Season 3 of Two Sides of the Table kicks off with Tim Stephinson, CEO of SherpaTech. In this episode, we unpack the realities of cyber insurance: what it covers, what it does not, and how MSPs and IT businesses can better manage risk in a changing landscape.
Listen here or wherever you get your podcasts.
Featuring: Tim Stephinson, CEO, SherpaTech
Length: 40 minutes
Key takeaways
- Cyber insurance protects your own environment, not your customers'. Tim explains this is a common misconception, and MSPs should encourage their clients to hold their own cyber cover.
- Professional indemnity is protection for bad advice or perceived bad advice to your customers. Even if you think you only sell product, Tim says selling product usually means you are giving advice too.
- Claims tend to fall over because of what was disclosed when the insurance was taken out, not what happened at the claim. Tell your insurer when you start offering new services, such as incident response.
- MSPs should not fill out insurance forms on behalf of their clients. Help them, but qualify which platforms you manage, because a blanket "yes" to questions like MFA can draw you into a client's claim.
- Call your broker and insurer early when an incident happens. Many cyber insurers will help you decide whether it is a claim in the first 24 to 48 hours, and early response keeps the claim smaller.
- Higher cyber limits are getting easier to buy as more insurers enter the market, and premiums can be paid monthly through premium funders to help cash flow.
- When you review your policy, Tim says the exclusions and endorsements are the big red flags to check against your business's biggest risks.
Transcript
Kayla: All right, Pete, welcome back. Thank you for being on the other side of the table. We are in season three.
Pete: Kayla, it's fantastic to be here for season three. We've had such good response from season two that I'm really excited about where we're going. So if you think about the genesis of where we've been on the podcast, there were the two of us with our dulcet tones, and then we brought the founder series in, where we brought founders from a number of different areas across the IT service provider landscape. And then this season we're really focused on bringing those experts to the table.
Kayla: Yeah, I'm really excited about this season. I think it's definitely going to be one that people are going to want to listen to. Our technology community is really going to want to listen to this one with the experts that we've got. I'm extremely excited about the lineup as well. We've got some really good people coming on, so I think it's going to be great.
Pete: Yeah. And look, really, we've got an entire plethora of people. That's everything from finance brokers, to help with answering some of those finance questions that business owners often struggle with, to people around culture and how to build high performing teams. And it's a great segue to who we've actually got on this episode, because we're going to deep dive into insurance.
Kayla: And so without further ado, we are welcoming Tim Stephinson from SherpaTech today. Tim works closely with MSPs and businesses to navigate cyber insurance risk, the realities of insurers and what to actually expect from them. He's seen firsthand what actually gets covered and what doesn't get covered, and how cyber incidents and other incidents in their businesses can really affect their premiums, what insurance might actually mean, and what insurance they need in their business as a result of that. So I'm really excited about this conversation. Tim, welcome to Two Sides of the Table.
Tim Stephinson: Well, thank you so much for having me. I'm very humbled to be included in the expert group, but yeah, it's been great to hear you guys on the first two seasons, and I'm excited to participate in the third.
Pete: Awesome. Thank you so much. I do remember when we launched the first couple of episodes of season one, you and I jumped on a call and you said to me, "We're really interested in being on the podcast." And look, here we are. First episode of season three.
Tim: There you go. I stay true to my promises.
Kayla: All right, so take us through business insurance as a whole. What do businesses need to consider, particularly in the technology space?
Tim: Yeah, so in the technology space, we see a lot of businesses trying to cover their biggest exposure, which is their customers. So first of all, when you start dealing with clients and selling services as an IT business, you're actually very similar to doctors, lawyers and anybody else who gives professional advice. And so the protection for professional advice is professional indemnity.
In a simple soundbite, it's protection for bad advice or perceived bad advice to your customers. And it's funny, I've heard some technology people say, "Oh, but we're not giving advice. We're just selling product." But through selling product, you are naturally giving advice in many cases. And so it's really important that you have protection for that.
The professional indemnity protection that comes from insurance is majority legal protection. So in the event that the customer suffers financial loss and blames the provider, the insurer will deliver the legal services to counter that claim or manage that claim, and then follow it down a myriad of different paths that it can go down. So yeah, we see that as probably their biggest exposure.
And as technology has changed and morphed over the years, it's then grown its own class of insurance. Cyber insurance used to actually be part of professional indemnity. And it wasn't until the claims started getting more complex, and exposures were not what you would typically see in that bad advice category, that cyber insurance was born, about 15 years ago, as a new class of insurance to cover cyber risks. And that has evolved now into not just legal protection, but incident response services.
So an IT provider will have those two insurances together, but many of the IT provider's customers need to hold cyber insurance as well. Because in the event of an incident, which can come from anywhere, as we all know, they need a team of experts across communications, legal and regulatory. Negotiation is even one where we've seen specialist providers on the insurers' panels.
I was on a call with one last year and they could reference the ransomware group straight away. They knew that they paid out, they knew their avatar, what they looked like. There are all these little niche specialty skills that come from the insurers. And the reason they do that is actually to save themselves money, because if they respond efficiently, the quantum of claims is less.
Kayla: Wow. My head's already spinning, and the episode's only just started.
Pete: And look, I think insurance is one of those really unknown areas for many business owners. If I think back to my own business when I started, the analogy I used was probably like my first car, the Ford Telstar that I bought. I didn't pay for full insurance, I just got third party, fire and theft, because I was trying to scrounge around and save a few dollars.
And if I cast my mind back, I actually saw insurance as a ticket to play. When I first started my first business, I didn't have insurance until I had to get it in order to be able to respond to a piece of work. So for me, that was the catalyst. I wasn't thinking about risk at that point in time. It was more, I just need this in the top drawer to allow me to do more work. Is that a common thing that you see with many IT service providers?
Tim: Yeah, it is. It's probably a maturity step where we see businesses. Usually the first reason they buy insurance is their client tells them they need insurance to operate. But usually, through going through that process, they unpack why they actually need it.
And there are two schools of thought. One is you buy your insurance as a ticket to play, and the other one is you have a robust program, so that if you need to pick up the phone and make a claim, it's there to protect you. And interestingly, the ticket to play doesn't always work out to be cheaper. We sort of see that if you're going to pay any money, you might as well make sure it's there.
We do see some programs that have heavy exclusions, and that's for a business to then make the decision to sometimes self-insure, have a cheaper insurance and agree that they're not covered for a certain portion of the program. Our role as a broker is really to navigate the insurance market and deliver on the client's requirements.
We have some customers where they need very sharp insurance premiums and very narrow policies, or sometimes they need broad coverage for a very wide range of services. And you can also do a lot of tricky things sometimes, like increase excesses or change coverage limits, to change cost and coverage. So yeah, it's a real fit for purpose product.
Kayla: You said something really interesting there: self-insurance. Is that just having a pot of gold somewhere that will cover you should an incident happen? What does that mean?
Tim: Yeah, so I had my own business a couple of years ago and we had a fleet of about 30 cars, and we chose to self-insure it. So like Pete said, we just took out the third party coverage. We didn't cover the assets, because the assets were quite cheap cars that were used by tradies. And in the event that we wrote off a car, it wasn't going to kill the business.
So we insure for the worst things, and if we can wear it on our balance sheet, we self-insure. You're just agreeing that in the event that something happens, you'll cover it with your own cash. We see that as well with a lot of cyber insurance programs, where people will set quite high cyber limits. They still need the team of experts to come running from the insurer, but they might take the first $100,000 of that exposure themselves. They can reduce their program, and then they're trying to cover for that larger event that could potentially kill the business.
So yeah, it just depends on the risk approach you want to take. And that's one of the things, our first step of really understanding a business is: how do you want to manage risk? Do you want to accept it all, or some of it, and where does that transfer happen as well?
Kayla: So give us the sales pitch then. What does SherpaTech do? How was SherpaTech born?
Tim: Well, it's very fortunate we're named Sherpa, because we are the assistance, we're the guide. We really try to help our clients navigate the insurance market and also navigate how they approach risk. That risk discussion is something that doesn't come naturally to people to talk about, but we all navigate risk in our everyday lives. If I go across the road, I stop and check both ways. And with little things like that, in business you can use those same tricks when you approach different decision points.
And it helps if you manage that risk well and you encourage your teams to think about risk as well. There are a lot of great industries, medical and aviation, where they have huge exposures and they manage risk really, really well, and they reduce the likelihood of incidents. And so if you take the same approach to technology and try to reduce that risk environment, you can actually get a really well priced insurance program, because you can show how mature you are.
And we actually see that businesses that sit in that 5 to 20 million turnover range are sometimes higher risk for insurers than the 50 million plus range, because of the controls and frameworks that we can usually articulate to the insurer they have in place. And sometimes those senior management roles that sit across the different verticals aren't always there in a small business.
But that's where I think the insurance programs are very important, because a million dollar claim will kill a $5 million or $10 million turnover business. Those larger companies can probably wear some of that, or navigate that as well.
Kayla: Yeah, it's really interesting that you say that, because one thing I do say to my team, before we go in to make a decision or we deal with an issue or something like that, I always say to them, "Look both ways before you cross the road." So it's really funny that you use that analogy.
Tim: And I think it's really important these days as well to bring the clients of technology providers into those conversations, because I've heard it a lot from managed service providers. We also look after system integrators, vendors, ISVs and others as well. But the managed service providers always say, "I gave them the quote for the MDR solution and they've declined it. And then what happens if they get breached, or what happens if they don't take my advice and there's a consequence from that?"
And so we've always advised people that it's about the evidence as well. An insurer doesn't say you must have this checklist of things when you come to make a claim, but you can always represent yourself better to an insurer should you have all those things. So if you've gone and told your clients that they need to do these things to improve, risk evidence is a wonderful thing.
And repeating that message. We see really good MSPs with their QBR having a risk register that they raise with their clients. A lot of these things are insurance related, they improve insurance, but they're not necessarily the insurance policy you get from the underwriter. So you can improve your risk without spending more money on insurance.
Pete: Yeah. And I think a lot of that comes back to the classic statement: what reasonable steps did you take? So if ever the worst was to happen and you're sitting in front of a judge, it's what reasonable steps did you take at that point in time to prevent the train crash from happening?
Tim: Yeah, that's it. And you can foresee that coming. We had a claim last year where a client of ours was concerned that their client was going to make a claim against them, because their client had paid away a significant sum of money to a third party. They were a victim of a phishing attack.
And straight away, the insurance policy for our MSP does not cover the money that the third party has paid away. But I said, "Nothing stops them from bringing a professional indemnity claim against you down the line, if they want to try and blame the fact that your controls might have been lax, or MFA could have been turned off, or whatever twists and turns that could take." I said, "You've got a really good security vendor there. Talk to them, get evidence of the logs, build as much as you can to put in the bottom drawer, so that if something comes in three months' time, we've got everything ready to go."
And fortunately it didn't end up going down that path. They did a really good job of helping their client navigate that. But putting two hats on, to ask how do I protect myself and also how do I help the client, is really important.
Kayla: And so you have those conversations with MSPs or technology service providers if they think there are claims coming their way? You help them through that?
Tim: Yeah, definitely. A lot of people don't know what a broker does. And in our industry of insurance brokers, there are varying degrees of service that come from different brokers. A lot of the business we win from other insurance brokers, the complaint usually is, one, "I don't think they understand my business or understand technology." And so we've invested in our team really having deep knowledge of technology and insurance.
The other one is that sometimes it's a little bit lazy in insurance, where renewal terms come late. There can be complex twists and turns, but we try to make sure renewals start eight weeks out, so it doesn't become a surprise. And I think the other advantage of having a narrow customer set and specialising is that if we see a particular trend with an underwriter in June, by August we are telling our other clients, "Hey, look, we've seen this, so we need to be prepared for that and do a bit more work."
And whether it's me or another insurance broker, the more information you give them early, the better equipped they are to advocate for you with the underwriters. We're sometimes salesmen, where we have to sell a business to the underwriters to say, "Hey, look, this is why this looks really good. They've got ISO, they've got great controls. Their vendors are actually taking some of the risk."
There are a couple of vendors out there in the security space that actually have security guarantees to a certain level before a client could possibly claim. We'll proactively share that with an underwriter to say, "Hey, look, if this business goes through that type of claim, they'll have these other risk mitigators in place." And that can lead to better terms, better coverage and also better understanding of those businesses.
Pete: And look, I have to admit that when I was first dealing with insurance, I was exactly in that same boat. There was an insurer that was recommended by the industry association. I called them up, they sent me a form to fill in, I filled that out, and they sent me back a policy. And then I didn't hear from them again until 12 months later, when they sent me the same form. I filled that in, and the only thing that changed was the price continuing to go up.
And I think one of the things that was always in the back of my head, and it's probably in the back of many of our listeners' heads as well, is: will the insurer pay out? Because if you look at people's experiences in their own personal lives, especially in Queensland, there have been many people affected by floods and stormwater and other things, only to find that the money they'd been paying to the insurer didn't cover it, because the water came out of a manhole, or it didn't come from the sky, it came from somewhere else.
There's probably a little bit of, let's call it, buyer beware that people have around insurers. And it sounds like you provide that understanding for people to know, well, is this fit for purpose? And if there is an issue, how do you navigate that to make sure your claim is covered?
Tim: Yeah, it's a really good point. When I was outside the industry, I never really understood insurance. And it was one of the things that, when I first started working with Andy, my business partner, he helped me understand: how you can leverage it and use it to your advantage. And I think there are many examples, especially in retail insurance, where people's expectations aren't met.
The big thing we try to do is eliminate off-ramps for insurers, and a lot of that's done through disclosure. Our really good customers engage with us early and frequently, and the more information that you can tell an insurer, almost the more you can hold them to account across that information.
And things like, where did the rain come from, those sorts of things are common reasons to disbelieve insurers, because everyone knows somebody who had a claim denied for some reason. But many people who have had claims paid, they're paid because an insurance broker advocates for them as well. So that's one big thing we do for our clients: at claim time, we advocate for them.
And there are also a lot of nuances in general insurance. So if somebody can help guide you through that and say, well, did it fail during a storm, or is it lightning? What's the evidence? And actually crafting that. In our experience, insurers pay frequently and often. It's their business model. They want to pay out, and they have certain obligations to under Australian law. So we use those things to hold them to account.
The other thing with the cyber insurance model, which I think is a little bit different to "I had a car accident" or "I had a property claim", is they're delivering a service of specialists who come running when you have a claim. And the terms that cyber insurance is written on now are very broad, and it's intentionally so. We're seeing a lot of AI exposures come out now, and people are saying, "Well, hang on, am I covered for this, yes or no?"
We've had that tested recently. One of the insurers, Emergence, has some really good examples of AI claims, and they're covered by their wording that was written a couple of years ago, because it was intentionally designed to be broad so they can cover those claims.
We've even seen this with insurers through a claim. Sometimes they don't cover hardware, because you've got to indicate on a policy that you want physical servers covered for encryption during a ransomware event. And some insurers have made decisions to pay for hardware, basically to minimise the quantum of the business interruption claim.
So if you are covered for business interruption, you can have a really large claim, because every day that business isn't trading, the insurer's on the hook. But if the insurer can make some strategic decisions to reduce the quantum of the claim, they will always do that. And if we can proactively help them do that, you get a quicker claim, a happier customer, and the insurer moves forward.
Kayla: Right. So you are also being covered for the loss to your business, as well as the potential damage or ransom?
Tim: You can be, yes.
Kayla: Wow. I didn't realise that.
Tim: Cyber's a really interesting one because it's such a new class of insurance, without going too geeky and nerdy on insurance.
Pete: Maybe it's a good point for us to take a little bit of a step back, because I always look at my certificate of currency and there are all sorts of different things. There's 20 mil this, there's five mil that, et cetera. Maybe take us through the difference between public liability, professional indemnity and cyber. Because when I look at my certificate of currency, it's just one insurance and I just pay the one bill, but there seem to be very different line items there.
Tim: Yeah, definitely. So professional indemnity is protection for bad advice or perceived bad advice to your customers. So that really is customer focused. And then public and products liability is really a personal injury coverage, in the event that your products or services cause harm.
So if we see a business that's doing electrical cabling or physical onsite work, their public and products is actually quite expensive. But if they're an IT business doing professional services, public and products is really cheap. And so that's one of the big things: you've got to make sure that you get the industry and the classification right across those classes. And then cyber insurance is really protection for your own cyber environment.
Kayla: Oh wow. So it's not for your customers' environment, it's for your own environment?
Tim: Oh, yes. That's a common misconception, and that's one that we really highlight to MSPs, because their customers naturally think, well, my IT provider has insurance. So breaking that one out is always really important.
Pete: And I think that's really confusing, because if you look at responses that you have to an RFQ or to other proposals, often the customer's asking for $5 million of cyber insurance. But the reality, from what I'm hearing, is that $5 million has no connection to the customer at all.
Tim: There is overlap. You do have some sections of a cyber policy that overlap with professional indemnity, but the majority of it, the main chunk, is for your environment. Now, we are seeing the New South Wales Government in particular asking for 10, and in some cases $20 million, cyber insurance for contractors doing work for the government.
We've worked with a number of clients, helping them explain to the panels or procurers of those services why the professional indemnity limit being higher and the level of cyber being a bit lower is actually acceptable. There was a recent paper written by the Australian Government Solicitor, and if anyone wants to reach out, I'm happy to send it around. But basically it articulates why the government is asking for these higher limits and what they're actually meant to cover.
So if you are responding to any of those panels, if you know what the other side's asking for and why, you can craft your program to meet those needs, or also explain the other things you do to mitigate risk in those areas.
Kayla: So what happens if, for example, a business is dealing with sensitive information on their customers, and that gets breached? Say I'm dealing with sensitive information on my customers, I get breached, and then the customers are put at a disadvantage because their information's out there and it shouldn't be. What kind of claim does that look like?
Tim: So that would be a professional indemnity claim from your customer against you. And then you would have a cyber claim that would jump in to mitigate that loss, deal with the regulatory compliance, and potentially also negotiate with the customer. And that comes down to supply chain attack as well. In a small example, you are that supply chain to them.
But that can also easily be affected by third parties as well. A lot of IT vendors are passing through services, and if a claim ever occurs, it follows the line of contract. So even with big vendors, insert largest vendor here, it would go through the MSP to that vendor, not around them. So they get drawn into it.
Kayla: Wow. So you've almost got this support network for when something goes wrong, with the cyber insurance.
Tim: Yeah. They're almost like the tow truck driver that comes out and helps you respond to the accident when it's happened. We had a really good example with another customer of ours whose client got breached, and their servers were encrypted. They called us and we said, "Okay, let's look at your policy. We believe this may not be your insurance. We believe this might be your client's insurance." But we triggered the insurance policy straight away, called the insurers proactively, and got the insurer to basically give our client the advice that no, this is not your insurance.
So they were able to push back on their client to say, "Hey, we've notified our insurer, and they've advised that this is your server we were working on. So you need to trigger your insurance, not ours." They could still bring a professional indemnity claim against them down the track. But that's the point where a lot of our clients, the more mature ones, will say, "We need all of our customers to hold cyber insurance before we even engage with them." Because they can easily be the victim of a phishing attack, leave a gate open, and something happens on their side. It's not the MSP's fault.
Pete: Yeah. And it sounds like one of the things is being proactive and having a really robust incident response plan, so that when it happens, and the reality is it's happening all the time, you know who to call first. And it sounds like almost the first call should be to your broker and insurance provider.
Tim: Yeah, definitely. And the insurance providers will jump in. A lot of the cyber insurers now have almost like a no claims bonus with their policies, where you can trigger it and call them, and they'll help you decide whether it's a claim or not in the first 24 to 48 hours. And the reason they do that is because they know if they jump in early, the quantum of the claim is less. Whereas if people say, "Oh, I don't want to trigger my insurance, I might have an excess increase or something," they stay away, and then the insurer finds out about it a week later and they've got a much bigger claim on their hands.
Pete: And look, one of the things I keep hearing in the industry is how difficult it is to get larger amounts of cyber insurance. Organisations that might have five struggle to be able to get ten, or it's very difficult to get 20. I remember even back at MOQ, we had 10 million for cyber, but that had to be underwritten by multiple insurers, because they would each take five mil of the pie to make up the 10 mil. Are you seeing it harder and harder for MSPs to be able to get higher levels of cyber insurance?
Tim: No, we're actually seeing it easier to get higher levels of cyber insurance now, and it's partly driven by the market. There are increased providers of cyber insurance now, so there's more optionality for us as a broker, and they're able to do higher limits as well. So when you were with MOQ, it could have been a two and a two and a two to get all the way to a 10. Now we'll find some providers that will do a straight 10.
But we're also a bit strategic. If you were to do two fives, the second five is typically cheaper as a whole than just the one 10. So sometimes an insurance broker might do that to minimise the cost as well, because the second insurer has a lower chance of the risk on the second five.
Kayla: So MSPs, or anyone really that gives professional advice, should really be talking to their customers about cyber insurance?
Tim: Yeah. So cyber insurance is a regulated market, so you need an insurance broker to break out limits and coverage sections. But everyone can tell their clients that they should go and have a conversation with their insurance provider about cyber insurance. Nothing's stopping them from doing that, and we actually think it's a good proactive step.
Because in the event that they do get breached and try to blame the IT provider, you've told them, "Well, we might be operating your Microsoft 365 and a few other line of business apps, but if any of your other services go down, we may not be the one that manages those." Websites, commonly, are actually not managed by the managed service provider. And in some e-commerce businesses as well, that's where the business interruption can be very, very large. If an e-commerce site goes down, they will blame those providers.
I've also heard some customers say, "Oh, but that's okay. We point to XYZ provider that runs our website. They would have coverage for that." And then we break that out with them and say, take a provider like Xero for an accounting system. They provide the box. You are responsible for everything that goes in the box. And if you leave the box unlocked because of the configuration settings, you will wear that responsibility.
Pete: Yeah, it's that classic shared responsibility. It's like a cloud backup: it's a shared responsibility between the vendor and the actual service provider there. And it sounds to me that insurance is maybe a great opportunity to have a more strategic conversation with customers as well, and really start to talk about what those risks are and where those lines of demarcation are. Because I think there's often confusion from customers and MSPs about who's responsible for what. And it sounds like cyber insurance might be a good place to lead with, to really start to carve out and help customers understand what's covered and what's not, and tie that back to the MSA.
Tim: Yeah, definitely. You could ask the client to bring their insurance broker into that program as well, and be very proactive about what's being submitted. One of the things that I think people sometimes get a little bit confused about is how easy it is to get cyber insurance, because of the increased competition in the market.
Now there are some insurers who might only ask three or four questions. Do you have MFA, have you had a claim, and some compliance. And you could use that as a de-risking strategy to onboard a risky customer. You may not have done the full due diligence on their environment, but if you've at least had them hold cyber insurance as you onboard them, you've helped de-risk that a little bit.
Kayla: Wow. I'm actually learning a lot as you're talking. This is mind blowing stuff. I think the thing that's sticking in my brain is how you really help MSPs and technology service providers through the process. You're constantly in communication with them throughout the year of that policy.
Tim: Yeah. It's something we've changed, I think, in our client management and our onboarding of clients as well. A lot of our clients used to see insurance as a headache. We really try to make it a value-added trigger within the business. If your customers are bringing you insurance requirements, bring them to us. We'll help unpack them, make sure the insurer covers them, and take that back to your client.
And if your team members see proactive ways to manage risk, that spills into other aspects of the business. Then the wider team will ask more questions, like, "Well, hang on, what about this area over here? Or what happens in this event?" And so it can unpack a lot of value-added benefits in a business.
We also see that you can't borrow money to buy property if you don't take property insurance, because the lender would be concerned it's going to fall over. We've seen some proactive businesses de-risk their business through insurance to be able to borrow money against their IT assets. So the same sort of thing can be said for using insurance as a value-added lever.
Kayla: Instead of just a cost centre. It definitely makes you think about how you can actually start to be more strategic with that.
Pete: But although I think you can be strategic, I think one of the big challenges for many IT businesses is just that it's such a large number that comes off the bottom line for insurance. My understanding, though, is you can finance insurance now, can't you?
Tim: Yeah. There are a lot of premium funders we use to do monthly payments, so you can carve it into 10 or 12 monthly payments. And we see a lot of businesses doing that to improve cash flow, which ultimately allows you to deploy it into other areas, like people and marketing.
Pete: I like that. Fantastic. Because look, for me, it always seems that the insurance renewal comes at Christmas time, basically, with all those bills coming in at once.
Kayla: Where do you see claims typically fall over? You touched on this before, about being really honest with your insurer and declaring things. But where do you see things potentially falling over for people when they try to make a claim?
Tim: Typically it's not around what happened at the claim, but what happened when they first sought to get insurance. So it's that original declaration. Look, insurance is a little bit backwards in the way it does things. It's still very paper driven, where people are sending around PDF forms to fill out, and they can be a little bit cumbersome. We're working to improve some of those things, but that's driven by the insurance market.
And so when you're asked to submit information on your business, what you submit six months before you have a claim is the pillars that we lean on when you have a claim. So it's important to actually articulate your business activities. We have seen some providers with very narrow policies not cover certain activities that an MSP does, because they might have only started doing it three months ago, and they got their insurance six months ago. So keeping up to date is really important.
And also, if you're going to start consulting in an area that you weren't three months ago, or you're now going to deliver a new level of security to your clients. We've seen some MSPs start to offer incident response, like an insurer does, which is fine, but then you've got to tell your insurer that you're now doing that.
Because if you have a professional indemnity claim from that incident response, and the insurer still has you classified as an IT consultant, when you come to make that claim and say, "Hey, the client's blaming us because we dropped the ball on an incident response," they'll go, "But you never told us." So they are the areas that need unpacking. There are a lot of other areas that insurers don't like, like SCADA and water management. And so if we need coverage in those areas, we have to be very specific about what we're seeking. Otherwise they can be general exclusions.
Pete: And I think it really comes back to that continual disclosure, which is an interesting point. Often MSPs work with their customers, and the customers get a disclosure statement and throw it across to the MSP to respond to. Is that a no-no for MSPs? Shouldn't they be filling out the forms for customers?
Tim: Yeah, we've been banging this drum for a while now, but MSPs really shouldn't be filling out the insurance forms for clients. A very basic example is that there's typically a tick box against "You have MFA". They're very binary about how they ask that question. But if the MSP ticks that, and then a breach happens on the client's side through their Xero or their CRM, or an area that the MSP doesn't manage, the client could realistically point back to the MSP and say, "But you said we did. We assumed that you were actually controlling those settings." And then they can draw the MSP into that claim.
So by all means, consult and help your clients fill out those forms. But I would typically do that with a call, or a qualification around "here are the platforms we manage that we meet these requirements for", not just a blanket "of course we cover that for your whole business". A lot of them, like ISO certifications and other areas, actually sit with that end client. They don't sit with the MSP to validate and verify. And I have seen some MSPs complete the entirety of those forms. You are helping your client, but you're opening up risk there, because then you could be blamed for something, as in that example.
Pete: It's really interesting that you keep talking about the word risk. One of the guests that we're going to have on a future podcast is a financial advisor. And I always remember the first time I went to a financial advisor, one of the first questions they asked was about risk. Everyone's got a different risk appetite: are you a high risk investor, or are you a low risk investor? Insurance is the same, because it's almost like, what are you prepared to actually run the gauntlet with, versus what do you want to make sure is locked up and secure?
Tim: Definitely. And you can manage that risk in different ways as well, so it doesn't just have to be a cost of insurance. We do see some businesses that are uninsurable. SCADA is a big one, and water management, those sorts of areas. And so they'll lean on contractual ways to manage that risk instead of just insurance.
Kayla: Wow. I didn't realise there were uninsurable things.
Tim: Oh, a lot of uninsurable things. Far North Queensland.
Pete: And look, it just sounds like there's so much information for people to get their heads across. If people are wanting to deep dive on this, what's the best way for them to start to educate themselves and really be informed about what they're currently covered for versus where those gaps are, and maybe even help them understand their own risk appetite?
Tim: Yeah, we are using a lot of AI tools now as well. Contrary to popular belief, I don't like reading long 40 page insurance documents. But summarising those, and actually using some AI tools to look at your current policies, ring-fence it and ask a simple question about what you could or could not be covered for, is a great way to look at your own individual risk. Then engage an insurance broker, who's a qualified professional in that area, to go deeper on that as well.
But your first point of call really should be your existing insurance broker, because they also understand and manage, and I keep talking about risk, but they understand the activities of your business. And it helps having somebody across all of those. Sometimes I think the gaps can appear in programs when one party places insurance through this broker, and then someone else in the same business goes online and buys it here, and somebody does something over here, and then they all get mashed together. And it's not until you have a claim that you find out, "Oh, we didn't have contractual dispute management covered," or something there.
Pete: And so if I was to go back to the office this afternoon, pull the policy out of the bottom drawer and dust it off, are there any red flags you think I should be looking for?
Tim: Definitely. Well, not on your policy. Your policy's robust.
Pete: Wonder who did that.
Tim: But you've always got to look at the exclusions. That's always what the insurer won't cover. There are endorsements as well, and endorsements can be positive or negative things. Sometimes they can say "we allow you to trigger the claim via an app" is a common one, because they wrote a wording four years ago and they're reusing that same legal wording.
But yeah, the exclusions and endorsements are the big red flags for me to look at. And then unpacking what they mean by those, or how far they go into the business. So you can't do it in isolation. You really want to understand what the business's big risks are, and whether these exclusions, endorsements or gaps in the policy lead to exposure to any of those.
Pete: Wow. And look, I think this podcast has really typified why we're doing season three. There are so many nuanced areas about being a business owner and running a business that you really need experts that know that, and that safe pair of hands, to know there's someone I can call on, there's someone that's got this for me, and I don't need to be a legal expert looking at four point font, trying to work out what's excluded in PDS statements.
Kayla: Tim, thank you so much for joining us today. If people want to get in touch with you, or use your services, how do they do that?
Tim: Yeah, so we're on LinkedIn a lot, we're at a lot of industry events, and there's our website, sherpatech.com.au. And reach out to myself, Andy, Hannah, Yaz and the wider team as well. We're all here to help.
Kayla: Amazing. Thank you so much, that was great. And Pete, thank you so much for once again joining me on the other side of the table.
Pete: Yeah. Look, it's great to be back for season three, and what a great way to start. Tim, thanks for the insights.
Tim: Thanks so much. Thanks, everyone.
