Tim Stephinson from SherpaTech, Reece Appleton from Huntress, Tom Buckley from All IT and Katrina Hickson from Emergence unpack the risks and exposures AI can introduce to technology businesses, and how insurance can address these exposures.
Featuring: Tim Stephinson (SherpaTech), Reece Appleton (Huntress), Tom Buckley (All IT) and Katrina Hickson (Emergence)
Length: 60 minutes
Key takeaways
- Tim's strongest advice for MSPs: don't fill in your clients' cyber insurance proposal forms. If you tick "MFA" for a client and the breach later comes through a platform you don't manage, such as their CRM or Microsoft 365, the client could claim you gave them wrong advice and draw you into a professional indemnity claim.
- Tim says businesses need to work out whether an AI exposure is a cyber risk or a professional indemnity risk. Cyber policies already respond to an AI-driven attack the same way they respond to a human attacker, but PI has not been tested yet, and staying silent about high-risk AI use raises the chance an underwriter won't respond to a claim.
- Katrina explains that insurers are shifting from simply paying claims to building cyber resilience, with many policies now including vulnerability assessments, real-time monitoring, threat intelligence and incident response support. She expects underwriters to look more closely at defences against AI-powered attacks, supply chain risk and compliance with rules like the EU AI Act.
- Tim says underwriters' own scanning and assessment tools mean businesses with strong security get approved quickly, with better premiums and wider cover. His advice is not to be limited by what the broker asks: share every policy, framework and control you have so the underwriter can price the risk properly.
- Tom warns that clients are rushing into specialist AI tools, such as booking platforms and business process automation, and handing customer data to third parties. MSPs should ask where that data is held and how it is secured, because documented due diligence counts for a lot if a breach happens.
- On "whose data is it", Tim describes using the underwriter as an arbitrator before a breach: splitting cloud and on-premises responsibility for 20 million health records let his client contract clearly and avoid an astronomical premium.
- Having a plan is not enough. The panel recommends testing it with tabletop exercises, involving boards, keeping key information ready for a breach, and calling the insurer straight away, since Tim notes that false alarms reported early don't affect future premiums.
Transcript
Justin: All right, folks, I think we are live. Firstly, I appreciate everyone attending the webinar today. I'm very much looking forward to this one. If you ask about two of the biggest topics in our space right now, it's AI and insurance, and we've decided to bring them both together.
To kick things off, I'd love to introduce you to the experts. I'm Justin, the moderator, and I very much enjoy learning from the experts we get onto these community fireside chats. This is the first community fireside chat in APAC. It's going to be a series that we run on a monthly or quarterly basis. The whole idea is to bring experts like Tom, Tim and Katrina together in discussion to deliver thought leadership and value to our MSP community.
So watch out for the series. This is the first one, and we're kicking things off with a bang, particularly with this topic. Let's jump into introductions. Tom, please introduce yourself, a little bit about your background and All IT.
Tom Buckley: For sure. I'm Tom Buckley from All IT. I'm the CEO, and we've been in business for over 20 years. We operate on the eastern seaboard, Brisbane, Sydney, Melbourne and a lot of regional areas in between. We offer quite a solid security slant to our offerings, in a very structured way, and we do that for managed clients across the eastern seaboard, mostly medium sized businesses in those areas and a few small businesses in some regional areas. That's us, and I'm looking forward to chatting.
Justin: Thank you, Tom. Tim?
Tim Stephinson: Thanks, and thanks, Tom. I'm Tim Stephinson from SherpaTech. We're an insurance broker that specialises in tech and IT. We represent our customers, predominantly MSPs and tech providers, to the insurance market. So we deal with wonderful underwriters like Katrina at Emergence, and others, to find products that are suitable for MSPs and to ensure they have the right coverage levels as well. We're Australia wide, and I'm based in Sydney.
Justin: Thanks, Tim. And a good segue into Katrina.
Katrina Hickson: Thank you. I'm Katrina Hickson from Emergence Insurance. I head up the distribution team across Australia and New Zealand. We are a specialist cyber insurer here in the market, and my role and the role of my team is working with insurance brokers like Tim to produce our product to support clients in that space.
Justin: Awesome. Well, I really appreciate you being here. To the audience, please feel free to be interactive. If you have any questions, put them in the chat or the Q&A and we'll look to answer those. For those of you watching this on demand, if you have any questions for any of us that we don't answer in the webinar today, you can reach out to us individually and we'll make sure we share those details with you.
Like I said, I'm very much looking forward to this discussion. To kick things off, we'd like to keep it broad with the first question, just to open things up. The threat landscape over the last 12, 24, 36 months is evolving pretty drastically, I would suggest. Insurance is a component of that and is trying to keep up with that landscape. So Tim, perhaps to start with you: what are some of the key trends or changes you've seen in the cyber insurance space over the past 12 to 36 months?
Tim: The big one for me is underwriters investing in their own technology. Everyone's probably familiar with the forms and documents you fill in to place insurance. But underwriters like Emergence and others are now investing in a lot more sophisticated scanning and assessment tools. So we're typically finding that when we take businesses to the market that have very good security postures, or have invested in getting the right controls in place in advance, it's a very quick approval process.
A couple of years ago, we used to find cyber insurance was very hard to get. Now we find it very easy, because businesses can be understood much quicker. These tools can be used to assess risk in a much more understood way, and we're finding the exposures are much better understood by providers like Emergence as well. So we can have really good conversations with them about things that technology providers or MSPs have done in advance. That's leading to better premiums, wider coverage and faster responses.
The reason underwriters have done this is to save them money. They obviously don't want to pay out more than they're required to, so they're very efficient now in handling claims and dealing with cases. Insurance for us has traditionally been a very archaic product. It's been around hundreds of years. But the way cyber insurance is managed now is very different. It's a promise to deliver, not a promise to pay.
I stole the phrase from one of the case managers at Emergence, who referred to the incident response team as the Avengers. It really resonated with me because I love my Marvel movies, and the team that shows up when something goes wrong has incredible skills, skills that sometimes sit outside your typical managed service provider as well. So I digress a bit there, but that's what I'm saying.
Justin: That's really interesting. Katrina, to extend the question to you and expand a little: is that introduction of IR and the capability to respond to incidents a big uplift you've seen in the past few months?
Katrina: Yeah, I think the use of AI and machine learning to help assess cyber risks is becoming a lot more prevalent, and it's also helping with accuracy. It gives us a much better understanding of the organisation's risk profile, and it can analyse real-time data such as network vulnerabilities.
Another thing I've noticed is that insurers are now moving away from that traditional risk transfer, where you're paying out claims after an incident, and are now really promoting cyber resilience. It's about helping the client avoid breaches in the first place. You'll see a lot of cyber policies on the market now that include things like vulnerability assessments, real-time monitoring, threat intelligence and the incident response support Tim mentioned before. It's becoming more of a proactive tool rather than a reactive policy.
Justin: That's really interesting. Tom, I'd love to hear how you see that play out in your world as an MSP, sitting between the customer and the cyber insurance policy, so to speak.
Tom: What we're seeing, particularly in the last six to 12 months, is a large change. Actually, let me rewind to the last three to four years. We've seen a number of new customers and existing clients come to us with an interest in the area, because with a number of the bigger breaches, the smart operators are certainly asking questions, and our relationship managers raise it as part of our managed approach.
But another big change in the last six to 12 months has been organisations, small and medium, even right down to contractors, that deal with multinationals or highly regulated environments having those suppliers or industries impose a hell of a lot of regulation and requirements on them. That in turn comes to us. It can be anything from businesses now requiring ISO 27001 certification, to a lot of audit and compliance requirements from multinationals that they'll now require if you supply services to them.
That has in turn moved into: what insurances does the organisation have in place? That's a question that gets asked, and it starts an entire new conversation. A lot of businesses have received the questionnaire that's been mentioned and done a tick and flick, and there hasn't been a lot of interest. But the interest in what is on that form, what we as their service provider actually provide them with, and what they're actually covered for, is sometimes imposed from those other areas, as I mentioned. That interest level has been amplified in the last six to 12 months, which I think is a really good thing.
It really parlays into what you were saying, Katrina: prevention is the best medicine, for want of a better term, rather than getting a policy and just sitting back and relaxing. Insurance is one thing, but people are really starting to think about the reputational risk as well. So it's rapidly changing, which has been a really interesting dynamic, particularly in the last six to 12 months.
Justin: Tom, have you seen that interest in cyber insurance from your customers drive additional opportunities and services for you as a provider? And how are you taking advantage of that?
Tom: For sure. There are a lot of different maturities in the customer space. From our perspective, we've got a multi-layered approach to applying a cyber security baseline and posture to an organisation, and that comes in various flavours and levels of protection. You can't come to an organisation and expect to have full coverage to maturity level three in the Essential Eight, for example, or the CIS controls, or audit and compliance, which is a lot of checking of things, all for a stock standard price.
So it is an education process. When clients come to us and ask questions, you've got to take the time to educate them and say, for this level of cyber protection and coverage, the price is this, and it includes this. We're noticing we've got to take clients on that journey, because of the range of services and the sheer manpower involved. We'll get into how AI is helping with the cost of providing these services, but there is a big range.
Providing a standard level of coverage can be reasonably economical. But if you have a regulatory requirement from government or a supplier, or you need these added protections, it can get very costly very quickly. And of course, business owners aren't experts in this. They're experts as an accountant or a lawyer or what have you. It's pretty dry stuff, so you've got to take them on that journey.
Justin: Absolutely. Katrina, from an underwriter's perspective, it sounds like there's a broadening of the services and capability you deliver outside of just that reactive insurance piece. How are you seeing that play out in the MSP to client scenario? Oh, I think you're on mute, Katrina. Tricky for young players.
Katrina: I think we're seeing more of a hybrid approach, working more in collaboration with MSPs for their end clients as well. There are some services that insurers may offer that the MSP also offers, and obviously the MSPs are the experts with that insured. So it's more from a collaboration point of view, and trying to fill any gaps that may be present.
Justin: And Tim, you must be seeing something similar with the number of partners reaching out to you guys.
Tim: Yeah, definitely. We take the view that the underwriters are providing these services as value adds. For most people, the MSP is the primary contact for their customers for technology. We feel the reason underwriters offer a lot of these services is that it reduces their risk. In some cases there might be a bit of a double up between services an MSP provides and services an underwriter provides, but we always refer to the things that come from an underwriter as almost the last line of defence.
If you look at it through that lens, sometimes underwriters also offer the ability to connect into tenancies, run scans or even send pre-alerts. We don't see that as a replacement for the security services MSPs offer, but as a backstop in the event there's a failure or an exposure that may not have been considered. There are gaps, and that's why insurance is held. So we don't see the underwriters overlapping with the MSPs. We see them as very complementary.
The more you can use the GRC services that come from the underwriters, the better. We've seen that with Emergence. They have a sister business called Cyber Suite, and with every Emergence policy you now also get additional CISO-style services. These can be an enhancement, and they can also educate end customers about areas they may be deficient in, where they might not actually be paying their MSP for services. So the underwriter or insurance can drive those services back to the MSP in that sense.
I think we're all trying to uplift our clients' postures. We're all trying to make sure they're better covered. So coming back to those principles really helps.
Tom: That's a good point, Tim. I've noticed, particularly with new clients coming in, that there has been a little bit of an aversion in the MSP landscape to some of these tools and mechanisms, because MSPs feel it might be an encroachment on their territory in terms of the job they do. But I think it's really important that everyone in this ecosystem works together, and that includes people like insurers as well.
Everyone's got an important role. Even as a business like us, we are very proud of our security baseline, but we are human, and there's a lot of human involvement in this stuff. We've got all the systems in place that we possibly could, but at the end of the day we're making an enormous amount of change on behalf of our customers in their environments, and at times human error comes into play. So those systems and mechanisms as a backstop, that the likes of Emergence and the underwriters are putting in place, we see as a very positive thing.
And again, I think you should be engaging and educating the client about all of these things, not hiding it from them. Another trend we see with some providers is, well, don't tell the client about this bad exposure or what have you. You don't have to be perfect, and that's okay. But the more you include the client in that discussion, the better. I think that's a very important thing.
Tim: So, do we expect our AI employees to be perfect? Let's hope so. This is one I've been kicking around with a few other people recently. When you think about the AI exposures that any business, not just MSPs or technical providers, is dealing with now, we're letting children, and I'll call the AI the children, drive advice out of businesses in some cases. That's one of the biggest exposures I think insurance will have to deal with in the next couple of years.
First of all, you've got to think about whether it's a cyber exposure or a professional indemnity exposure. We see a lot of insurance policies built to handle AI, but we don't see a lot of clauses introduced into insurance policies until insurers lose money. Then they start to introduce these clauses, or exclusions or endorsements as they're called in the insurance world.
So I think any business out there that's using AI has to think about how they're mitigating that risk. If it's a high risk, say you're using AI to deliver a technical result with health implications, like scanning for melanomas, you should introduce that into your insurance provider's documentation to make sure they're aware and they've provided coverage. If you don't mention it, it's called staying silent, and if you stay silent you increase the chance that you could have a claim the underwriter may not respond to.
There are a lot of exposures where we don't know how insurance will handle them. There's also a lot we do know. A cyber policy is already built to handle AI losses. If somebody uses AI to trick someone, the policy behaves the same way as if it was a malicious human actor versus an AI actor. But on the other side of the coin, with professional indemnity, we haven't really seen some of these things play out yet. So on the AI theme, we've really got to understand what we're trying to cover or address.
Justin: That's a really good segue, Tim, into the AI discussion. AI is going to be involved in attacks, to your point, with adversaries using AI to breach our customers. AI is going to be used internally in our customers' businesses to drive efficiency and effectiveness in the delivery of their services to their customers. And MSPs are going to be using AI, potentially tools with AI components, to help deliver their service to protect their customers. So AI is going to be everywhere. Katrina, it would be good to understand from your perspective how underwriters consider the implications of AI, and how they're evolving their policies.
Katrina: Yeah, sure. To Tim's point, the way a cyber policy currently responds is to a cyber event, irrespective of whether it's AI driven or driven by an individual. But more broadly, underwriters will need to consider threat actors using AI to automate large scale cyber attacks, such as phishing campaigns, ransomware and malware. AI driven tools can launch highly targeted attacks, improve precision and make it a lot harder for businesses to detect them. So that's definitely going to be taken into consideration.
On the flip side, we'd be looking to assess whether companies have adequate defences against those kinds of AI powered attacks, including threat detection and machine learning anomaly detection. So I think it's a bit of a hybrid approach. It's not something new to the considerations we have, but as we see more adoption of AI in businesses, we'll start to see those examples and scenarios play out. And to Tim's point, that will potentially alter the way we handle it.
Justin: Just coming back to you, Tim, on professional indemnity insurance versus cyber insurance. There are AI implications in both of those, right?
Tim: Definitely. Insurance has been talking about AI for the last 10 years. It's been in there in some instances as exclusions, where professional indemnity underwriters haven't wanted to cover the AI exposure. In the last couple of years, the generative AI that everyone's using in business is actually included by some of those policies. Those AI exclusions were more around people developing AI products within businesses. Now that we consume AI more frequently, it's less of an exposure there and more of a business advantage.
But the element I was unpacking is the difference between professional indemnity and cyber insurance, with professional indemnity being protection for bad advice or perceived bad advice. You just don't want to let the AI give bad advice to your customers if it doesn't have the right human in the loop, or the right checks and balances you'd put on any junior before they implemented something for your clients.
One of the big marketing angles for ChatGPT and other generative AI models is that it's like a McKinsey 2.0. It delivers those reports, that framework and that thinking for you. But are you comfortable putting your business name or your business recommendations to that unchecked?
Tom: I think your reference to AI as a child is a good one, because AI is not quite where it needs to be to take ownership of some of these things that people perhaps think it can. I definitely think it'll get there, though. It's moving very, very fast, so we can start thinking about it as a teenager, and then as a grown-up.
So it's about building our businesses to be better equipped to address those risks, because they're going to change very, very fast. Once that child AI becomes a teenager and a grown-up, it will be much more powerful and much faster. If you unleash a business operational model now that doesn't consider those future gains, you could be opening yourself up to other exposures.
Katrina: Well, hopefully the AI gets through those teenage years pretty quickly. Just another point I wanted to mention on that topic: we're seeing emerging regulations around the ethical use of AI, particularly the EU's AI Act. That's something underwriters will consider down the track as those regulations roll out: how well companies actually comply with them, and the potential liabilities if they're not complying. So that would definitely be a consideration from an underwriting perspective.
Justin: While we're on the AI underwriting piece, Timothy has a couple of questions. I'll go to the final one first, around AI exclusions. Are we seeing AI exclusions appearing in underwriter policies already? Are they already in there, and is there a trend of more AI exclusions being put in place? Can you talk to that, Tim, and Katrina perhaps?
Tim: Yeah, I've seen it with some historic PI policies. The thing you've got to understand with an insurance policy is that the wording, the legal framework the policy is built on, is typically written every four to six years. They're quite expensive documents to produce, and the landscape four years ago is very different to where it is now.
One underwriter jumps to mind where it was at the top of their exclusion list: they said their appetite wasn't for businesses doing AI work. They don't do gambling, they don't do adult services, and AI fell onto that list previously. Now, as wordings change, I've seen that removed, because it's more common for people to be doing those activities. But because the cycle of insurance is slower than the cycle of technology, we do see a mismatch between policies written this year and those written four years ago.
So that's about us selecting the right policy for the right client and making sure it's fit for purpose. The good thing about the insurance market is that it's actually very large. There are a lot of providers and a lot of competition, and typically we can find homes for all natures of risk. Sometimes it just takes a bit longer and requires more detailed conversations.
Justin: I'll go into underwriters' use of AI in a second. But Timothy did make a good point that he feels he needs better communication with underwriters, because a couple of his customers are with Emergence but had no idea about the GRC tools and the additional capabilities you provide. So again, that open ecosystem model of leveraging capability across the providers we use as MSPs is pretty critical.
On underwriters' use of AI, the question here is that there seem to be some inconsistencies around premiums and the calculation of premiums. Do underwriters use AI or automated tools to work out premiums, or is there more detail behind the scenes that goes into putting these premiums out there?
Katrina: From our perspective, there are individuals who underwrite the particular transactions. We do have an online portal where brokers can populate the risk information, and we've got a risk matrix and pricing matrix associated with those responses. From an AI perspective, there are other markets using AI to assist with the underwriting decision process and the pricing process.
I think it's one of those things that needs to be handled in collaboration with an individual decision making process, or the individual underwriting process, because AI can produce false negatives or false positives depending on the situation. It's one thing to use AI to make the decision, but it's another to actually understand the profile of that business, and not just the profile, but how they handle their risk, what their behaviours are and what their tolerance levels are. That goes a long way, and you can't get it out of these sorts of AI tools.
Tim: To that point as well, one of the big bits of advice we always give our customers is don't be limited by what the broker asks you. If you're doing things over and above, with risk controls, good policies, procedures and frameworks, make sure you share that with your broker to share with the underwriter. The better your business looks from a risk point of view, the more the individual on the other side can assess it manually and make considerations or price adjustments.
With that exclusion list I mentioned, for example, gambling is a big one, but I have a number of clients that run gambling networks and ecosystems that are accepted because we've explained the controls and processes they've put in place. So they do get accepted by those insurers. But don't just tick and flick the forms and expect somebody to come back and want the risk. You've got to present it well and show that it's considered.
Justin: That's a really good point, and Tom, perhaps you can speak to this as well, but I think MSPs in that scenario might be too frightened or concerned about oversharing the controls and policies they have in place.
Tom, coming back to the AI piece and the increased desire to have AI in our businesses to drive efficiencies. In the discussions you're having with your customers, how are you guiding them through this AI journey, where it fits, where it doesn't, and the considerations they need to make from a risk perspective?
Tom: Looking at it from a risk perspective, we take a relatively practical approach on the things we can control. I think the risk around what AI can do from a cyber breach perspective is still very early days. Unfortunately, I don't think the market can really respond until we see some of the breaches, the ramifications they have and how they're done. That's from an insurance perspective, an underwriter's perspective and, of course, ours, in how we proactively protect. So that's largely an unknown, because it's yet to occur in a large scale way.
But there are some things we're concerned about from a practical perspective, and we're having a lot of conversations with clients about them. We're seeing a lot of buzz around AI in general, Copilot and the general AIs, and I think their effectiveness in large scale use in a business is still somewhat limited. Where we are seeing AI gain big traction is in very particular use cases. There are a number of organisations coming out with AI for various things. To give you some examples, AI booking platforms for restaurants, and business process automation in law firms and property companies. They're specialist AI tools, probably leveraging the big platforms, but with a custom flavour.
People go into these things because they see the efficiency gain very quickly, and we're seeing that in some of these custom products, but they're heading into it a little bit too quickly. So we're trying to, honestly, put the brakes on, or at least have a conversation with these providers about where the risk is and where the data is heading.
Here's a good example. There's a big risk I perceive where an organisation collects customer information and then uses a number of third party tools, and this doesn't only apply to AI, whether they're CRMs, these AI booking platforms or the business optimisation companies. A customer hands their information over, and then that business hands that information to a third party, unbeknownst to the end consumer.
The business doing this really needs to ask about the protections in place when they're dealing with this AI and the information they're handing over. Where is the data being held? How is it being secured in transit? I think it's the responsibility of the MSP to really ask these questions and unpack that, because they should be asked and they can be controlled.
As business owners and employees, we all scroll through the terms and conditions of these organisations as quickly as we can to hit the accept button and get these tools into place. We're suggesting you don't do that. At least engage someone like us to look at it and see where the risk is. That's something you can control. The ramifications of AI, and of data getting into the wrong hands, remain to be seen. I think there are some instances occurring in certain industries. But that's one area we highly recommend our clients and partners look at, because I think it's really important.
And of course, there are changes afoot in a lot of government policy for small and medium organisations, in the Privacy Act and other areas, around businesses having to notify. If you've done your due diligence, asked the questions, and a breach occurs where you have a regulatory requirement, you can leverage the capacity the insurers have, and people like Tim, and that whole ecosystem that can support you. You can say with some confidence: we've had this breach, but we did go through this long due diligence process and we did ask the questions. If you haven't done any of that, you've got financial risks, you've got all sorts of risks, but ultimately the reputational risk is something that can fold a business.
Justin: That poses an interesting question, particularly in that scenario where you've taken some client data as the end customer and you're then leveraging AI, or to your point, it could just be a third party tool of some sort. If there's a breach somewhere in that supply chain and the client data gets leaked, from an insurance or protection perspective, who's...
Tim: That's a great question. Whose data is it, and whose responsibility is it? I've been across a couple of claims recently where I couldn't answer that. So we've gone to the underwriters and asked the question, and in some cases the underwriters then refer it to legal professionals to actually demarcate: this is the responsibility of this policy, and this is the responsibility of that policy.
I had a unique pre-claim situation with a health provider that was handling data for a state health department. The state health department was trying to put the organisation on the hook for 20 million customer records. Through work with Emergence at the time, we broke out what was the client's responsibility and what was their customer's responsibility. The reason was that if they had to insure for 20 million records, the premium was astronomical. But we were able to break it down with the insurer and say: the cloud co-hosted data is a shared responsibility, but the on-premises data is clearly not the provider's responsibility, it's the state health department's.
That enabled them to contract ahead of time and be very clear on whose data is what, and whose responsibility, before there's a breach. I think that's a great way to sometimes use the underwriters as an arbitrator before an event. If you can't get insurance for it, chances are it's not covered. But if you can get insurance for it, then you can comfortably contract for it. So that's a way we use underwriters to help resolve that before it's an issue.
If you do have an issue and it hasn't been resolved, the best scenario is that both parties hold cyber insurance, so you can trigger those policies and the lawyers then work for the insured, in their best interest. This is something some people don't realise. The lawyers who respond when a policy responds don't work for Emergence. They're not working in Emergence's best interest, they're working in the client's best interest.
That sounds a bit basic, but sometimes people think the lawyers are there trying to get out of the claim. In our experience, every claim we've been involved in has been valid, paid and managed really well. So, to dispel some of those insurance myths: I hear "they never pay" thrown around all the time, and it's definitely not the case in our experience.
Justin: Anything to add to that, Katrina?
Katrina: Yeah, it's quite an interesting topic, and I think supply chain attacks, or supply chain risk, is quite top of mind. You think of malicious attacks like SolarWinds and Kaseya, and then non-malicious ones like the CrowdStrike outage. Insurers are now placing more emphasis on coverage around third party risks, and businesses really need to consider how robust their risk management and vendor management processes are. I think we'll start to see a lot more emphasis on supply chain risk in the cyber insurance space.
Justin: So would you say that for a partner MSP thinking about cyber insurance for themselves and for their customers, proactive engagement with an underwriter, or through a broker like yourself, Tim, to really understand who needs cyber insurance and for what, is pretty critical to delivering an outcome for their customer?
Tim: Definitely. One of the things we ask our customers when we're onboarding them is: what are your big three risks, or what are the events that scare you? It's really interesting when businesses like All IT answer those questions, because sometimes the answers surprise you. We can then use that to go to underwriters or the market and say, we're trying to cover these risks off. They're not always consistent. The big ones are data breaches and ransomware events, but sometimes there's nuanced risk that comes from unique customer sets as well.
So if we can unpack that properly, it helps. An example I gave at a round table a little while ago: some very large customers were saying they use their balance sheet to cover their cyber exposure. I was talking to them about ways they could reduce the cost by having very large excesses, while still accessing the panels of those specialists, to reduce the cost of the cyber insurance program.
If you figure out what you're trying to achieve with cyber insurance, you can craft the right policies and programs and address the needs of the business, not just tick a box and get cyber insurance, but deliver a policy that works well with your incident response plan. The insurers have amazing incident response plans, but sometimes you might want your own internal plans to override some of that. Sometimes you need to validate that it is a notifiable breach before you call the insurers. Those things are really important to set out as well, and the due diligence around getting insurance can sometimes uncover all of those elements.
Justin: Tom, from your perspective, is that proactive engagement within the ecosystem something an MSP can monetise, or is it more a risk reduction exercise for partners, do you think?
Tom: I keep saying education, but it's a long journey to monetise that. It's a long journey of education in terms of setting expectations around the services you provide. I think a lot of MSPs fall into the trap of thinking they need some sort of security product. Then all of these things change, and all of these services just keep getting lumped into their standard package. This space is changing rapidly, and all of a sudden, in terms of hours spent or products used to service the client, it's gone way over. That can happen very quickly, and if you're not tracking it, it can become a very big cost to the business.
So how do you change that? Again, through education with the client and setting expectations around the services you provide and what's included. Through that education the client understands: you're receiving these services from us as your MSP, but if you acquire X, Y and Z, these are the costs associated with it.
We take the perspective that very frank, open and transparent conversations are the best method with clients. This doesn't need to be smoke and mirrors to work out what is and isn't included. But they can be uncomfortable conversations. Generally, as MSPs, everyone is out to service the customer the very best they can with the resources they have. It's not a matter of ripping clients off. It's just a matter of having frank conversations around what you do provide and what's not included.
At the end of the day, if you're having those conversations, the client is then looking at it as a risk from their perspective. Do they take on the services you're recommending or don't they? It's like insurance: what level of coverage do you want, and what's your excess? Those are decisions the business owner should make. We shouldn't be making them for the client by staying silent. If they're aware, then it's their decision, with the options given to them.
Tim: We definitely see that with the more mature MSPs. They don't feel they have to do everything for the customer. They're more inclined to be an advisor in some instances and say, look, we might do 50% of these services, but if we see a gap or a risk in your program, go and talk to a good GRC supplier or a specific implementer, or actually carve out those areas. We see that as a great way for an MSP to de-risk its offering as well.
When we look at legal contracts, it's really important to call out what you do for a customer, but also be very specific about what you're not doing for them, so they don't perceive you as the only port of call for those services. That's good protection for professional indemnity as well, to show that you're not the one-stop shop for everything, that they can get these other GRC services from other providers, and that you've recommended that to them.
Tom: A good point to add to that, Tim, is that we're seeing a large trend, particularly in medium sized organisations, and I know the definition of that is a little grey. Medium sized organisations that have their own internal IT department are moving away from dedicated IT departments towards a hybrid approach with MSPs, or to MSPs entirely. Some of the reason for that is, to Tim's point, that mature MSPs can offer a really trusted panel of providers, whether that's insurance or specialist security. The MSP might provide 50 or 60% of the service, but they have a panel they work very closely with.
Again, "ecosystem" is a bit of a corny term, but it's really important that everyone's working in harmony to provide the services. You can't be everything to everyone, and if you try, there's an inherent risk in that, unless you're a very large MSP with many hundreds of employees and specialised departments. Even then, we're seeing those MSPs break out and use specialist providers, whether that's ISO implementation, as Tim mentioned, or other areas. So I think there's an advantage in that, and again, being transparent with the client, and that's okay.
Tim: I lean on that a lot as well. If I'm taking an end customer risk to a provider like Emergence, I love to share that they've got a professional IT organisation managing their infrastructure, plus they've looked at other third party consultants or have those services in house. We find we get a much more mature conversation with the underwriter at Emergence, or others, when we articulate all of that. That's my transparency point.
Justin: What's also interesting, tying back to the open ecosystem piece we keep talking about: when I was at an MSP a decade or so ago, I was speaking to an IT manager who explained that his role had evolved from fixing stuff, hopefully not breaking stuff, to procuring services from external providers to deliver a service to his internal company to make it run. It sounds like MSPs need to start thinking with that mindset: they're not just the people going around fixing things, they're procuring services from that ecosystem, including underwriters and brokers, to deliver an outcome for their customers.
Tom: I couldn't agree more with that, and I think it's only going to change more with the AI piece. You're becoming a trusted advisor and a consultant around all of these things. We're probably talking about medium sized businesses and above, and the MSPs that service that market. There's still very much that reactionary service, and there always will be. But for MSPs that want to grow into that space and have structured solutions, it's about becoming an advisor to those clients, not only around risk, but around how businesses can run more efficiently as well.
You see the MSPs that are expanding at rapid rates certainly heading in that direction, rather than the reactionary approach that's solely around the tech, and having the MSP involved in important conversations within these businesses. For organisations that aren't used to it, you've got to inject yourself into those conversations more often than not, because they don't know what they don't know.
Tim: We see insurance as a great way to inject yourself into those conversations, because clients come to you to complete their forms. It's a great consulting piece to be able to say, we can't just tick and flick these forms, we actually have to step you through them. Take MFA as a basic example: we provide MFA on these three platforms, but we don't manage your CRM and we don't manage your accounting software. You need to go and verify that all of those platforms meet those requirements, because quite often the forms aren't granular enough to reconcile all those different areas. So that's a great consulting opportunity.
Justin: That's another good segue, Tim. You've been doing well with the segues today. One of Timothy's questions is around actually filling in those insurance forms. His question was: should an MSP not be filling in their clients' cyber insurance forms, but providing their own document of...
Tim: Absolutely. Don't fill them in. We cannot say this enough. To use the basic example of MFA: if you're an MSP and you check the operating systems you provide for your customer, tick MFA and send that back to them, they submit it to their broker, who sends it to Emergence. Then they have a claim, and it turns out the claim came from their CRM or their Microsoft 365, some area outside the MSP's responsibility. The customer could have a valid professional indemnity claim against you, saying you gave them advice that was wrong, and they could draw you into a claim. Professional indemnity is the protection for bad advice or perceived bad advice, and that perceived bad advice could be confused there.
So we very much advocate not completing those forms, for that granular reason, and stepping the customer through it instead. It's their data and their responsibility, and they have a lot of vendors that sit outside the MSP contract as well. We've done an MFA checklist for our customers to help them get across that. MFA is such a basic one, but if you apply that example to the many other technology platforms in the business that sit across that form, it dials the customer in to the fact that this is their responsibility as well.
Tom: Just really quickly on that: obviously the client is coming to you to gain some validation around the protections in place. So as an MSP, I feel we can't not answer the questions. But the way we approach it for managed clients is to provide two answers to, for example, the MFA question. We provide the history of protection on the organisation, which gives some validation that the protections have been in place historically. And we provide some validation around the controls and policies in place to maintain that moving forward, for the platforms we manage on behalf of the customer.
That's rather than saying "yes, they're covered" as a blanket answer for every platform. Even if you say yes for Microsoft 365, that's great, but how are you as an MSP going to cover the case where a junior engineer, again through human error, accidentally turns the MFA policy off or leaves someone in an exclusion group? I'm not sure whether we've validated in a legal sense that this is the best level of protection. That's probably best answered by Katrina. But we provide that historical context and record, and the controls and mechanisms in place moving forward.
Katrina: Yeah, those are really good comments. One thing we like to emphasise is that if there's any confusion, or if the insured isn't sure about all the protections in place, then, to Tim and Tom's point, there will be things the MSP handles where they can advise what is and isn't in place, and then there are all the other systems or programs. In that case, definitely err on the side of caution when completing those proposal forms. I think that gives you the best outcome when there is a claim scenario.
A lot of the time, most insurers will still offer insurance depending on the yes or no responses to those questions. So consider how you want to respond, and make sure you're comfortable that what you're providing is accurate, or if it's not, err on the side of caution and potentially select no.
Justin: So, to summarise: don't just tick the box.
Tim: Don't just tick the box. Absolutely. It's never as simple as that.
Justin: And I'm sure most partners aren't doing that, but their customers could be. So it's certainly a conversation to have with their customers.
I'm mindful of time. We've got five or so minutes left. Firstly, I want to thank the three of you for coming on, because you've shared untold knowledge bombs today. It's been really good, and I think MSPs watching live and on demand will take a lot of value from the considerations and advice you've shared.
Before we go to the final Q&A with Sean, actually, we'll answer this question first. Is providing a WISP adequate? I have no idea what that acronym means. Tim or Katrina, I'm hoping you know what that is and can answer the question.
Tim: Have you got an explanation? What is a WISP?
Justin: The question is, "Is providing a WISP adequate?" So I have no idea what that is. Sean, you might need to provide a bit of clarification on your question. You're making us all feel stupid here. No, I'm only joking. Before Sean provides a bit of clarity, guys: a written information security plan. There you go.
Tim: There you go. That makes a lot of sense. We're an industry full of acronyms.
Justin: Too many acronyms.
Katrina: Yeah, having any sort of preparation is absolutely critical, particularly when we talk about incident response plans and acting when there's a crisis happening. Whether just having a plan is adequate, I'd probably disagree. I think it's having a plan, but also making sure everyone in the business is aware of the plan, testing the plan and reviewing the plan. There are a lot of other elements that need to go into it, not just having a plan.
Tim: Yeah, tabletop exercises are really important to be able to test those plans as well. Even with very basic plans in very small organisations, have some steps up on the board: who to contact, who makes the decision, who the insurer is, who the broker is.
I heard a few great tips at a seminar recently. You need to have, in the bottom drawer, the five or 10 pieces of information you need at your fingertips during a breach. A backed up copy of your customer database that's always accessible. The communications list. You can talk to your broker about what would be required in the event of a claim, or what the lawyers will ask for as that first communication step. So it's about pre-empting some of those things. They're quite basic, but having them at your fingertips ready to go matters.
Have the plan on the wall, make sure everyone's aware of it, and talk about it regularly. Chances are a claim or a breach will happen on a weekend, a public holiday or over the Christmas period, when people's phones are off and they're not contactable. So if you can't get hold of the seniors or the manager, what do you do? Making sure the entire organisation is across those steps is really important.
Tom: Sorry, Tim, I was going to say, just extend that to boards. We do quite a bit of work for not-for-profits and medium sized listed organisations that don't necessarily have CTOs around. What I'd add, and what should be explored, is the responsibilities of directors and boards that are coming into place under the Corporations Act, which is changing in a big way. But also education from a board perspective about what occurs, or could potentially occur, in these situations, and tabletop exercises from a board perspective. Again, it comes back to education.
Boards are generally constituted with varying skills in varying areas, to make up a really strong board, and not everyone on the board has strong cyber knowledge. So we're seeing that as a really big requirement: keeping leadership teams and management accountable in the right areas for their response, should something like this occur. It's not just the responsibility of leadership and the organisation. There's a responsibility on the board to keep the organisation accountable during a time of crisis. And we have seen this: doing that on the fly during a breach is not the time to be doing it.
Tim: Just one point on that. Policies like Emergence's have a 24 hour, or in some instances 48 hour, no-claim style advice period. They want you to call them straight away. They want to jump in, and they don't want you to sit on the breach. They do that so they can get in early and reduce their costs, but if it turns out to be a false alarm, there's no issue. It doesn't affect your future premiums. So having a culture of reporting is really important as well, because if they can answer three false inquiries and then deal with the real one, your policy is better structured. So, as a takeaway, don't be afraid to call the insurer.
Justin: Yeah, and to your points as well, those tabletop exercises are invaluable. We run them for incident response with our partners, and sometimes their customers, and the chaos that ensues in what's essentially just a game is very eye-opening, for the customer and for the partners. So I couldn't recommend those tabletop exercises enough.
Guys, we've come up to time. We've kept all three of you for far too long, and I really appreciate your time. Before we go, if partners watching live or on demand want to reach out for some advice or just to engage with you, where can they find you?
Tim: Find us on LinkedIn. I'm always there, and I love a chat. Send us a message, or reach out to any of the other partners on the call here. We can pass our details around.
Justin: So it sounds like LinkedIn across the board. Perfect. Katrina, Tim, Tom, I really appreciate you. It's been excellent. Like I said, knowledge bombs for the last hour. I think whoever watches this is going to get a lot of value from it, so we appreciate it, and thanks to those who were live and asking questions. Thanks, everyone. See you, guys.
