Tim Stephinson from SherpaTech and Scott Hesford discuss the nuances of cyber insurance for MSPs and how BeyondTrust can help improve your risk profile.
Featuring: Tim Stephinson (SherpaTech) and Scott Hesford
Length: 41 minutes
Key takeaways
- Tim explains that cyber insurance is far less standardised than professional indemnity: cover levels vary greatly between policies, so you need to unpack what is included, starting with the exclusions. Ransomware exclusions and ransomware co-insurance are now the main ones to look for.
- A cyber policy is predominantly first-party cover for your own incident. The third-party section mostly means defence costs, not your customers' incident response, so tech businesses need both cyber and PI cover operating together.
- Tim shares a claim where an MSP hit by ransomware could not deliver contracted services and two of its 50 clients made claims. In another case, an MSP's contract that limited its liability was thrown out under unfair contract terms, which is why he suggests sharing your contracts with the underwriter ahead of time.
- Scott points to IBM figures: 16% of breaches involve privilege misuse and another 16% involve stolen or compromised credentials, and it takes an average of 277 days to detect and contain a breach. He says removing local administrator rights, applying least privilege, using MFA and keeping visibility of what happened are controls that address these directly.
- Tim says not to keep your controls a secret from your insurer. A report showing how admin access rights are managed can give the underwriter a reason to reconsider a ransomware exclusion, and for questions like "Do you have MFA?" you need tools that can prove the answer, as if you were defending it in the witness box.
- Insurance should not be left to renewal time. Tim recommends a half-yearly conversation with your broker, notes the cyber market is now softening, and expects Privacy Act changes to reach the roughly 95% of businesses currently under the $3 million turnover threshold.
- Scott recommends BeyondTrust's cyber insurance checklist at beyondtrust.com/cyber-insurance, and Tim offers a complimentary insurance health check for Westcon-Comstor customers.
Transcript
Scott (BeyondTrust): Just a little bit about BeyondTrust before we get started. BeyondTrust are the leader in identity, access and security. Basically, our vision is to protect identities wherever they are from cyber threats. Probably enough about us.
So I just wanted to talk about some of the trends that we are seeing now. All of these are from the IBM data breach report. There are a number of reports, which are fantastic. The IBM one is where these came from. There's also the Verizon one, which is worth checking out as well.
Some of the big things here: the average time to detect and contain a breach is actually quite alarming. It's 277 days from the moment the breach actually starts. And all of these things here are, I guess, contributing factors into what we're going to talk about next, which is premiums and how they're affected by these particular things.
The average cost of a data breach in Australia is $2.7 million, as an example, and you've got all of these other things that contribute to that. Now, those are global stats, so they're a little bit different to ours. I think it's the percentages that are the big things here. So 16% is leveraging privilege in some way, as well as another 16%, which is based on stolen or compromised credentials.
There's been any number of breaches that have used a combination of those, together with an external pathway. It could be a cloud misconfiguration, just different ways into an organisation. And that's really where privileged access management, third-party access management and the things BeyondTrust can provide are really helpful.
Tim Stephinson (SherpaTech): It's interesting, Scott. On that, we see a lot of our clients having issues come from multiple different data sources or breaches where the bad guys piece everything together. So it's not just one piece of information, it's that cumulative effect of multiple data breaches leading to multiple attack vectors.
Scott: Yeah, that's actually exactly right. What you'll find is that when an attacker gets into an environment, they'll start to move laterally into all different systems and attack in different ways. So that's where different levels of protection within an organisation can really help minimise that, and make it easier to pick up in the first place.
Okay. So just some stats on the actual amount of ransomware that's been out there. I think the interesting point here is that it's a growing industry, and when I say industry, that is how it is almost treated. Cyber crime is a growing problem that we do have. It's not going away unless we as organisations do something about it. It's just going to continue to get worse and worse. So cyber insurance, yeah, it's great to have it there, but we still need to have those protections in the first place. I know, Tim, we...
Tim: We talked about that a lot as well, because cyber insurance isn't like car insurance, where you throw the car to somebody else and they fix it and give it back. There's a lot of things that need to happen in that people, process and technology piece before insurance kicks in. And we talk a lot about the stack and what exists beforehand.
That's the reason why, in many cases, people can't get insurance now: the insurers are actually assessing risk a lot more thoroughly, and they're really understanding what customers have in place. I know it's a huge source of frustration for many of our customers, but the insurance questionnaires are ballooning to such a point that they're beyond ridiculous in some instances. What you need to understand is that the underwriter is trying to understand as much about a risk as possible.
So one of the things you can do to help yourself in that situation is actually bubble forward your security posture, any ISO compliance, anything else that you do, in advance of filling out that questionnaire. You can actually have a renewal program where you address a lot of the risk factors that the insurers see as negatives before you get to your insurance renewal. And I think that's obviously where BeyondTrust's suite comes into play.
But in many instances now, ransomware is excluded from insurance. And people say, "Well, then why would I have insurance for cyber if it doesn't cover ransomware?" But there are nuances that we need to unpack in every particular instance there.
Scott: All right. Just going forward, let me know when you want to go through these.
Tim: Absolutely. So I suppose the starting point for us when we talk about cyber insurance actually has to be professional indemnity. Professional indemnity covers the advice you give that leads to financial loss for customers, clients or people you're doing work for.
A little bit of a backstory is that cyber insurance, up until about five years ago, used to be part of professional indemnity. Now, professional indemnity as an insurance has been around hundreds of years. It's tried and tested, and it's a very stable insurance class. So we could get one policy from Chubb and another one from QBE, and the wordings are very, very similar. There are a few things where they will differ, but by and large, they are very similar.
When it comes to cyber insurance, we talk about it being the pimply teenager. It's only been around a couple of years, it doesn't quite know what it is, and the cover levels vary greatly. So we could have one policy that does first party only, and another policy that does first party, third party, crime and social engineering. And we're really advising our customers that you need to unpack what is included in cyber insurance.
We have some areas at the moment where, contractually, people are now starting to understand that it's a risk mitigator to actually encourage their clients to hold cyber insurance. And when that happens, you've got to get the levels right as well. We say cyber insurance used to be the insurance we couldn't sell. Now it's the insurance you can't buy.
And so in order to buy it, you've actually got to really improve your organisation's risk profile, and not just tick boxes on a form, but actually show the underwriter that you have a maturity that will be able to defend against attacks and those other vectors. Because insurers are now just saying, if you don't have these things, we don't want you. And if you can't get insurance, then you can't deliver on those contracts either. So that's just a little bit of background about how we got here.
So what do we try to do when we're unpacking these insurances? The quick go-to is exclusions. This is the area where an underwriter will particularly call out areas of a policy that it doesn't cover, so we look at that first. The main exclusion we're seeing now is ransomware exclusions. We're seeing it with a couple of underwriters, where they're now doing co-insurance or total ransomware exclusions. What that means is if you get a ransomware attack, you may not be covered.
So it's important to understand that if your people, process and technology get breached and you are wanting to rely on insurance, there can also be gaps in that insurance. You may then need to mitigate those with either your balance sheet, being cash, or by revisiting the stack and actually bolstering up the security protection stack that you have in there. And I think that's where PAM really plays a big role, in our mind. About three years ago, everyone started to rush to put MFA on the insurance applications. Now we're seeing more appetite from the underwriters for what is next after that.
The other one is changes to the Privacy Act. We'll speak to that a little bit later as well, but we're seeing that that'll be the next big wave, I think, of drivers for people to invest in the tech stack. When it comes to the Privacy Act, currently it only touches about 5% of businesses because of the $3 million turnover threshold. So there's another 95% of businesses that sit below that $3 million turnover that, we believe, the changes coming to the Privacy Act will now include.
The last one there is cyber crime and social engineering. This is an optional extra when it comes to cyber insurance. When we look at a cyber insurance policy, it's predominantly first party, and this is a big confusion that a lot of people get tripped up on. It references third party as a cover area in many cases, but that's defence costs, not actually your third party's incident response. So every business that holds cyber insurance holds it for their own incident, not for their customers. And their cyber crime and social engineering cover is their first-party cover, not their customers'.
That's probably the biggest one that we find people get confused about, and it's actually a great opportunity to talk to your customers about it. So if you're an MSP or a tech provider, you can ask your customers about their cyber insurance cover, because it's their first party. One, you want to know how you dovetail into their insurer's response plans, their insurer's incident requirements and those sorts of areas. It's a way to look under the hood and actually help your PI by bubbling these things forward to your customers. So I've rabbited on a bit there.
Scott: Yeah, there's also, I mean, for third parties as well, because you've got CPS 234 and those kinds of things. So you're actually finding more and more compliance statements coming through, which I guess align with what the insurance requirements are, in a way.
Tim: Yeah. And we are seeing the insurance proposals now aligning more to known standards. Obviously CIS, NIST and ISO 27001 are the big ones. If you can look at some of those compliance standards in advance, insurance renewals become a lot easier, because you're already compliant in some of those big areas of data management and risk.
Personally identifiable information, or PII, or personal health information for the health businesses out there, is one of the biggest costs in a data breach: obviously to inform and comply with that. And so a big misinterpretation of cyber insurance, I suppose, is that it's a technical insurance, whereas the breach mitigation is a very small component of it. It's more communication specialists, forensics and legals, and that's going to become a higher requirement as well with increasing fines and penalties. So again, understanding what's in that policy and what as a business you want to lean on is a really important component of risk management.
So this is just a quick one: everyone loves a war story. We've been through a lot of these with some of the legal firms that do the mop-up post an incident. And this is a very common occurrence, and we've seen a lot of these in the US as well, where an MSP has suffered a ransomware attack. In many cases the cyber policy, if they hold it, will respond to protect their first-party incident. But it's also really a professional indemnity claim, because they're unable to deliver services to their contracted clients. So there are a number of things they can do to protect themselves here.
In this particular example, they were actually very good on the communication piece with their clients, and they got ahead of it. However, the MSP was unable to deliver contracted services, and so two out of the 50 clients then made a claim. Wotton Kearney was the law firm in this case, and they are still dealing with the mop-up.
What typically happens is the law firms draw in all the third parties. That's where you need these cyber and PI protections, because the two covers actually have a grey area in between and they overlap. So in some of the larger risks, we like to see them under one provider. It's not an absolute must-have, but it's a nice-to-have. But you definitely need both these levels of cover operating in the tech space.
The next slide is actually a learning from an incident where the client of the MSP was breached, and the MSP leant back on their contract, saying, "We've limited our liability in the contract, so we actually don't have this as a requirement to resolve." But the contract's been thrown out due to unfair contract terms. This is something we see on the smaller side of MSPs, where they think they can insert something into their contract that limits their liability, and we're seeing more and more that that's just not allowed under unfair contract terms.
So what we like to do in this instance is, if you have a contract, share it with the underwriter ahead of time and seek their input. We're not lawyers, by the way, we have to give that disclosure. But we like to bring all those parties together where possible, so that in the end, in the event of a breach or a contractual issue, we have all those parties aligned as to what the real expectation is in that situation.
So I've gone on for a little bit there about insurance, but what are you seeing, I suppose, on the cyber side from a privileged access management point of view, Scott?
Scott: Yeah, actually this one's really interesting. On the left you've got the number of data breaches and privacy incidents, and on the right-hand side are the changes to the premiums. So you can see they're actually very much related to each other.
The very next slide is actually Australia. This is from September last year, from the Actuaries Institute. Interesting points here: your big blue bubble is essentially the gross amount of the actual premiums within Australia, so $53 billion in premiums. The little red one, at $0.2 billion, is for cyber specifically. And then when you compare that back to the actual reported cyber losses, you can see there's a massive discrepancy there. Cyber makes up such a small amount of the actual premiums versus the amount of losses. And what that would actually mean is that someone's losing a lot of money here.
Tim: Look, in this case it's the underwriters. A lot of them have walked away from the market for this reason. As a global statistic, cyber insurance markets paid out 120% of their premium pools last year. That leads to a couple of things. They restrict cover, so that's where they exclude ransomware and take all of these things out of policies, and they raise premiums. And we need these markets to work, because they need to be there as a backstop, but the loss ratios are just way too high currently.
It is interesting: these markets move very quickly. At the beginning of the year we were telling everyone, it's a hard market, you can't buy cyber, and the prices were rising. With many of our customers now on renewal this year, we're seeing a stabilisation of those rates, because those losses have been stemmed by the restriction of cover and also the improved health of the businesses within those pools. So the insurers are not giving out premiums now to people who don't have the right mitigators in place. Whereas five years ago, when we couldn't sell cyber insurance, they would take any premium to build the value in that pool.
Scott: And the interesting part is that this continues to grow and continues to be a problem. Cyber insurance organisations, those providing that coverage, will naturally be looking at ways to tighten. If we go back to pretty much the second slide, it had the stat of 16%, I believe, for compromised third-party accounts and credentials, and another 16% for privilege misuse. These are two things that we actually do have control over to a certain extent: we can implement controls via software. That's where BeyondTrust comes in, and where we can help organisations. So I would very much expect that cyber insurance will really tighten up on that kind of thing. If you want coverage, you're not going to have a choice. You're going to have to have someone who's managing your credentials properly.
Tim: Yep. The interesting thing is, like we saw with some of those previous claims examples, insurers are really good at finding out what's happening in the market, because as soon as they lose money, they change things in their frameworks. If a particular underwriter suffers losses because access management is an issue, they will actually tighten the controls in their particular risk pool. But then you could have another underwriter who hasn't suffered those same losses from that cause, and they won't really focus in on that area. So the different pools react with different requirements, and that's where we as a broker come into play.
But we're seeing it consistently across the board now, especially on renewal. That's when an underwriter will send a new question set out and say, "Hey, we now expect this as a minimum, and if not, that'll raise the premium." So what we like to do is talk to people about not assessing insurance and controls like this just at renewal time. It's really good to have a half-yearly meeting with your broker and say, "Hey, we are doing all of this internally. Go talk to my underwriter and find out how that's going to help our premium," because it will turn.
Insurance markets are cyclical, and we're seeing a softening of the cyber market now. That will lead to a fall in premiums, because you will have an improving risk market and more players will come into it. One thing that's actually interesting about that slide with the tiny red dot: we see that with traditional non-tech clients, probably 20% of them hold a cyber policy now. In the UK, where they align to GDPR, 60% hold a cyber policy. So that shift with our Privacy Act changes will actually see an uplift in the cyber market, higher supply, and then a greater chance of increased cover as well as better premium costs.
But you've got to be participating to be aware of that. You can't just say, "Oh, it's too expensive this year, don't worry about it." Keep getting proposals from your broker and keep finding out what their appetite is for you as a risk. I think that's a really big one, because otherwise you'll end up with a client or a contract that needs it, and you'll have a very short runway to get it. So these things need to be planned.
Scott: Okay. So from our perspective, there are a few things that we can certainly do, linking back again to the stolen or compromised credentials and the privilege misuse. So let's actually dive into some of the controls.
First off, actually getting visibility into what you have. BeyondTrust offers several different solutions on this front, for actually being able to scan environments and finding out what you can do to secure your environments. So that's quite an important stage: to actually know what you've got.
The second thing is to start aligning to the principle of least privilege. This is otherwise known as zero trust, where every operator, and I say operator because it could be a person, it could be an API, it could be a script, it could be literally anything that's using a privilege within an organisation, is always verified, and you never trust that they are who they say they are. So that's an important thing to start off with as well.
You then need to make sure that nobody has excessive admin privileges. What I mean by this is, it's quite common when we speak to potential or existing customers to say, you know what, we need to make sure that you do not have anyone logging on as a local administrator. This is particularly prevalent when it comes to ransomware. If you have someone who is a local administrator opening up attachments or browsing the internet, then you're actually doing half of the attacker's job for them. It is much, much easier as a ransomware attacker to go into an environment where someone is already a local administrator.
Tim: This is a really good point though, Scott, because in my day-to-day broking, I take a proposal through to an underwriter and they come back with a policy that has a ransomware exclusion in it. They say, "We don't want to touch ransomware." I don't accept that as a fait accompli. If our client was operating BeyondTrust, I'd go back to them and say, "Hey guys, can you give me a report that shows how your admin access rights work? Because I want to give that to the underwriter, so they might consider removing that ransomware exclusion because we have this control in place."
It's a simple example, but it's one where I think if people understand why the insurers ask a question and what that leads to, you can then insert things into the proposal that give you a better chance of having wider cover.
Scott: Yeah, absolutely. So this is a really good one, I think. The other point there is that a lot of organisations see that as something that's really difficult to do. And for all of our viewers and listeners out there today, if this is one of your challenges, you are not alone. Particularly if you have developers in your environment, it can be a big issue. Where we also see it is in legacy environments, where you have older software that requires local administrator access to actually run. That's another use case that we help organisations with.
We had one local government customer that had several thousand local administrators within their environment. We partnered with them and managed to clean that up within a week. The C-levels of that organisation actually came back and said, "Have you guys done this? Is it done? Because no one's complaining." And that was considered a massive win. That's one of the really big bonuses of where we can help customers with this one, and it's constant feedback from our customers that this is a big thing we can help with.
Tim: Yeah. But don't keep it a secret. Tell your insurer about it, because it'll benefit you. That's my point.
Scott: Yeah, exactly. We tend to be very cagey about the controls that we do have. And I guess, back to your point, it probably helps to be more open with our insurers than it does to be public.
Tim: Yeah. At the C-level, you want a good link between your CTO and your CFO for that reason.
Scott: So the next one: you mentioned multi-factor auth earlier. It's not a new control, and it's something that is absolutely vital. It's been vital for about 10 years. I remember watching a presentation from, I think it was the Google CFO, maybe 12, 13 or 14 years ago. He basically said, look, if you don't enable multi-factor auth on your email account, you will get hacked. He didn't say you might get hacked. He said you will get hacked. It will happen.
Multi-factor auth is absolutely vital, especially if we're talking about external access, whether it be contractors, vendors, anything like that that's logging into your environment. Even if you have employees working from home, it is super important that you have some form of multi-factor authentication there.
The other thing here is that you can attach this to privileges within an operating system. As an example, if you have a server environment and you want to install a particular piece of software, you can enforce a multi-factor auth step-up: you know what, you're trying to do something on this particular server that's business critical to us, therefore I need a bit more information before I'm going to let you do that.
The other thing is integrations. Integrations can be very expensive. So if you want, let's say, multi-factor auth on every administrative privilege within an environment, it makes sense to have that as a gate in front of your privileged access management or your third-party vendor or contractor access system. That way you've got multi-factor auth everywhere you can possibly have it.
Tim: Yeah, that's a really good point though, Scott, because on every insurance form now it's a tick box: do you have MFA, yes or no? Now, that's very granular, and what we try to tell people is that it's really important when you tick yes. If you end up with a breach and then they do their investigation and find out that it's a no, that can be a bit of an off-ramp for insurers to get out of having to cover the policy. Not all insurers, but some do.
So what we like to say is you've got to pretend you're in the witness box defending it, and you need tools behind you that can prove and give you a history of: yes, we had MFA, yes, it was enabled, and here's all the best-efforts coverage. What that means is, if there might be one platform where it was missed on the client side, but you can at least demonstrate that it's there on the 99% of instances that are logged in, the insurance policy will protect you, because you've made the best effort to achieve what you put in the application. So we really try to highlight that to a lot of our customers as well: you need to do it, and you need the proof you've done it.
Scott: Yeah, exactly. I think the last point I want to make here is actually having visibility into what has happened. This is really important afterwards. It's a kind of mitigation step, so you know what has happened. I like to put more emphasis on the protections first and foremost, but this is also a particularly important thing to have, because if there has been a breach, you do need to be able to trace what that attacker actually did.
They might be in systems that you don't know about. There may be ticking time bombs within an environment that you really need to know about beforehand. Or they might be taking some form or collection of data, and you don't even know that they've got access to secondary data that they're going to hit you with a month later. So even if you do pay, they may still try to extort you later on.
Tim: That's great. This was just a quick slide, obviously, to give us a little bit of detail, because all the insurers are already adjusting policies as the Privacy Act changes come through. The big areas are obviously the fines and penalties, lifting to potentially $50 million or a percentage of turnover, and changes for some of the smaller customers. We haven't seen this enacted into law for the wider recommendations, but it's looking to happen shortly, and we think this is something everyone just needs to really keep across for their particular businesses, because there'll be a wide raft of changes.
Many of the larger companies are already aligned to structures like GDPR as well. But we think for small businesses this is going to be a big shift for them, coming into the end of the year. So we'll be trying to release a little bit more on this as it happens.
Scott: I think there's a bit more emphasis on the protection of everyday people, the general public, with this one.
Tim: Absolutely. And there's a lot about consent for data as well. Have I given consent for you to take my personal information and hold it? And if I tell you I don't want you to hold it, how are you going to actually do that? So again, I think there'll be a huge investment next year in the tech stack across a lot of businesses for these reasons. And if the insurers lose money from something, they move really quickly, and they know it inside and out.
Scott: Okay. So just a little bit about BeyondTrust. I've talked a lot about some controls and where we can help. I think the overall theme that we have is that, firstly, it's about protecting access into particular systems. We can do that for internal systems, where we will actually go out and discover what's within a network or environment, automate the onboarding process, and then start to protect how people are actually accessing those systems: where are they coming from, what are they trying to do, and also having an approval process to get onto those machines.
This also applies to third-party access. Third-party access is a very, very large attack vector that you need to think about as an organisation, particularly with contractors. The very first big high-profile one was Target, and I think that was over 10 years ago now. We still talk about it. Other recent ones: we know that it happened at Latitude, and we know that it happened at Colonial Pipeline over in the US. So a lot of attacks have been focused on third-party access, and that is a specific area we have a solution for.
As we go around, being able to remotely support users was another big thing. We do see some attacks coming in via systems that are compromised on the far end.
On the left-hand side, it's more about protecting what your users can do when they're on systems. The ACSC's Essential Eight has a big focus on application control. This is where we combine application control with restricting admin privileges. It is a huge bonus, and what our customers tell us is that if you can do them both at the same time, it saves a lot of time, a lot of effort and a lot of money, and you've got both controls. So it's the best of both worlds, on all the systems, and that applies to servers and workstations alike.
Some of our customers start by protecting their high-value assets, so that's servers. They'll do that by basically blocking everything except what the user is specifically assigned to do. What's the use case for that person? Are we going to let them update a particular piece of software and do nothing else? Maybe restart a service. We're not going to allow them to do anything else. Maybe we'll require multi-factor auth before they can do that. Versus end users, where you'll probably want to do things like saying, I'm going to allow you to update software from a particular vendor, but I'm not going to let you do anything else.
You can combine that for an even more powerful solution with things like Password Safe, where I'm going to control you as an individual or a user. I'm going to give you gated access after multi-factor auth onto a particular machine, and give you a particular account. Traditional privileged access management solutions will give you an administrator account and basically say, "You know what? I'm recording you, but off you go, you can do whatever you want on that system."
So one particular way of thinking about that is to think of the use case for a specific user. Again, that could be a third-party user, it could be an employee, it could be basically anyone. Have a think about what they need to do, get them onto that machine as a specific account that is not a local administrator, and then give them privilege escalation on that one task only.
The last thing here is something new that we have brought to the market just recently: Identity Security Insights. This one gives a holistic view of everything happening within an organisation. What we'll actually do is look at who has access to what, where multi-factor authentication is turned on, which is an important one, and whether there are dormant accounts that have excessive privileges. We then tie all that back so the security team gets a holistic view, and they can say, "You know what? I need to raise tickets for the AD team or the infrastructure team, because they need to fix particular things to secure the entire environment." So, back to you.
Tim: This is over to me. So how can SherpaTech help Westcon-Comstor customers? Insurance, for most organisations, is typically a bit of a headache. It's done at the last minute and it's done in a rush. What we find is that when we go to underwriters with a very short runway, they get to control the narrative. So what we try to do is talk to our clients mid-cycle on their insurance renewal, so we have enough time to look at the policy, test it against what it's meant to do, and then make the necessary adjustments, and do that well in advance of renewals.
Something that people don't always realise is that insurance is a contract of mutual honesty between the customer and the underwriter, and it never gets tested until there's a claim. That's the worst time to test it, because when you have a claim, you want to know the policy will respond. So what we typically like to do is look at the activities of the business, understand the clients, look at the frameworks that already exist, and then provide feedback on how the insurance market would actually respond in the areas that might be your greatest concerns or greatest risks.
We have a health check process to help step people through that. It's typically a C-suite engagement, but we're happy to talk to any of Westcon's customers, and BeyondTrust's as well, to try and assist in this area. We have a number of checklists, similar to yours, Scott, that always help people get involved. But we're also trying to tell people to use insurance as the reason to have conversations about tech with your customers, because it can actually be a good driver for uplifting their security, and for showing them the value: if they invest in a particular stack, what that leads to in savings or extended cover with insurance. So we really feel the two need to be quite closely related.
I've read your insurance checklist as well, Scott, and I think it's amazing. I really like that one.
Scott: Yeah, so this is available on the BeyondTrust website. You can see the link down the bottom: beyondtrust.com/cyber-insurance. This one's probably worth a read. It covers off a lot of those bigger threats that we saw earlier in the presentation, in terms of stolen or compromised credentials, or even privilege misuse or insider attack. So that's a great resource to use as well.
And just some contact information on who we are. You can contact us via beyondtrust.com, or that's my email address there. I'm also available on LinkedIn, so please go ahead and feel free to add me.
Tim: Yeah, absolutely. I'd love to. I'm always happy to talk insurance to people. I find it a bit more exciting than the normal bloke does. But if there's anyone out there that needs any help, we're always happy to help. Our job's made a lot easier, Scott, when the technology stack is actually really robust, so we have a risk we can take to the market that considers all those factors. And that cyber checklist really covers off a lot of those, so it's great to have.
So if there are any questions from the audience, we're happy to field them. Phil's asking what the cost of the health check is. For Westcon-Comstor customers, we'll do it complimentary. It's about a day's worth of work, but the goal out of it is that we really want to be your insurance broker, and we will put a lot of work into trying to help unpack your areas of risk. So we are more than happy to help. And I want to thank everyone out there for joining us today. Andrew, I might hand back to you.
Andrew (Westcon-Comstor): Oh yeah, thank you. It looked like you guys were talking and we were just listening in, but it was a fantastic session. Thank you so much for taking time out of your busy schedules and doing this for Westcon. Now, as part of wrapping up from the Westcon side, I'll be sending out a recording of the presentation and some checklist links, so that the people who attended can have a refresher and read through them. I think there's one more question, from Alicia. Tim, if you could answer that for her, please.
Tim: Yes, we definitely do. We do all types of general business insurance. Cyber is just one area that we offer. We do business, property, professional indemnity and liability, so we're across it all, and we'd love to help you, Alicia.
Andrew: Fantastic. Thanks everyone, and we'll see you shortly for the next session.
