BLACK HAT USA – Las Vegas – On a day when keynote speaker Dan Kaminsky told the security industry that it must do better, industry veteran Jeremiah Grossman offered a path to some meaningful change.

In a one-hour session on cyber  insurance, Grossman underscored why with all the high-profile hacks there’s good reason for companies to feel vulnerable today and that security companies need to start thinking about offering guarantees.

Citing a Dark Reading survey, Grossman said that 15 percent of security managers have no doubt that their company will have to respond to a major security incident in the next 12 months.

“Our industry must change,” said Grossman, who now works as chief of security strategy at SentinalOne. “Not many people believe us anymore, so the best way for us to move forward is to share our knowledge. Think about it, the security industry is one of the only businesses that doesn’t offer any guarantees or returns policies.” 

Grossman talked about recently-introduced guarantees at SentinalOne, WhiteHat Security and Trusona. At SentinalOne, for example, the company now insures up to $1,000 per endpoint with a maximum cap of $1 million if a customer experiences a ransomware attack. The insurance costs about $15,000 to $30,000 a year and is tied into a company’s general liability insurance.

Parallax reported that one-third of U.S. companies buy cyber insurance, a market that PwC estimated will grow to $7.5 billion by 2020. 

Grossman crunched some numbers and found that companies spend $3.8 billion annually on traditional security equipment like AV, firewalls and intrusion detection, but they also spend $3.2 billion on cyber insurance. 

“So a lot of the companies out there just opt to spend money on insurance when they get hit with an incident,” he said. But the numbers from some of the leading incidents also show that companies are not buying enough cyber insuranace.  The Target breach cost the retailer $248 million, but the insurance company only paid out $90 million. And Home Depot lost $43 million on its breach, with a payout of about $15 million.

“So what this tells us is that big companies are buying insurance, breaches happen and the insurance companies pay,” he added. 

And companies finally understand that they need more insurance.

Anthem, which experienced a major breach in February 2015, now has a policy in excess of $150 million, Grossman said. And companies are now stacking insurance policies. For example, one carrier may cover up to the first $50 million, while another company may cover the next $100 million. 

Grossman predicted that the cyber insurance market will explode in the next few years. Companies will need to work with brokers who can piece together coverage from different sources. He also said there’s a market forming for security ratings services that use analytics to issue a rating similar to a FICO score for home buyers. 

Related Content: