Why does insurance matter for Trend Micro customers? Tim and Andy from SherpaTech unpack why insurance matters for Trend Micro customers and MSPs.
Featuring: Tim Stephinson and Andrew Bremner (SherpaTech), with Trend Micro
Length: 47 minutes
Key takeaways
- Professional indemnity is the main risk cover for MSPs, and it often responds even to cyber incidents. Andrew shares a live claim where an MSP hit by ransomware was sued by two of its 50 clients, and the claim was picked up by its PI policy rather than its cyber policy.
- Hold both PI and cyber cover. Tim explains that the line between the two is a grey area, and it is often the lawyers who decide which policy a claim falls under once it is lodged.
- Your proposal is part of your insurance contract, so list every business activity accurately (such as backups or security services) and tell your broker when your services change, or you may be uninsured for that work.
- Do not fill out your customers' cyber insurance proposals for them. Andrew recommends going through the questions with the customer on a call but letting them complete the form, so the MSP is not drawn into a claim.
- Sharing evidence of your security maturity can improve your terms. Dom describes a Trend Micro customer that upgraded to Service One and cut its cyber premium by around 15%, and Tim suggests MSPs use insurance as a way into tech stack conversations with clients.
- Andrew says a good cyber policy covers three areas: first party cover, third party cover to defend claims against you, and social engineering and crime. Check the exclusions closely, as ransomware and financial advice exclusions are becoming more common.
- Proposed Privacy Act changes would remove the $3 million turnover threshold, which would bring many small MSPs under breach notification rules, and penalties have already risen to as much as $50 million.
Transcript
Dom: My name is Dom, and I'm one of the channel account managers here at Trend. So thank you everyone for jumping on this morning. Lovely to be joined today by Tim and Andrew from the tech insurance specialist. I'll let them introduce themselves in just a moment.
But to provide a bit of context, I met Tim and Andrew earlier this year at an event, and I've been lucky enough to hear these guys present on a few occasions. I hope Tim and Andrew don't mind me saying, but the biggest compliment I could give you guys, and why we wanted you to come on board and present in front of our MSPs, is that you somehow make insurance and cyber insurance actually sound interesting.
I think it was Tim, when I first met you, who was saying that with insurance, most people hopefully only have to deal with you guys once or twice a year, and that's a sign of a good insurance company and policy. But yeah, honoured to have you guys on the MSP webinar here today. I'll hand over to yourselves to introduce yourselves and we'll get started.
Tim Stephinson: Amazing, thanks so much. So, a little bit of housekeeping first of all: today is general advice only. We operate under an AFSL, an Australian Financial Services Licence, so there's a lot of compliance and a lot of regulation, but that's just a little notice up front.
So a bit about Andy and myself to start. Andrew and I are both insurance brokers. I've been with SherpaTech for the past two years, and prior to that I have quite an extensive business background and a lot of experience in managing risk. That's one of the philosophies we really bring to the table with cyber insurance and also business insurance: really trying to understand the business risk profile first, and then looking at the insurance mitigators that we bolt on there as well. Over to you, Andrew, for a little bit about yourself.
Andrew Bremner: Thanks, Tim, and thanks again, Dom, for inviting us onto your webinar. We're really pleased to be able to present. So yes, Andrew Bremner. My background, prior to seeing the flashing lights of insurance, was in management consulting, and I worked for IBM for a long time doing strategy leading to large scale technology implementation. But I would argue that Tim has a far stronger technical background than me. I was probably more on the strategy and implementation side. So that's a bit about me.
Tim: Fantastic, thanks Andy. So just to sum up what we're going to look at today: some types of insurance, predominantly professional indemnity and cyber, which is what we see as the greatest risk for MSPs and your clients in most cases. Then navigating some of the cyber insurance variances that we see with underwriters, and how you can ask your brokers, even if it's not us, some better questions and challenge what is put forward to you, to better protect yourself going forward.
A lot of what we try to help customers with is the understanding, because insurance is hugely complicated. It's important to break out the actual areas of cover that you are trying to protect yourself against.
A little bit of background: MSPs and tech businesses are traditionally a risky business. We joke that everyone's come a long way. The IT guy used to be just dancing around in his basement, and now they're hugely sophisticated businesses. Even an MSP turning over a couple of million dollars could possibly align to ISO standards. They have vendor requirements, and they also have heavy contractual requirements with customers.
So when you are looking at risk, there's a big piece that comes before any insurance discussions happen, and this is where Trend play as well. Dom, you'll be familiar with all of this: the people, process and technology. We try to help our customers understand these risk mitigators as well. The people, the process and the technology all have gaps in them, where even the best systems can have failures.
We've seen it this morning, obviously, with a telecommunications provider, where this will have huge impacts. It will invariably impact areas that people didn't even think about in their risk management strategy, and it exposes gaps in cover. So that's where insurance comes into play.
It's important as well that when you're crafting an insurance program, you correctly articulate the areas of cover where you actually want the policy to respond. We'll get to this a little later, where we highlight business activities, exclusions, endorsements and some other areas there. And if you don't hold insurance, the other question we ask you to ask yourself is, "Or what?" Invariably it's your balance sheet that has to respond, or the cash in your bank that you may choose to have in place to deal with what needs to be resolved following an incident. Andy, have you got anything else?
Andrew: Yeah, I think Tim and I believe this is a really important slide in terms of helping people understand that the first line of defence, that people, process and technology, is so absolutely critical. It's really only once that risk breaks through the first line of defence that you either reach for your insurance policy or you reach for your bank account to settle that claim or that risk.
It's an absolutely critical part of understanding, especially when you start unpacking your risks and identifying what mitigations you have in place. It's just such a critical starting point to understand your risk profile.
Tim: Excellent, thanks Andy. So then we come to what makes up an insurance contract, which is something a lot of people get confused about. When we ask some people what an insurance contract is, they'll say, "Oh, I've got a COC, my certificate of currency." That's actually just proof that the insurance exists. It's not the insurance contract.
The first pillar of the insurance contract is the proposal. This is what you fill out to tell your broker or the insurance company the actual characteristics of the business you are seeking to have insurance over. It's the responsibility of the person filling it out to ensure that all those details are correct.
This is something we spend a lot of time on with our customers, because you need to make sure the proposal includes all your business activities. If you're doing backups for your customers and that doesn't exist in the proposal, the insurer may not be providing cover for those backups in the event that you had a professional indemnity claim in that area.
So we do a lot of challenging with our customers and actually unpacking things. In some instances, the client might see themselves as doing security activities, but they're really reselling Trend Micro products. So that's really value added reselling, not security. They still might need to have some security cover there, but it's a nuanced understanding of what they're actually covering themselves for.
The next part is the schedule. This is where the insurer communicates back to the insured, the first party holding that cover. They list all the areas of cover that were in the proposal, the endorsements, any other specifics such as exclusions, and the characteristics of the cover. So you'll find sub-limits, or sections A, B and C, and that's all listed in the schedule.
The third part is the policy wording. This differs across all insurers, but it's specific to the cover you hold. I always say the wording is like the rules of the game. If you want to understand anything, you go and read it in the wording for that policy. All of that wraps together and gives you an insurance contract.
Andrew: That's great. And just to jump in, it's really critical with the proposal that you are honest about what you do, because insurance is actually all about mutual honesty. You're honest about what the risk is, and the insurer is honest about the situations in which they will pay out. So if you include things in the proposal that are inaccurate, there's a chance you might get caught out at claim time. It's just something to keep in mind.
Tim: And a big point to highlight there, Andy, is that if things change throughout the year, it's your responsibility to call your broker and tell them. Quite often a business might change direction or expand into security services or something. That's on you to tell the broker, because there could be a period where you're uninsured if you haven't informed them of your changing environment.
So what do MSPs hold? There are many different types of insurance: there's liability, there's indemnity, different types of cover. But typically for MSPs, we see their main area of risk is professional indemnity. This is the insurance for the advice you give your customers that could lead to financial loss, or in some instances being pulled into a claim for participating in something that might lead to financial loss. Andy, do you want to explain the nuances of that a little bit?
Andrew: Yeah, absolutely. Professional indemnity is protecting you for bad advice. That might be true bad advice, where you've made a genuine mistake. You might have left the door open on a test environment and hackers have got in. Or it might be something that your client has blamed you for. So it may not even be your fault, but you still have to respond to a claim.
Most of the cost around professional indemnity is actually reimbursement for legal fees. Professional indemnity is absolutely critical insurance for anybody providing professional services, be it MSPs, accountants, lawyers, even insurance people like us. It's an absolutely critical insurance type.
Tim: Excellent. Now the next cover is cyber insurance, and cyber insurance is really interesting because it's a cover that's only been around for a very short period of time. Andy and I joke that it's the pimply teenager of the insurance family, because it's a little bit confused. It doesn't quite know what it's meant to do or when it's meant to show up.
There's a bit of overlap between professional indemnity and cyber insurance, so what we find is there's a bit of a grey area in between. A number of years ago, professional indemnity included a number of the areas that cyber insurance now covers, and now we see exclusions in professional indemnity that carve out the sections cyber insurance now responds to.
So we see it as very important to hold both of those covers, because in some instances we don't know where a claim is going to fall until it's lodged with the insurers. Then the lawyers decide whether they see it as a professional indemnity claim or a cyber insurance claim.
Dom: Just to add on to that as well, I think we had an internal session on cyber insurance the other day. What we were saying is, if you compare cyber insurance to your car or home insurance, with home and car insurance you've got decades upon decades of data, whereas cyber insurance has pretty much only been around for the last couple of years. So it's hard to predict, and the underwriters are changing things from their side as well.
Just in my own experience, I've been at Trend for about three years, and I've seen it go from, depending on what a customer had, just having this policy, to nowadays where you've got to comply with all these different requirements or you don't get a policy at all. So it's changed quite quickly over the last couple of years, and I'm sure there are more changes to come.
Tim: Yeah, definitely. The cyber insurance market is changing really fast. About six months ago it was a hard insurance market, and we were struggling to place a lot of businesses. In the last three months it's softened, and what that means is we can now find more providers looking to compete in the cyber market. So a company that we couldn't get insurance for 12 months ago, we now can. It's important to talk to your insurance providers or your brokers regularly, because these markets change very quickly.
And on the other point you make, around not knowing where a policy responds: underwriters have suffered huge losses from cyber in the last couple of years. So in some instances where a policy holds cover for both areas, the insurer might choose to push the claim down the professional indemnity path instead of the cyber path, because they don't have the funds to cover it there. Andy, what were the figures last year?
Andrew: It was a loss ratio of about 120%. What that means is for every hundred dollars of premium, the insurer was paying out $120 in claims. That's not a sustainable environment, so things have changed a lot. So what do the insurers do? They've diluted the cover and increased premiums. But as Tim mentioned, because of the growing cyber insurance market, there have been a number of new entrants, so the market has softened.
Tim: The dilution of cover is a really good point you make there, Andy, because as they dilute that cover, you really want to compare policies from different providers. Ransomware is a huge exclusion that we see with some providers, so a cyber insurance policy at a given limit is really not comparable until you actually break out all these different sections. We'll get to a bit more of that later.
The other area is public and products liability, which is a common insurance type that all businesses hold. Then you have your transit, workers compensation, motor and assets as the general classes. We're more than happy to help everyone with all these classes, but today we're really just focusing on the professional indemnity and cyber risk areas.
So we've actually got some real life stories playing out currently, with claims we're seeing go through the courts. Andy, do you want to tell us a little bit about this example? It has obviously been generalised, but it's a claim I think everyone can relate to.
Andrew: Yeah, absolutely. These are actually live claims being dealt with through legal means right now, and this is the first of two. In this one, the MSP suffered a ransomware attack. Very sad: someone clicked on a link, and away they got. So they closed down their operation, and the impact was on their 50 clients. Those clients were missing out on the professional services provided by the MSP, which kept the lights on and did the upgrades and whatever else needed to happen.
Now, fortunately, this MSP was really responsible. They were really well organised, and they communicated very strongly to their customer base to say, "Hey guys, this is what's happened. This is the implication, and here's what you can do."
But even despite that, two of their customers made claims against the MSP to say, "You've been the cause of our business interruption. We're not able to generate the revenues we expected, and we're going to make you pay." So two clients went after them, and basically it was around breach of contract and negligence.
Interestingly enough, even though it was a cyber incident, a ransomware cyber incident, it was actually captured under the MSP's professional indemnity policy rather than their cyber policy. So I'll stop there. If you have any questions, please pop them in the chat, and we're happy to discuss further.
Tim: This one was actually from Wotton + Kearney, the law firm. Inevitably, what happens when you have a claim is the law firms get involved, because they also look to try to subrogate the cost to other providers. So quite often in a claim, people get swept up in it.
We see that as probably one of the biggest risks for MSPs: getting pulled into a claim for something that happens at one of their clients, where they might just be doing the desktop support, but the insured suffers a loss from another area. The barristers try to find as many people as they can to bring into that claim to share the costs.
The next slide we've got here is one where we want to talk to everybody about the cyber proposal, which is the document you fill out, and the questions they ask. Dom, do you find this is a common issue for your customers, where they're being asked to participate in insurance documentation?
Dom: Yeah, definitely. On most occasions, whether it's just a casual chat over the phone or meeting an MSP in person, it usually comes up that they have to go through these big long checklists of questions, and follow-up questions, based on what the underwriters have got. As we mentioned before, the underwriters are changing what they want to protect and what their policies are. So every couple of months there seem to be lots of new questions and a new checklist to go through. So definitely a bit of a hassle for MSPs.
Then it comes on to us as well, because obviously the partners want to double check with their vendors what they can do and what boxes they can tick off. So from a partner and a vendor perspective, we're also going through these lists. Trend can be quite good because we do have a number of different solutions. It's not just the endpoint or email that we stick to. We've got OT, Office 365 protection, things like that. So we can be a bit of a one-stop shop.
Tim: That's a really good point you make there, the diversity of offerings that you have. And one thing to understand is why the insurers are asking all these questions. They're actually not doing it to make our life more difficult. They're trying to gather data, so they can understand the risk in more detail.
So what we tell our clients, and the people on the call today, is don't be afraid to tell your broker or the insurer more information. The more they understand about you, the better they can actually cover that risk, and they'll see you as a more known quantity.
So if somebody happens to be paying for your premium product, the insurance form may not ask the question, but they should export the report that shows all the endpoints, or everything that it touches, and share that with the underwriters. That will give the underwriter confidence that you're a high maturity business and you are operating in a way that reduces their risk.
They're trying to get all that information by asking these questions, but if you understand why they're asking, you can help them. And if you're dealing with a broker who understands the right markets, they can then find the right home for the business. Not every underwriter wants an MSP that does these sorts of activities, but we might find that there are two or three underwriters that do want them once it's more thoroughly understood. That's part of the job of a good broker: to go to those different markets.
Andrew: I suppose to add, we see this as a huge opportunity for you as MSPs to really show and highlight the technology piece, in addition to any ISO certification or Essential Eight maturity, whatever you have, to really make your risk look attractive in the eyes of the insurer. It's just an absolutely cracking opportunity, and this is something Tim and I do every day. We make the risk look attractive to the market.
The impact is you'll have better premiums, and you'll have more options in terms of quotes from underwriters. The underwriters will see it as a better risk. This is a really important component. Dom, have you seen any examples of that?
Dom: Yeah, we had a customer in the midmarket enterprise space who had been on our endpoint and our email product over the last couple of years. I'm not sure what the actual numbers were in terms of their premiums, but it was at a certain level. As we were working with the partner, and the customer as well, we began to upgrade them onto something called Service One.
There are a few points on the screen, but basically that comes with managed XDR, and our team gives you a dedicated technical account manager based in Australia who can do the day-to-day monitoring, as well as the deployment and the health checks. There's also a number of incident response days, so if something does go wrong, you've got a set number of days to help with the response plan. So that ties in quite well.
After they upgraded, like you were saying, Tim, they went back to their underwriters and said, "We've actually got X, Y, Z now, and we've got this incident response plan in place. Do we look any better?" And they were able to reduce their premiums by around 15%. So that was quite a good success story, and we were quite happy with it. That was only just recently as well, so we're hoping to get a few more success stories like that.
Tim: We also see that as a great opportunity for MSPs to actually help their end customers. We tell a lot of MSPs to use insurance as your Trojan horse to have these discussions about upgrading the tech stack. So ask the question: "Hang on, out of interest, how much do you pay for your cyber insurance?" They might say, "Oh, it's a hundred grand program." And you say, "Well, we're proposing you spend a little bit extra this year on risk mitigation in the people, process and technology. If you talk to your broker and take them on the journey, you might find you get a cost saving in the program as well."
We also see that with cyber claims. If you have a cyber insurance claim, when you come up for renewal they'll want to know how you've mitigated that for next year, and that's usually an uplift in technology to allow you to continue that cover. So it's constant improvement in this area, and sharing that improvement. I think the big thing here is you can't sell a secret, so you need to actually share this information with the right people.
Andrew: Yeah, absolutely. And one other thing we really highlight to MSPs is that a lot of the time your customers will say, "Hey, we don't understand the questions in our cyber proposal. Can you please complete our forms?"
Dom: That's a huge thing that comes up with MSPs. A definite pain point.
Andrew: So what we say is that we would strongly recommend you do not complete it. You get dragged into the legal ramifications in the case of a claim, when the client goes, "Well actually, we didn't complete this form, our MSP did." So it actually opens up some exposure for the MSP.
What we recommend is that you get on a call with your customer, go through the questions and share with them where there are gaps. They might say, "Hey, we don't really understand what DR is," and you can say as the MSP, "Well, you've got this, this and this in place." But let the customer complete the form rather than you as the MSP.
Dom: Good advice. I think most of the MSPs I've been speaking to have been completing it on their behalf, so that's a good point, not only for myself.
Tim: And that's the professional indemnity exposure. We've even seen some policies that actually prevent MSPs giving financial advice. Because this product operates under an AFSL, it could be deemed financial advice. So if you had a claim from it, the lawyer might say, "Well, the MSP shouldn't have been touching this document, and it's a financial document." So depending on the policy, there can be areas there you just want to better understand. Again, it's a general statement, and it depends on the specific policy.
The next slide is really about what's in a good cyber insurance policy. But Andy, do you want to give me a bit of a summary: do I need to hold a cyber policy for my customers?
Andrew: The short answer is absolutely yes. We would also strongly recommend that MSPs make sure their customers carry cyber insurance individually, so that in the case of a cyber incident, the first thing they reach for is their own cyber insurance policy, rather than going after the MSP's professional indemnity policy. I think that's another very important point.
What this slide shows is from one of our underwriters in cyber. They're called Emergence, and they're specialists in cyber insurance. We use a whole bunch of others in the market, including CFC, Brooklyn, AXA and many more. But a good cyber insurance policy, as we view it, holds three key areas.
The first part is first party cover. As mentioned earlier, the policy is a first party policy, which means it's actually protecting you as the MSP. The second part is third party, which is actually arming you up to defend claims from other people, like your customers or other stakeholders, who are blaming you for a cyber incident.
Tim: So a third party section doesn't cover my third party customers, does it, Andy?
Andrew: Correct. That's really important. It really pays legal fees to defend claims against you.
The third part of a good cyber insurance policy is social engineering and crime, so cyber crime acts and cyber social engineering acts. Social engineering is pretending to be someone else. For example, we get an email purporting to be from the CEO saying "pay this money away", but the email was bogus, and we pay the money away. That would be an example of social engineering.
So those three areas are: first party cover, which covers your forensics, stopping the bleeding, any communications out to your stakeholders, negotiation around fines and penalties, and payment of fines and penalties, all wrapped up in that first party piece. Then third party, which enables you to defend claims against you as the MSP. And then social engineering and crime.
As I mentioned, we really recommend that those three elements are covered. As mentioned earlier, there are lots of variations between cyber insurance policies, but a good cyber insurance policy should contain those three areas.
Tim: One area we're seeing more, Andy, is that contractually, people are now starting to ask for cyber liability cover. We've seen it with the New South Wales state government on their ICT panel, and other third parties are now saying, "If you want to be providing us professional services, we need you to ensure you have these areas covered."
Quite often, with the misunderstanding around cyber insurance, the cover levels don't typically match the risk. We're happy to help customers in that area, have those discussions with their clients about why first party cover doesn't need certain levels sometimes, and assist in that area as well.
Now the next one, Andy, is something that's very hot in the media at the moment: the Privacy Act.
Andrew: Yeah, absolutely. The background to this is you're probably well aware of the Privacy Act, which is from 1988, and then there's a data breach section that was added relatively recently. In terms of regulation, the view is that Australia is actually quite far behind the rest of the world, particularly Europe with their GDPR, and also certain states in the US. So the view is we are behind and we need to get ahead.
Part of this is Clare O'Neil, the federal minister for cyber. She has an aim for Australia to be the number one cyber country.
Dom: Something like the most cyber secure country by 2030, or something like that.
Andrew: By 2030, yes, that's exactly it, Dom. Which is a pretty gutsy statement, and there's an absolutely long way to go. But as part of that vision, there are upgrades to the Privacy Act. In the last couple of years there has been a review, and 116 recommended changes to the Privacy Act have been drafted. This is all public information, and it's actually worth a read.
One of the big takeaways from it is an increase in fines from $2.1 million to $50 million, or 30% of your turnover. As a knee-jerk reaction to the Optus breach, the Medibank breach and the Latitude breach, the rules around those fines have been moved forward, and that was enacted in December last year.
Tim: And we've seen the insurers have all moved already. We've seen the insurers increase their cover and actually respond in those areas as well, which is great. Sorry to interrupt, Andy.
Andrew: No, you were bang on. So that's happening. We don't know when the remainder of these recommendations will be implemented. Timing wise, there was a rumour it was going to be by the end of this year, but it could be early next year.
So the big takeaways are that the fines have already moved, there's going to be much more power for the regulator, and much more budget for them to be able to go after people with breaches. And there could be a wider definition around what data and what privacy is.
Tim: It'll also sweep up the businesses below the $3 million turnover level, and we see a lot of MSPs in that area. Currently, if you're below the $3 million turnover limit, you don't have to comply with the Privacy Act. But once that's removed, a lot of MSPs that sit in that space will have these compliance requirements in a breach.
We see the insurance mechanism as a great way to address that in your incident response plan. What do you do in a breach? How do you actually inform everyone whose personally identifiable information is affected? You could use the insurance response to meet that need.
Andrew: I'm glad you raised that, I'd missed it. Just as a stat, out of all the businesses in Australia, 92% of them turn over less than $2 million. At the moment, the limit under the data breach rules is $3 million turnover. As mentioned, that will be removed, so all these businesses will now be captured under the Act.
Dom: Amazing. Fantastic.
Tim: We'll just quickly rip through the last little bit, as we're getting a bit tight on time here, Andy. Basically, what's scary for our MSPs and their customers? We see professional indemnity and cyber insurance, which we've spoken about previously, as the big ticket items. But if you're talking to your broker or looking at your policy, there are things to hone in on. As much as I think they're wonderful, fascinating documents to read, not everybody does.
So go straight for the insurance exclusions. They're the things that aren't covered. We're seeing more and more insurers put things in there like ransomware and financial advice, areas where you might be offering services. If they've excluded it, you need to answer the question: is that the right policy for you? And also, what will you do in the event of a claim where the policy won't respond, or won't be there as that risk mitigator?
We apply that lens to a lot of things. A common one now is ransomware exclusions, or co-insurance on ransomware, which tries to limit that exposure. We don't see it from all providers, so if you have a provider that is giving you a ransomware exclusion, shop it around, and the best place to do that is with a broker.
On changes to the Privacy Act, we've touched on that, but we'll see the structure of policies change as they're adjusted to address the changes to the Privacy Act. And crime and social engineering is a big one there as well. We like to say consider it, because there are so many examples of it happening. It's a bit of a shame, but people don't talk about it. When you start to chat to other business owners, we see a lot of our clients who've experienced it, and not all of them have coverage in those areas. It can be quite costly and damaging.
The second claim, just quickly, was when your customer is hit by a ransomware incident, which is something we've touched on in the previous example. This particular MSP had what they thought was a watertight contract, where they tried to limit their liability. This is something we see happening a lot with MSPs. We're not lawyers, and we want people to seek professional legal advice. But we inevitably have to share your engagement contracts with underwriters, because they want to have a look at them to make sure the terms and conditions you put on your clients are fair and reasonable.
Just to skip to the punchline here: unfair contract terms have become something that's very commonly getting unpicked by the courts. An MSP might say, "We've limited the liability of what we can actually be held accountable for." These are getting thrown out in retrospect when the claims are being washed through.
So how can we help everyone? Basically, Andrew and I at SherpaTech have run insurance programs for many companies, and when we first engage a company, we almost test the policies like it was a claim. To do that, we run our insurance health check, where we basically measure the nuances and the activities of your business against the policies you currently hold. We usually charge for this service, but for the Trend customers on the call today, we'd love to help you out.
The perfect time to do this is actually not when your policies are renewing, because when your policies are renewing, you're inevitably chasing the cover you're trying to renew with. We find that if we can help you with this out of cycle, we can then give you advice around things to improve in the program. If they're very important, you can address them immediately, but otherwise they can just form part of your renewal cycle at your next checkpoint. Andy, is there anything else you'd like to add on that point?
Andrew: I suppose at worst case, after the insurance health check, we can respond to you and say you've got the best insurance program possible. But as night follows day, we find gaps in cover, we find perhaps some price efficiencies, and a bunch of other things. So we'd be very happy to help you with reviewing your insurance program through our health check.
Dom: Excellent. I think we're about two or three minutes over. Just on this slide, in the post-event email I'll make sure Tim and Andrew's contact details are included, if you do want to reach out directly. So feel free to get in touch with us.
But Tim and Andy, there is one question that has come through from Phil that we've got a bit of time to go through. Philip is a small MSP, and he's wondering if there's any entry level PI and cyber insurance that would be cost effective but still provide the necessary cover. Do you have any recommendations or a few tips for Philip?
Andrew: Sure, I'll jump in, and Tim might have another view. The lowest PI is $1 million, and cyber is probably around $250,000. But it probably needs a bit of a discussion, Philip, in terms of understanding what your exposures are, who your customers are, and maybe a little bit of digging around your contracts. So it probably needs a discussion.
Tim: I suppose as well, Andy, just to highlight to everyone, SherpaTech is actually an online portal for insurance as well. We have an online offering where smaller MSPs can go direct and buy online. If you go to our website, sherpatech.com.au, you can price some of those policies directly online, and you can bind that insurance straight away.
For the more sophisticated MSPs, as Andrew's articulated, we take a more consultative approach. But many smaller MSPs just buy directly online, and it's a bit of a zero-touch engagement if they need it. That was actually how we started SherpaTech, because we recognised that so many MSPs were using paper-based forms and found the insurance renewal process quite challenging. So we've built a zero-touch platform there as well to help smaller MSPs.
Dom: Lovely. I didn't actually know that, so that's good to know.
Tim: We also do the sophisticated stuff quite well.
Dom: I know we're right on 11:45, so I'm not sure if the marketing team will cut us off at any moment. But Tim, you mentioned in one of the slides at the beginning the MSP that was quite successful, with only two out of 50 customers coming back to them. Was there anything in place from the MSP's perspective that helped them along the way? Obviously you mentioned they had good communication, they were responsive to their customers and kept them in the loop. But did they have anything in their security stack that stood out to you guys at all?
Tim: In this example, they didn't highlight the security stack as much as good business process and documentation. Evidence is the most important thing when you come to a claim, and one of the things a good security stack does is usually give you granular data about what happens through a process.
We always talk about how, especially with insurance, you need to prove things. So any stack that gives you history, logs and evidence is hugely important. You should always approach problems or challenges in business with the perspective that you might have to prove what's going on at some point. So evidence, logs and data are hugely important there. Andy, anything else?
Andrew: I cannot overemphasise the need for documentation, and for recording what your customers agreed for you to do, the changes that are being made, and changes in scope.
Dom: I guess that ties in well with why you guys think customers should fill out their own questionnaires rather than handing them over to the MSP as well. You're never sure what's going on, and you could be drawn into their claim, because you're providing the advice.
Tim: Exactly. Well, it's been amazing to be on today. Thank you, we've really appreciated it.
Dom: No, thank you very much for jumping on. Like we mentioned earlier, we'll make sure we send through the slide deck and the recording to everyone on this webinar, and we'll pass on Tim and Andrew's details as well if you want to get in touch with them directly. You guys are in Neutral Bay in Sydney, and I think you mentioned you're going to Melbourne in a few weeks' time as well. I think there were a few people from Victoria who joined. Well, enjoy the rest of your day everyone, and especially Tim and Andrew.
.png)