3 ms·

The problem is that cyber risk is effectively impossible to model As an embedded consultant I've worked very closely with several companies in at-risk spaces (

The problem is that cyber risk is effectively impossible to model As an embedded consultant I've worked very closely with several companies in at-risk spaces (eg. banking), and from a technical / corporate-culture perspective I have a good idea of which ones are less likely to be breached. I think part of the challenge is there's a huge disconnect between how the insurance companies work (fairly macro) and the little details that really matter to assessing the security posture of an individual customer. A premiums discount for those who undergo intensive annual security audits by respected professionals would be a good start, then you can begin to rate the auditor's performance tier based on the relative number of their clients impacted.

tfehring 5y ago
A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually quantify each of their expected losses. I agree that there's a big disconnect between the way that insurers assess risk and the way that security researchers assess risk. But I'm skeptical that the type of assessment you're describing can be done at scale in a rigorous enough way to inform pricing decisions, I worry that it would just turn into gameable checklists and therefore cease to be a good measure. Perhaps more importantly, it's probably possible for insurers to accurately assess the expected annual cost associated with a given company's employees getting phished for a seven-digit ransom, but that's not the only risk they're worried about. Even if it can accurately assess the average loss associated with, say, a major 0day in a particular piece of software that's used by a double-digit percentage of companies - a much harder task - an insurer might just not want that much exposure to a single point of failure on its balance sheet.

tfehring 5y ago

A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually quantify each of their expected losses. I agree that there's a big disconnect between the way that insurers assess risk and the way that security researchers assess risk. But I'm skeptical that the type of assessment you're describing can be done at scale in a rigorous enough way to inform pricing decisions, I worry that it would just turn into gameable checklists and therefore cease to be a good measure. Perhaps more importantly, it's probably possible for insurers to accurately assess the expected annual cost associated with a given company's employees getting phished for a seven-digit ransom, but that's not the only risk they're worried about. Even if it can accurately assess the average loss associated with, say, a major 0day in a particular piece of software that's used by a double-digit percentage of companies - a much harder task - an insurer might just not want that much exposure to a single point of failure on its balance sheet.