitoring can provide significant value.

[15:22] Most decent cyber insurance policies are now providing these as part of the policy. The biggest difference between SMEs and large corporates is resources. Large enterprises can afford internal security teams. SMEs can't. That's where good cyber insurance policies can fill the gap.

[15:58] Danny Wood: Trent, what do you see as good value for SMEs here?

[16:00] Guest: The ones you've called out are important, but like Michael said, it's probably getting the basics right. Things like backups, good tested backups, multifactor authentication, they're really critical for businesses both big and small.

[16:28] More than half of our claims originate in the inbox through business email compromise. So getting those controls right is really critical. We actually launched a tool for our customers last month called Login Security.

[16:47] It's identity threat detection and response. We saw how damaging those email compromises are. We're giving that tool away now for free because we think the investment in our customers' security will pay itself back through claim savings.

[17:09] Danny Wood: Anthony, what can SMEs do to prevent attacks? What's the best way to spend their time trying to do this?

[17:17] Guest: We still see employee awareness training as fundamental and necessary. It wasn't that long ago that every insurer was providing free awareness training, and it seems to have dropped off quite a lot. I think it's really important to continue providing this because it's still the most effective investment as a first line of defense.

[17:48] All these other services, pentesting and dark web monitoring, do add value. It depends on when and how large the company is as to where they'll get the best bang for buck.

[18:04] Back to basics, as mentioned. The number of clients who still don't have MFA, backup and other simple controls is still very evident. These are absolutely crucial controls that they need to have.

[18:24] Danny Wood: Let's look at cyber wordings because they can vary quite considerably. How can brokers compare policies on what's actually covered, not just price? And is more standardization the answer here? Anthony, let's go with you.

[18:40] Guest: It's generally hard for most brokers to navigate wordings in this market and compare like for like. Wordings are getting updated very often now to keep up with the threat landscape.

[19:00] There's probably about 30 cyber markets. That's a huge number of wordings to consider. If I was a broker, I'd focus on five to six wordings that provide the broadest cover available.

[19:27] I'd really focus on computer crime. We still see BEC phishing dominate losses for the SME market and AI is only accelerating that. There are so many triggers now for computer crime.

[19:50] You need to cover reverse social engineering, invoice manipulation and loss of client funds under the care, custody and control of insureds. Incident response is also a really key coverage.

[20:15] Something that gets missed a little bit is conditions built into cyber wordings. Some insurers put conditions in their wording that the policy won't respond if certain conditions aren't met. Brokers have to be careful with the devil in the detail.

[20:50] On standardization, I don't think it's realistic or even desirable. All insurers have different loss histories, views and underwriting experience. If you try to have one policy, it may temper genuine innovation, and cyber is all about innovation in products and solutions.

[21:26] Danny Wood: Michael, how do you see this cyber wordings challenge and the standardization question?

[21:33] Guest: Picking up from Anthony, he was saying have a look at five or six wordings. For me, just look at CFC's wording. That makes it really simple for brokers.

[21:46] I understand why standardization sounds attractive, but I'm not convinced it's the answer. It removes innovation. Innovation has been the defining feature of cyber insurance. Covers, extensions and services we provide today only exist because insurers were allowed to innovate and differentiate themselves.

[22:18] Standardization won't keep pace with a threat landscape that evolves quickly and is evolving quicker. Brokers should be talking about client exposure and the value-add services they get from a policy, not only the wording itself.

[22:51] The proactive services, pre-loss services, incident response services and AI tools should be spoken about just as much as the covers themselves. AI tools will probably help with policy comparisons over the next couple of years as well.

[23:24] Danny Wood: Trent, how do you see the cyber wordings and standardization question?

[23:31] Guest: I probably disagree a little bit with Michael. I think there could be some benefit from some standardization. I don't think anyone wants to restrict cover, but there could be benefits from naming sections similarly.

[23:53] A good example is contingent business interruption. Some markets call it contingent disruption, dependent business interruption or supply chain cover. They all kind of mean the same thing, but it's tough to follow.

[24:14] We're a competitive market, so I don't think anyone's going to want to follow everyone else. But I think it would be a nice world where we could make it a little easier for brokers.

[24:32] The competition is good though. The wordings now are the best they've ever been. I don't think there's any more cover you could have ever gotten. Competition means there are very broad wordings.

[24:56] For brokers, it's unfortunately hard work. They have to check the wordings. Look for broad triggers and focus on outcomes rather than narrow causes. That's probably the best way to go and that's true for cyber and all insurance classes.

[25:29] Danny Wood: Finally, looking across the cyber risks in your brokers' portfolios, are Australian businesses more resilient than they think or less? Trent, let's continue with you here.

[25:40] Guest: I think Australian businesses are more resilient than they've ever been. Looking at when I started doing cyber about 10 years ago, if a client had MFA, that was amazing. Now most businesses have decent baseline controls.

[26:04] But cyber threat actors are also more capable than they've ever been. If I was saying do businesses think they're more resilient than they are, probably slightly yes. Most small businesses don't look after their own IT. They contract it to MSPs.

[26:24] MSPs have a tough job because they manage multiple clients at once. They're often not security experts. There can be a disconnect between the customer and MSP of who's handling what and who's responsible for what.

[26:37] That does lead to some weaknesses in resilience for cyber attacks.

[26:37] Danny Wood: Anthony, how do you see the resilience of Australian businesses?

[26:45] Guest: I agree with Trent. Businesses have made really meaningful progress in security over the last few years, but I still think some overestimate their level of resilience.

[27:04] Australia experienced fewer large cyber incidents than the US and UK in the past, so we fell behind our peers in terms of control maturity. But that has changed. High-profile incidents, state-sponsored attacks, supply chain attacks and AI-enabled phishing have pushed businesses to improve.

[27:35] I still think there's a long way to go, particularly in the SME space. They outsource control to MSPs and think if they outsource it, they don't have to worry about it. We know that's not true.

[27:53] MSPs manage many clients, have thin margins and are not necessarily cyber security experts. You can outsource your IT, but you can't outsource your liability to the MSPs.

[28:13] A lot of SMEs still think they're too small to be targeted. We know that's not the case. There are many tools available to help businesses become better risks, and insurers really want that win-win situation.

[28:49] Danny Wood: Michael, you get the last word. What's your view on this resilience question?

[28:53] Guest: I do love the last word. It's both. Like Anthony and Trent said, it's gotten better. There's still a lot of work that needs to be done.

[29:09] Businesses in general probably overestimate how prepared they are to respond to a real incident. They think they have tools in place, but everyone has a plan until they get punched in the face.

[29:25] They overestimate how quickly they can recover and how good their backups will work. The businesses that tend to be most resilient aren't necessarily the ones with the biggest IT budgets. They're the ones that have a plan, have an incident response plan and have run through it.

[29:47] The resilience piece is where the insurance industry can really come to the forefront. Cyber insurance should help with business resilience, not just compensate losses after the fact.

[30:02] If I had one final message for brokers and SMEs, it'd be don't measure resilience by whether you've avoided an attack. Measure it by how effectively you would respond if one happened tomorrow.

[30:11] Danny Wood: Great. Thank you all very much. Thank you Michael Lewis from CFC, Trent Neil from Coalition, and Anthony Wall from Cowbell. And thanks for watching Insurance Business TV. Bye for now.