What does cyber insurance really protect, and why is it different to professional indemnity? Listen to Andrew Bremner from SherpaTech discuss cyber insurance with James David from Pax8, and why professional indemnity insurance is not enough on its own.
Featuring: Andrew Bremner (SherpaTech) and James David (Pax8)
Length: 6 minutes
Part of a three-part series. Watch Part 1: Professional Indemnity and Part 2: Contracts.
Key takeaways
- Many MSPs are like the cobbler's children: very good at advising their clients, but not always properly protected themselves.
- Cyber insurance covers three main areas: first party (your own business, such as hacking and data breaches), third party (claims from customers who blame you for their cyber losses), and crime and social engineering.
- Cyber insurance is a new and immature product with a lot of variety in cover, so choosing the right policy takes careful navigation.
- Telling customers "you don't need cyber insurance because we've got you protected" is concerning, because it raises the customer's expectations of the MSP.
- Large companies are now making their MSPs responsible for their business continuity, which is a very different risk profile for MSPs.
- Even at the small end of town, a claim of $80,000 to $100,000 could wipe out a year's profit for an average MSP.
Transcript
James David: It's a good point. MSPs aren't in the risk business. Talk to most MSPs and they'd say they're mitigating all this risk and they understand risk. But from your experience, actually working in a risk-based business that's all about quantifying risk in money, how would you view MSPs in the way they manage risk?
Andrew Bremner: I would say, based on experience, and we've probably got in the order of 80 to 90 MSPs that we look after, by and large it's the cobbler's shoes. They're perhaps very good at advising their client base, but their own house may not be protected properly. That's probably what we discover.
Professional indemnity is a pretty mature insurance product, and you kind of know what you're getting. But cyber is another world. Cyber insurance covers three main areas. First party, which is protection for your own business, so hacking, data breaches and the like. The second part is called third party, which is a claim by your customers for cyber losses in their business that they blame you for. And the third part is crime and social engineering. Social engineering is where someone pretends to be someone else and causes you to do something, like pay money away. And crime is just pure crime, someone getting into your bank accounts and paying money away.
Cyber insurance is quite a new insurance, and it's immature. It's like a teenager. There's lots of variety in coverage, and it needs quite careful navigation to select the right policy, or the right components, for your business. That takes a little bit of knowledge about the risks associated with your particular MSP business.
James David: It's really interesting, splitting out the three different types: protecting your own house, the third party, and then direct cybercrime. I don't think many MSPs would have heard that before, or thought about it, or about how they're communicating with their clients. From my experience, there are mature MSPs that can have really good risk-based conversations with their clients, but a great majority of the industry is using very strong language, like "We'll prevent and protect you from all these incidents." A lot of the time, immature MSPs say, "No, you don't need cyber insurance, because we've got you protected." I'm just seeing your face now and your reaction to that. What is your opinion on that?
Andrew Bremner: You raise a very good point, and we see it in our customer base. It's really concerning when MSPs go out to their customers and say, "Hey, we've got you protected." The reality is the end customer probably expects that. That's the expectation. And it leads on to a concept we're seeing at the big end of town: large companies, ASX listed companies and multinationals, are now making their MSP responsible for the business continuity of their business.
So if you've got, say, some sort of booking system, an airline booking system for example, and it goes down for a day, it might mean tens of millions of dollars in lost revenue, or certainly an opportunity cost. What's going to happen is the end customer will hold the MSP to account. This is a major change for MSPs, and a very different risk profile to what MSPs have faced before.
James David: And it's not just the big end of town, is it? It's the SMBs as well. The last figures I heard, and you'd be more up to speed than me, were that the average claim was for $80,000 to $100,000 of impact. And that's the small end of town. So it's quite significant. An average MSP might be turning over $2 million and making a 6% EBITDA.
Andrew Bremner: Yeah. A hundred grand in the scheme of things might not seem large. But if you're only making $120,000 profit, there goes your whole year in one incident. And you may not have the capital base to weather a claim of two or three hundred thousand. You may just not have the capital.
