Keith Savino has been in the cyber insurance market long enough to remember when the application asked how many email addresses the applicant had. The answer, in those early days, was often AOL and Prodigy.
"I love the evolution of the cyber industry over the past 25 years," said Savino, CEO US at Emergence Insurance, at a recent Insurance Business cyber roundtable. "I think we've gotten better at doing a lot of things, not worse."
Applications moved from one page - asking questions largely irrelevant to actual cyber risk - to 22-page behemoths so burdensome they guaranteed non-completion. Now they sit somewhere more useful: combining streamlined questioning with third-party data and security scanning that makes underwriting more precise rather than simply more demanding.
Proactive monitoring tools have changed the character of the product itself. Cyber insurers are no longer purely reactive financial backstops. They are part of an ongoing security posture - monitoring clients throughout the year, flagging vulnerabilities, connecting them with incident response resources. That shift has contributed to what Savino describes as cyber becoming a standard option rather than a specialty line.
"It's no longer a specialty line,” he said. “We're still cool, by the way. Even if we're not special anymore, we're still cool."
"Prior to the pandemic, nobody was talking about MFA or EDR, and now we've all had to become cybersecurity experts in order to sell cyber," said Jennifer Wilson, senior director, cyber at WTW. "So I do agree the evolution is making all of us better."
Her personal marker for how far cyber has travelled in the room is the most pointed. "I remember back in the day, pre-pandemic, when the producers would say, 'Jennifer, you can come to the meeting, but we're probably not going to talk about cyber. And we're really going to focus on D&O.' And now the D&O folks are kind of in the backseat."
Applications now focus on controls that actually predict loss - MFA adoption, EDR deployment, backup practices, incident response planning - rather than throwing every question at the wall. The result is underwriting that works.
"I think the underwriting is going very well," said Joe Earle, cyber group practice leader at C3 Risk and Insurance Services. "We've seen record lows of ransomwares paid, so that's a good sign that customers aren't paying as many ransoms."
Against that genuine progress, Earle introduced the market's most pointed self-criticism.
"I think where the industry might be going wrong is that we're trying too much to be cybersecurity companies instead of just staying in our lane as cyber insurers. I think cyber insurers and cybersecurity companies should be working together, but not trying to take over becoming cybersecurity companies,” he said.
Over the past several years, cyber insurers have added pre-breach services, security scanning, vulnerability assessments, incident response retainers, and vendor panels to their offerings. The intent is defensible. The execution risk is that insurers begin making implicit representations about their clients' security posture - or competing with the security vendors they are ostensibly partnering with - in ways that create their own liability and complicate the claims relationship when a breach occurs.
The distinction Earle draws is clear: working together, not taking over. A cyber insurer that connects clients with appropriate security resources is adding value within its competence. A cyber insurer that positions itself as the security solution creates expectations it may not be equipped to meet.
"If you're a professional insurance agent today and you're dealing with the insured, your insured is maturing every day of the week, and they're getting smarter and smarter," Savino said.
That client sophistication is the argument for broker expertise, not against it. Clients coming to renewals having used AI to compare policies and prepared lists of coverage questions have raised the bar for what they expect from their broker.
The response is not to out-research them in real time. It is to know the product well enough to lead the conversation rather than follow it. That requires genuine subject matter expertise - not just at the underwriter level, where it has clearly improved, but at the point of sale, where the gap between what is being purchased and what is actually covered remains consequential.
Savino put the standard simply: "You need to know what's in there, and you need to know what you're selling."
