4 ms·

I think this is the author's most novel insight: > Honestly, I would not be suprised by 2030 if insurance companies made the usage of ephemeral sandboxes (in w

I think this is the author's most novel insight: > Honestly, I would not be suprised by 2030 if insurance companies made the usage of ephemeral sandboxes (in whatever form: be that cloud, OCI, or firecracker) a condition of issuing cyber insurance. Whatever form it takes, insurance companies' influence on the development process is a new and profound thing. Try to think of an industry where insurance is involved that doesn't go to great lengths to comply with their requirements; manufacturing, bulk transport, personal transport, health care, home ownership, civil engineering, chemical development, plant maintenance, entertainment, farming...it's an endless list. Devs can rant all they want (people in other industries sure do!) but if the insurer's mandates are imposed at a company level, they won't have much choice.

busterarm 5y ago
I've also come to this same conclusion about two years ago. Given the pace of new compliance I've had to onboard in the last few years, I think it's coming a lot sooner than 2030. Maybe 2024 or 2025.
- handrous 5y ago
  What's this insurance for? Data breach liability?
  - busterarm 5y ago
    I'm not even so sure it's going to come from the insurance industry, but just from B2B customers. Banks and insurance companies have been implementing on their own and requiring rigorous standards from their vendors. Then there's meeting the requirements for FedRAMP certification if you want to sell to Uncle Sam. If you look at the tech stack of a company like Progressive and how they do software deployments, they are _significantly advanced_ in comparison to the rest of industry. They also made their transformation extremely quickly by committing adequate internal resources to the problem.
    - mleonhard 5y ago
      I would like to learn more about how insurance companies do software engineering.
jessaustin 5y ago
The industry seems fairly unsophisticated so far. Our local agents are determined to attach cyber/data riders on the coverage a building owner has for an entire building. When I point out that building owners DGAF about tenants' data and how well tenants protect that data, they have no idea what I'm talking about. They seem very far from designating e.g. sufficient backup procedures.
- ericbarrett 5y ago
  That's interesting to hear. I wonder if smaller, more savvy insurers will lead the way in establishing relevant standards and then be bought or copied by the big ones.

busterarm 5y ago

I've also come to this same conclusion about two years ago. Given the pace of new compliance I've had to onboard in the last few years, I think it's coming a lot sooner than 2030. Maybe 2024 or 2025.

handrous 5y ago
What's this insurance for? Data breach liability?
- busterarm 5y ago
  I'm not even so sure it's going to come from the insurance industry, but just from B2B customers. Banks and insurance companies have been implementing on their own and requiring rigorous standards from their vendors. Then there's meeting the requirements for FedRAMP certification if you want to sell to Uncle Sam. If you look at the tech stack of a company like Progressive and how they do software deployments, they are _significantly advanced_ in comparison to the rest of industry. They also made their transformation extremely quickly by committing adequate internal resources to the problem.
  - mleonhard 5y ago
    I would like to learn more about how insurance companies do software engineering.

jessaustin 5y ago

The industry seems fairly unsophisticated so far. Our local agents are determined to attach cyber/data riders on the coverage a building owner has for an entire building. When I point out that building owners DGAF about tenants' data and how well tenants protect that data, they have no idea what I'm talking about. They seem very far from designating e.g. sufficient backup procedures.

ericbarrett 5y ago
That's interesting to hear. I wonder if smaller, more savvy insurers will lead the way in establishing relevant standards and then be bought or copied by the big ones.