Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Will Brooks - The Cyber Insurance Evangelist
95 Plays1 year ago
Abe was joined by Will Brooks - The Cyber Insurance Evangelist at Fifth Wall Solutions, to lift the curtain on the fast-evolving world of cyber. Will recounts his unique path from ministry to math to wholesale, drawn back to insurance by the tech focus of cyber insurance.
He provides an inside look at Fifth Wall and their unique strategy of focusing on cybersecurity maturity by partnering with MSPs. We discuss the education gap amongst agents and the need for basic cyber fluency. Will shares his outlook on the cyber insurance market, the value of verified controls, and his hope for carriers to reward policyholders' cybersecurity investments.
Throughout the unfiltered conversation, Will stresses that cyber insurance must be part of an overall cybersecurity strategy. With infectious passion for demystifying cyber, he epitomizes the next generation of our industry. Tune in for an enthusiast's take on bringing clarity to the wild west of cyber insurance!
Recommended
Transcript
Introduction to Cyber Insurance with Will Brooks
00:00:19
Speaker
What's going on everybody? Welcome to the ensure sec podcast, where we talk about all things, cyber insurance and cybersecurity, and really where the two intersect. Today is an exciting day for me. I get to chat with Will Brooks. He is a cyber security and cyber insurance evangelist. He is just like me, former ministry staff, my brother in Christ, Will, how's it going, man?
00:00:48
Speaker
Good, man. It's awesome to be on this call. Yeah, weird how we find ourselves in completely different roles, but still spreading the good news about something. Yeah, exactly. Exactly.
Will Brooks' Journey: From Tech to Ministry to Insurance
00:00:59
Speaker
Well, usually what we try to do kind of in the beginning is get everybody up to speed on who you are, where you've been, how you got here. I always say you can start with two people fell in love if that's how far you want to go back, but really just take it from wherever you feel is most relevant.
00:01:16
Speaker
Yeah. I mean, me being here goes back way further than me falling in love with my wife, but you know, it's all good. Oh, you mean like my parents, your parents. Yeah. Oh, it's a long time ago. Wow. Yeah. I don't even remember that far back, but, um, yeah. So, I mean, put it simply, I've always been kind of a tech nerd, not to tell people, Hey, breaking into the tech industry is really hard to do.
00:01:38
Speaker
Um, it's something I've kind of wanted to do. I minored in computer science, majored in math, and I should have flipped those things. Um, because I got about midway through my junior year and I was like, oh, computer science is awesome. And math is annoying on a high level because it's all proofs and stuff. So by then it was too late. I didn't have the funding going. So I just held the course, but then.
00:01:58
Speaker
You know, like you said at the beginning here, after I graduated college, I don't want to do math, so I'm going to go into ministry because my life was radically changed by the gospel in my junior year of college. So I moved into that and spent like five years
00:02:15
Speaker
Well no okay so I was in seminary for three years and then when I graduated seminary I moved down to the Virgin Islands for a year and a half and it was doing youth ministry down there and I it was just like a one year it was actually officially a one-year contract I started down there before I was on contract after the contract was over I moved back to Long Island where I live now moved in with my parents which
00:02:35
Speaker
at the ripe age of 27 is nothing you really want to do, but I had to, and I needed a job. So I walked down the street to an insurance agency that was two blocks from my parents' house, and I just walked in. Nothing about insurance. I just knew I needed a job. And I talked to my boss.
00:02:52
Speaker
Well, before he was my boss, but I talked to him. I said, so I need a job. And he said, what do you know about insurance? And I said, well, I know you need it. And he said, he said, well, we're in the business of taking risks. So I'm willing to take one. So he hired me on and I started doing property and casualty insurance, you know, selling business, business liability and general liability and commercial property and all that fun stuff. And.
00:03:16
Speaker
I hated it. I had no desire to be in insurance, especially coming off ministry. You're like, I was doing this ministry thing. Now I'm selling insurance. I feel this stinks. I don't like this. And I was in an office where I was, other than one other guy, I was the only person under the age of 50. And again, I was 27. So it was challenging because I'm, again, I'm very tech minded and
00:03:40
Speaker
I almost fell into a tech support role, even though I was in sales. So anytime something went wrong, they'd be asking me to come fix their computers. And it's like, don't we hire a third party IT person for this?
00:03:53
Speaker
Uh, so that, that kind of got annoying. So I actually ended up leaving after about two years in that role. Um, and was like, I'm leaving insurance behind.
Finding a Niche in Cyber Insurance
00:04:01
Speaker
I'm going, I found the job at a church in kind of in the middle of Long Island, Seville, um, as the name of the town, um, was working there. And then in 2020, I got married and, um, living on Long Island is not cheap for one person, let alone two.
00:04:18
Speaker
And it quickly became this kind of thing. Well, I feel called to this place. I want to stay in this place, but at the same time, I do not have the income to support that calling. It's almost like this thing where, okay, I feel like I'm supposed to be here, but the money I'm making in the ministry role doesn't work. And that's when I actually stepped down formally from working at the church. I still preach, I'm still really involved, still doing lots of things, but I stepped down formally
00:04:42
Speaker
and started working in financial advising, went through all the training, did all the series, uh, the series six, 66 or series seven, like all these, I don't know, all those weird things you have to get and passed all those tests and got to the point where it's like, okay, you could be a financial advisor. And within a day, I was like, I hate this too. I do not want to do this. Um, and so I was like, you know what, I need to make money for my family. I'm just going to keep
00:05:08
Speaker
going and that's when a friend of mine approached me and said hey fifthwall solutions is looking for a new account manager.
00:05:13
Speaker
And I, you know, quit Google a fifth wall solutions. It's like, Oh, they sell insurance. Great. Great. You know, and then you fall back into that world. But then when I learned that it was only cyber insurance and I studied up a little bit on cyber insurance, it's like, Oh, this is different. Um, growing up, growing up, uh, technology in my home typically broke because of me. So I would be taking things apart, putting things back together, figuring out how to, you know,
00:05:41
Speaker
play with the internet in a way that my parents didn't want me to do, like, downloading things on the computer that probably caused viruses. I don't know. I was a kid. But it's the kind of thing where now that desire to dive into the tech industry kind of took a direction that only wouldn't have been able to take if I had not had those couple of years in insurance. So I look at that and I say, OK, my license had expired, so I have to go retake that stupid test.
00:06:07
Speaker
And this is where things get so crazy is the test had 170 questions. It's different in every state, but the New York state won 170 questions. One of those questions was about cyber. It's wild. And you
Cyber Insurance vs. Traditional Insurance Lines
00:06:19
Speaker
know, it's wild. It's like, but that was, that was, so it was the kind of thing where I studied my butt off. I got like a 92 or something and my boss told me you overstudied and he was right.
00:06:29
Speaker
But I started my butt off past the test and then immediately dumped all that information. And that was like the weirdest part of it. But now all I do is this cyber insurance stuff. And it's awesome because it's very tech minded. People don't typically understand it. And it's I don't know. It feels different from other lines of insurance. I mean, feel the same way. Oh, yeah, absolutely. It almost seems like there's like there's like
00:06:57
Speaker
personal lines and then there's commercial lines and then there's cyber. Yeah. It's kind of like its own thing, its own world. No, totally. And like the cyber component is, I don't know. It's like with a car. When I, when I used to have to write a car insurance policy, it was check this, you know, check these boxes off. Oh, daytime running lights. Yeah. Airbags. Yeah. Great. Um,
00:07:19
Speaker
those.
00:07:37
Speaker
in reality, and you know, like the ensure sec name implies, it's actually part of the overall cybersecurity strategy. It's not just this thing you go get. And so it's like, it is its own, it's a different world. And it's a way to get in to the tech space, but from an angle that I never thought would be one that would get me there.
00:07:57
Speaker
Yeah, that's a really cool story. It's really interesting. I had a similar experience with ministry too, where I was in Fairfax and I was on staff hired to be a worship leader.
00:08:16
Speaker
Fairfax is probably a lot like Long Island, really expensive right outside of DC. My wife and I just got married and we were living in somebody's basement and paying like 1700 bucks a month for a studio basement apartment. I'm like, man, anywhere else in the country outside of a major...
00:08:36
Speaker
I could be living in a mansion in other parts of the country. But yeah, we had the same experience and then it's just kind of weird. There's something about this industry and what I find really interesting about your story is that you were in insurance at one point and then you came back.
00:08:56
Speaker
And you think that was generally just mainly because of how different cyber insurance is to other lines. If it would have been like fifth wall solutions with like a generalist wholesaler, do you think you would have been as interested in joining?
00:09:14
Speaker
No, I mean, I think if I had to do anything other than cyber, I probably wouldn't be in insurance right now. I mean, it's just the amount of time and effort it takes to focus solely on cyber insurance, mainly because it's changing so much. You just kind of have to keep up the continuously. There's always fun things to talk about in the cyber insurance industry, which sounds hilarious, fun talking about insurance. But like the news side of things, there's, oh, this incident happened. Oh, Clorox got breached.
00:09:43
Speaker
Casinos are getting breached. There's so many incidents that are happening. Then to be able to boil that down to something that the small business owner or the medium-sized business owner can comprehend in a way that's like, oh, well, I'm not a massive casino. Why do I have to care about this? There's always new ways and angles of approaching it. I don't feel like I'm
00:10:05
Speaker
I don't feel like I'm burning businesses down, I guess, in my role, whereas in the other insurance space, you go in and you literally are selling fear. And I think that's probably the angle I love is that here in the cyberspace, because it's talking more from the viewpoint of overall cybersecurity,
00:10:24
Speaker
It's just, it's, it's all kind of bundled into one conversation. You're not going in there and saying, well, let me tell you about all the terrible things that can happen to you. Um, kind of are still, but it's, it's in a way where it's saying, Hey, look, all these controls you have to get in place to get a policy are meant to protect you so that the bad things don't happen. But people are terrible and bad things still happen. So we want to make sure that if something were to get through, you're protected. And that's, I like that approach. It feels less slimy. Yeah.
00:10:55
Speaker
Yeah, for sure. So wait, hold on. So going back, you were a worship leader, so you play guitar? Yeah, of course. Classic. Classic. I can't do anything except play pretty basic chords and sing, which is pretty much 90% of worship leaders kind of skill set.
00:11:16
Speaker
Yeah. I'm, I'm like, I like to say I'm a jack of all instruments and master of none. Cause I grew up playing piano and then I have guitar, but I dabble in the banjo and
Specialization of Fifth Wall Solutions in Cyber Insurance
00:11:28
Speaker
I do other things. I'm like, I don't know how to do any of these well, but they're all fun to play. That's it.
00:11:34
Speaker
I'm sure you probably can sub in on like, uh, what does it call it? Cajon or. Yes. Or something. Uh, I love my Cajon not to be confused with the other thing that sounds a lot like it. And I realize people listening in might not understand what a Cajon is, but it's a drum. You sit on the street, like a box. Yeah, exactly. I realize if you're not like involved in a church, you probably have no idea what that was or you have no reason to ever see one. Cause I've never seen one outside of the setting of a church.
00:12:03
Speaker
I feel like a church and maybe if you were to go to like some hipster bluegrass concert in a black box theater and that's probably the only way you'd see it. That's so funny. Drum set in the box. Yeah. So you're kind of give us an overview. Fifth wall, obviously I'm a wholesaler. Fifth wall is a wholesaler. I've always had a lot of respect
00:12:29
Speaker
Really ever since I've got introduced to what you guys do and your approach to cyber insurance and really compared to 99% of other wholesalers out there, which I would call most of them generalists, where
00:12:46
Speaker
Cyber just kind of got lumped into specialty lines and you had these people that had been writing management liability, professional liability for decades. And well, this is cyber insurance. So I guess we have to offer it now. It's not really one of their specialties. Fifth wall is obviously very different. Um, take us through just kind of an overview of fifth wall, what you guys do, what your role is there, how are you guys different? Cause I think it's, it's, it's really interesting the way that you guys approach it.
00:13:13
Speaker
Yeah, so we were birthed out of a general wholesaler. So one of I guess the story goes in 2016 or in 2015, the two of the owners of fifth wall were
00:13:25
Speaker
hanging out by a bonfire, sharing some bourbons, and said, hey, we should get into the cyber insurance game. And then, apparently, no one else knows what that conversation looked like after that point. And then the next day, fifth wall was the idea. And time we ask, what the heck fifth wall means, nobody knows. So there's that piece too.
00:13:46
Speaker
makes no sense. So we make it up sometimes and I sometimes have like different definitions that I'll just toss one out. None of them are vetted or verified. But it was this kind of thing where this massive regional wholesaler in Pennsylvania said, wow, cyber is going to be a thing, but we want to create our own offshoot. That's no way part of our general wholesaler that's purely focused on this cyber piece and nothing else.
00:14:12
Speaker
And the reason for that is like we talked about the rapidly changing nature of the industry and how there's so much content. We got started in 2016, which was when cyber was really a baby. I mean, it was around, but all you needed, I like to say all you needed to get a policy was
00:14:28
Speaker
show that your business had a pulse, right? You had to show revenue numbers and a website. I think that was like, yeah, it was so easy. And then with the pandemic and all this kind of stuff that happened, I'm so thankful that I work for a wholesaler that does only cyber because that's when underwriters started to get serious with all their security controls and whatnot. So
00:14:49
Speaker
Fifth Wall started as an agency-only wholesaler. For those of you listening in who aren't familiar with wholesale, it's this idea that you have some insurance companies that say, you know what? I don't want hundreds of thousands of agents calling me for quotes every day. I'm going to contract out with these businesses that
00:15:08
Speaker
are my points of contact for all those agents rather than having to work with all of them. So, you know, like you, we would work with agents and we'd say, hey, look, we can handle the cyber book. So you don't have to handle that. And you can focus on all that other stuff that you know really well.
00:15:24
Speaker
And to my experience, when I was working at that insurance agency, when I first moved back here, cyber was really challenging for them because most of them were not tech savvy at all. So then ask someone who has no idea even how to attach something to their email.
00:15:41
Speaker
all these questions about cyber insurance, it would have been really complicated. So with fifth wall, our whole goal in our agency space is to simplify cyber insurance. When we worked with agents say, hey, we'll, we'll, we'll help provide you materials and education and all this stuff on how
00:15:58
Speaker
to best explain all these coverages and how to work through that stuff because we weren't selling directly. The agents were the ones selling. So at the end of the day, we had to teach the agents to sell, but then once they were ready, they could come to us. We get them quotes and they get their commissions and all that good stuff. And then when things went crazy in 2020 with the pandemic,
00:16:19
Speaker
carriers started asking for a lot more in terms of security, and that's when we created a second channel that focused on security providers.
Role of MSPs in Cyber Insurance Applications
00:16:28
Speaker
So now we partner alongside security providers to make sure that they understand, one, they understand the right controls, but they're being inundated with all these different applications and stuff, and now they're being brought in
00:16:40
Speaker
to the cyber insurance application process and it's a pain for a lot of them. So our goal is to help kind of review client policies, do some risk analysis on what would make their clients better risks to the carriers so that it eliminates a lot of that renewal chaos that was happening for a while there. Yeah. It was a real over broad review. I love it because the
00:17:06
Speaker
The strategy, and you can correct me if I'm wrong, but when you say security provider, I would assume in general, it would be MSSPs or MSPs that work with
00:17:20
Speaker
I guess they all depend on the size, but local businesses or regional businesses, and they're the IT point of contact for most of these smaller businesses that don't have that service in-house. In many ways, they would need to be involved in this process.
00:17:39
Speaker
especially now as questionnaires for cyber insurance have gotten more complex and detailed. If they're not in a setup that you guys have made it really easy, they would still need to probably send this application to their MSP to get some clarity on some of the answers.
00:18:03
Speaker
Has the strategy been to work with the MSPs to help them secure cyber insurance for their clients or their clients coming directly to you guys? How does that generally work? Yeah, it's weird, right? Because MSPs can't sell insurance because they're not licensed to sell insurance. So at the end of the day, it functions literally like a wholesale channel. I mean, they
00:18:32
Speaker
bring up the idea, but we have to be the ones to actually provide the policy. So, um, and that's putting it real, real lightly, but really when it comes down to it, MSPs were getting these cyber insurance applications from their clients that they had to fill out, but the MSP is like, I don't want to fill this out. What if I answer something wrong? What if I do something incorrectly? Um, that's going to lead to the policy not being effective. Cause there's stories out there of misrepresentation on a policy saying you had MFA and incident happens. You didn't have MFA.
00:19:02
Speaker
guess what, now you have no coverage. So it's the kind of thing where MSPs get nervous about that. There's all these, there's legal counsel they're getting now saying, don't fill out those apps, you can advise on them, don't fill them out. And all that kind of stuff. So it got to the point where MSPs were afraid to fill them out. Clients were going to lie on them. So it's like, who's going to get this done? And so it's kind of our process has shifted
00:19:28
Speaker
I know there's a lot of different takes, but ours is just to work alongside the MSP to verify and get to the point where we know that the client's going to be a good risk to the carrier before we submit it to market.
00:19:42
Speaker
rather than play ping pong with the carrier until everything that needs to be in place is in place. And I mean, sometimes you can't avoid it because the nature of the business, you know, I mean, you work with, uh, clients in a certain revenue tier and you know, when you get to that revenue tier, everything you need to, to make sure the client's a good risk and still the underwriters may have more questions every time you can limit the questions. It adds a lot of value and cuts a lot of time out from the process. Yeah.
00:20:11
Speaker
Yeah. So in this process, what are you specifically doing? Are you working with MSPs? Are you working with the individual businesses? What is your role? Yeah. I mean, I'm so thankful. I told you when I started at an insurance agency down the block from my parents' house, I hated it.
00:20:32
Speaker
I don't really have sometimes it happens. I mean, we're a small company, so get pulled into different roles. I don't do a whole lot on the sales side. Um, I can when I have to, but I'm glad I don't have to a lot. I have an amazing sales team behind me that handles that stuff. Um, so I, I'm kind of top of funnel. So I think like channel manager, I'm managing all the MSP relationships filling top of funnel.
00:20:55
Speaker
Managing vendor relationships is a ton of vendors in that space and they're all offering those security controls that end up on applications and they all want to know if you can bet them for the applications I know I cannot but we can have conversations about how your product is helpful and
00:21:10
Speaker
We're happy to co-market with you, right? So there's all those conversations. But at the end of the day, my role is really to make fifth wall relevant in the space and keep it relevant. That's how I would probably put it on a real basic level. So, and then get feedback. If something seems awkward or tough for an MSP or they don't understand it, how can we better educate them? A lot of education from our part. So I do a lot with webinars and
00:21:37
Speaker
podcasts like this one and just jumping on and having conversations around cyber insurance. It's amazing. You're on LinkedIn. So it's amazing how up until this job, I used LinkedIn a little bit, but I only ever think I used it for when I was looking for jobs and stuff. I never changed it as a community. And it's the only form of social media I like using now. I mean, I hate social media. I've always hated social media, but
00:22:04
Speaker
LinkedIn is different. I don't feel like I'm being targeted with ads and things like that in a way that you are more Instagram, Facebook, things like that. Just feels more professional. It's a really encouraging community. There's far fewer trolls. I mean, I use Reddit too. Reddit is full of trolls, but that's different. I'm one of those trolls on Reddit.
00:22:28
Speaker
Uh, it's funny. Yeah. It's uh, it's, it's so true. And, uh, LinkedIn is, is interesting because
00:22:39
Speaker
I feel like I know people on LinkedIn just from us interacting and direct messaging. And like, I don't even have to like hop on a call with them. And I already feel like I know them. And then we hop on a call and it's just like, you feel like you know each other. It's a weird, it's a weird, uh, phenomenon and just like how, how easy it is to connect with people. Um, like I, without LinkedIn, obviously we would not be sitting here talking. Um, which is a pretty cool phenomenon.
00:23:08
Speaker
It's so true. And what, something I love about the channel. So the MSP side of things, and do you work with managed service providers too?
Community and Collaboration in Cyber Insurance
00:23:15
Speaker
Very, very, very rarely. Okay. Yeah. Your focus is more around the agency space, but, um, right. So with managed service providers, and you probably see this cause I know a lot of MSPs follow you, even if you don't work directly with them because it's helpful information and they like are chomping at the bit for cyber insurance education. So, um,
00:23:33
Speaker
On top, on that, like it's so interesting to me. Like I go to these conferences for MSPs and they're technically competitors, right? I mean, especially when you have like four from the same town coming to the same conference, it's probably awkward on some level, but it's also at the same time. Like I look at the MSP space, I look at LinkedIn, I go on, I I'll, I'll help out with these webinars for certain vendors and there'll be tons of MSPs on there.
00:23:59
Speaker
And the community is actually legit. Like even though we may technically be competitors, we're also here to support each other in a weird way. Like we want to give advice. Some of it's really toxic on Reddit, but in other places it's really helpful.
00:24:11
Speaker
And just that there's almost like this side of things where it's similar to what we're doing. I mean, you're a wholesaler. I'm a wholesaler. Technically, we're competitors, but at the same time, it's weird. It's just the nature of the space and the nature of it. It's not like you're the agency next door to mine in the same town where it's like, oh, we're going after the same clients and all this kind of stuff. It's really like, oh, there's actually knowledge and helpful information to be shared between the two of us.
00:24:39
Speaker
Let's talk about it. And I see that in the MSP space. And I think that's one of the things I'm so encouraged by in that space is people are willing to learn and understand. And the ones who succeed are the ones who are willing to not just learn, but then take what they learned and teach it to their clients. And it's just, it's an amazing community and I love being a part of it.
00:24:57
Speaker
Yeah, it blows my mind. I saw it in the retail agency channel, this collaboration. I haven't seen it much in wholesale, outside of the smaller wholesalers, not like the big four or whatever they call themselves.
00:25:22
Speaker
Yeah, before technical term. Yeah, technical term. I don't think it's talking about sports, but it's not. Let's be real. Yeah, it's actually, yeah, it's actually insurance retailers.
00:25:33
Speaker
But yeah, I mean, I think that's a that's a great point, right? Is typically, when you talk to an agent and they go access their wholesale on most agents I work with you when I was working at that local agency, we'd access one of the four, right? Because they're just there, they're out there, they have their marketing budget, they get out there to everyone. But
00:25:54
Speaker
Being a cyber specific wholesaler as well, I just think there's, there's something to it where you have the collaboration, you're a smaller, you're a smaller wholesale, which honestly, when I think about it, it sounds really funny because you have access to all these carriers out there, but you're just a little tiny guy.
00:26:09
Speaker
It's like, oh, cool. There is collaboration and you don't just feel like a cog in the wheel, you know? And even with the agency relationships you have, they're relationships. It's not just, um, Hey, email this one contact that's been assigned to your agency and just email back and forth. There was, when I was, when I first started at fifth wall, I was on the agency team.
00:26:31
Speaker
And my job was to call agents and talk to agents and literally have to call them up and say, so what do you got on your desk for me? What do we got going on? And when I worked in retail insurance, the wholesale, I never talked to my wholesalers. I think maybe once in the two years I was there, I even heard from them. Usually it was just submit this risk to them. And it felt more like a.
00:26:51
Speaker
It felt more automated, it wasn't, but it felt automated, right? And I think to this day, business, and you see that in the MSP space too on the business side, it's all, it's relationships. Without the relationship element, things are a challenge. So that goes back to your point of question before we come in with, we don't treat our MSP channel as a referral program. It's not, oh, go talk to these guys at fifth wall, they can get you set up.
00:27:17
Speaker
We want MSPs to understand that we're coming in to effectively be a wing of their business, that they're not licensed to be. So we're able to have those conversations and advise their clients on cyber insurance and review policies and help them understand the nature of their risk. And I think they really dig it because, I mean, you know, from the insurance base, like if
00:27:39
Speaker
If a client brings their policy to you and it doesn't expire for nine months and it's a good policy, you're not going to say go cancel it and take mine instead. That's bad practice, right? So it's the kind of thing where MSP see a lot of value because they're not, they're not bringing us in as sales guys. I mean, they're not saying, Oh, fifth wall can come in and get you a cheaper policy. Some of them have had those conversations and they usually are a little awkward for them. I was like, don't sell them the cheap policy. If we have to sell them policy, that's our job. We're the salespeople, but you sell that service and say, Hey, look.
00:28:09
Speaker
It's really important to us as an MSP that our clients are able to withstand an incident because it's impossible to protect from 100% of them. So we want your policy reviewed. And when we get to go in there and tell a client that you have a great policy and it doesn't renew for eight months,
00:28:24
Speaker
Uh, here's all the coverages you have and here's what they mean. Wow. I, this is awesome. And now they've had that vetted review. So they feel good about themselves. Right. And that's it. Um, and the MSP looks really good and that's been a really cool part of our whole relationship with them for sure. So.
00:28:43
Speaker
Obviously, the MSPs have this technical expertise in terms of IT and probably some more than others within cybersecurity.
00:28:59
Speaker
Like how much is your role, but also just fifth wall in general, how much is the role on educating the MSPs on what controls are important? Obviously there's change to an extent, but generally speaking over time, we keep seeing time and time again, like these kind of basic core controls are really
00:29:26
Speaker
what's most important regardless of what new exposure comes out. Are you guys educating the MSPs as much as you're educating the clients of the MSPs? Are you helping them just educate on cyber insurance or just kind of take me through the education piece? Because it seems like that's a huge part of it. I mean, core controls are what the MSPs want to hear about. I mean, if your controls are required by cyber insurance carriers, then
00:29:56
Speaker
That's great for you because now your clients are going to get a policy because your clients are only going to get a policy if you're able to equip them with the right controls.
00:30:04
Speaker
We kind of try to treat it like it's two separate lanes and we say, hey, we're going to set you up to land some business here, to better equip your clients, to better mature their cybersecurity understanding or posture. And then if the situation allows, then we'll come in with the policy. But at the end of the day, if they have a policy in place and they don't have the core controls, then it's either a bad policy, they misrepresented their security or
00:30:30
Speaker
They were able to get through last year and the carrier was okay with it, but this year chances are they won't. So it's like that kind of conversation where if we can keep them moving forward, but one of the benefits that I'm seeing.
00:30:41
Speaker
Just for client end clients like you just the end client side When every year you're having a conversation now that oh just a little bit more is required of you in terms of security Just a little bit more is required now or just a little bit more every year It's starting to help them understand that cyber security is not stagnant like it's not like
00:31:01
Speaker
My MSP came in and equipped me with all this security when they first onboarded me six years ago. I'm never going to have to change my security posture. That's not it. It's not like getting an alarm system installed at your house and you're going to go forever. There's going to be new threats that emerge and even though carriers are two years, three years behind on what actual good security is,
00:31:22
Speaker
It's at least getting people and moving in the right direction. So it helps them understand the maturity piece. And that way when, and I mean, from the wholesale side, right, if you can help them save some money on their insurance, now they're not breaking their cybersecurity budget on a super expensive insurance policy. So they have a little more space in the budget to get more controls and better security in place. That's kind of the MSP at that point, where it's like,
00:31:48
Speaker
Hey, you know what? I'm not going to sell your controls as much as I don't want you to sell my policies. So I'm going to set you up. But then from there, you handle the conversation, you handle the budget. We're just there to support you. Yeah. This is kind of a kind of like taking the conversation in a different angle. One thing that I've been talking with a lot of people recently is it seems like we
00:32:15
Speaker
You know, we got through COVID and, you know, we're talking about losses that, I mean, just completely, completely negate, like,
00:32:28
Speaker
20 years of profitability on the carrier side. So we've made it through that. So I think that there's a, there's a level of sustainability to cyber insurance that I think there's a lot of people that are a little bit too pessimistic, but I'm kind of curious what your,
Market Strategies and Growth Potential in Cyber Insurance
00:32:42
Speaker
what your thoughts are. There seems to be a lot of people trying to buy market share right now and their underwriting guidelines are soft. Their appetites are like wide open pricing's like incredibly cheap. And it's like six months ago,
00:32:58
Speaker
we probably should have learned from these lessons, right? What is your projection and kind of outlook on cyber insurance kind of over the next six months and then more broadly speaking over like the next five to 10 years?
00:33:13
Speaker
Yeah. Um, I guess my immediate reaction to that is, and you hit the nail on the head, you have people come on the scene who are trying to get up market share. So they almost like open their book up for business. They're like, anybody, they go Oprah on the policies, right? Like, you can get a policy, you can get a policy. Who cares? Um, and you're like, what are you doing? We saw how this played out. Um, but again, like you said, they're trying, it's a strategy. They're trying to buy up market share. I mean, if you can get,
00:33:39
Speaker
If you can get, I guess, X amount of dollars on your book and you run the risk of a ton of cyber incidents happening, but I guess if you can get through a year without those incidents happening, now you can require the security controls and you have a ton of money sitting in your pocket. So it's probably a risk game.
00:33:56
Speaker
which I don't understand from the actuarial standpoint because like I said, I didn't progress past my undergrad in math. But yeah, there's probably some level there where it's like, okay, this is worth taking on this risk because if it plays out, then we do really well for ourselves and then we can get strict on things and raise prices and all that kind of stuff, but we'll be in a good spot.
00:34:17
Speaker
I don't think it's wise, but I know they do. I think the weirdest thing was, if you probably heard about it, back in December when there was all that speculation of the cyber insurance market not being sustainable and cyber insurance was going to fall apart.
00:34:32
Speaker
That was huge in the MSP space. One thing I've learned in the MSP space is as soon as there's any sign of potential destruction from the inside, everyone wants to talk about it. It's like, oh, cyber insurance is not going to happen anymore. It's going to be gone. Yeah, cyber insurance is dead. What are you talking about? But it's that kind of thing where it's not sustainable. It won't survive. And when we actually would put the numbers up and say,
00:34:59
Speaker
I loved at the end of 2022 when the reports started coming out that, hey, our loss ratios have actually gotten way better and there's premium increases are
00:35:15
Speaker
This is always a weird thing to phrase. There have been less of a premium increase on policies. So it's not that the policy cost is going down, but the premiums have not increased as much, which tells us a couple of things. One, the cybersecurity controls work. They're actually helpful and it's good that they're being required. And two, maybe the pricing is
00:35:34
Speaker
now where it should have been all along. So it was kind of jarring when it first happened because people were getting their premiums forexed on an annual basis. I paid $2,000 last year and now I have to pay $8,000. And it was really confusing and frustrating for a lot of businesses.
00:35:50
Speaker
But now seeing loss ratios go down, it does show that, OK, maybe there is something to having good security. But there's also the reality that cyber incidents still happen. Loss ratios aren't perfect. They still had incidents. And that's always going to happen. So if they can at least mitigate them and have less and fewer and have the right controls in place that even when an incident does happen, it's able to cut it off quicker. All that kind of stuff is so important.
00:36:18
Speaker
So I mean, I think short term, but then long term, I mean, I, I don't remember where I read it, but there was something and it makes sense with how much of the world is remote. Now there's speculation, which is what insurance always is after tomorrow. Um, it's, it's, uh, there's, you know, there's a speculation that cyber insurance could potentially surpass commercial property, which is huge. That was always like the biggest line commercial property. Oh, you own a skyscraper. Oh, this is going to be policy.
00:36:47
Speaker
Now you have businesses selling off their property and saying, we're, you know, 80% of our employee base is remote now. So you see that and you're like, oh, there's a difference here. So I think there's also that side. And the uptake, like the actual interest in getting cyber policies is going through the roof. People want them. And that's where MSPs see that success of leveraging
00:37:13
Speaker
cyber insurance using, leveraging their controls using cyber insurance. It's like, oh, my clients want cyber. So if I just tell them you can't get it without these things, they'll get the controls. It just, it makes sense. Yeah. So how much of the, uh, the conversation around controls, if we look at claims frequency, it seems to me that
00:37:40
Speaker
that cybercrime tends to be, you know, recently cybercrime and ransomware.
Importance of Security Awareness and Training
00:37:45
Speaker
So we think about social engineering or what funds transfer fraud or invoice manipulation from all the statistics and hardly ever know whether or not they're accurate from the statistics that I look at. Those are the most frequent claims that we see. One thing I've always been curious about is like,
00:38:07
Speaker
You can't really like sell a product or service to really mitigate that exposure. I mean, outside of obviously like some awareness training or maybe some simulation software. Have you seen MSPs do anything to educate clients on that exposure or is it generally more of like the more
00:38:33
Speaker
the more IT related controls that you can implement instead of more of the people controls? That's a good question. I think we've gotten to the point where we say security awareness training is a must for clients. Even if the carriers, some carriers are starting to require it, some aren't, you know, it's that kind of thing where
00:38:56
Speaker
But you look at that and you say, if the majority, like you said, the majority of claims are due to things like social engineering attacks, phishing scams, things that are due to human or user error, then the user needs to be at least informed because that is the biggest risk, especially with all the other controls in place. I mean, that statistic of fraud and social engineering and e-theft and all those kinds of things is increasing because I think the other claims that are better protected are decreasing.
00:39:26
Speaker
because the security's in place. But that security awareness, if clients aren't actively taking the time to learn how to protect themselves by not clicking that link or not just blindly falling for that gift card scam or things like that, it can be really helpful in mitigating the loss. So it's not a true control, but education is important. It won't eliminate the risk, but it'll mitigate it intensely.
00:39:51
Speaker
Um, I'm surprised some carriers still don't require it personally. I think it's crazy. Um, but when I look at it, I'm like, okay, wait, you're going to save so much money. If you just make people take these stupid, watch these stupid two minute videos to understand what a spear phishing attack looks like or how they could be targeted or things like that. Right. So, I mean, it's what it is. But, um, I know MSPs will also sometimes do webinars around that stuff, but.
00:40:18
Speaker
you're not going to get your entire customer base in a webinar. So implementing some level of security awareness training into your security services, I think, is a must.
00:40:30
Speaker
Yeah. I'm curious for you from the agency side, because I mean, I was, I was there once, right? But I was there before things got super complicated in terms, like when I was on the agency side, MFA was just being required and I had to explain MFA to an agent. So what's that look like for you now? You know, you're working, the security control list is growing and it keeps growing. So when you're talking to agents,
00:40:53
Speaker
Um, and they're kind of the ones primarily doing the sales or do you come in on calls with them or what does that look like? And then when it comes to the security controls, how are you explaining? Yeah, this is a, this is like a frequent conversation. Um, I, I do assist some in the sales, uh,
00:41:14
Speaker
I think it's been challenging for us as a smaller shop. We don't have an incredible amount of manpower. Right. How do we do this scalably? The last thing I want to do is go above and beyond in the beginning while we're small and hungry and maybe not as busy as we will be.
00:41:39
Speaker
And then that like starts to taper off like that level of service kind of want to find something that we can maintain. So we've tried to figure out ways to, to help agents that aren't super proficient in cyber and, and, and, and the language and the controls.
00:42:01
Speaker
And I don't have the answer. I don't have the answer. We've kind of self-selected working with agents that understand it for the time being, which works, but there's a part of me that's like,
00:42:22
Speaker
I want to help because there's not many people that can or will, and it needs to be done. So I don't have the answer. I guess to flip the question back on you, which I think fifth wall does an incredible job at education. Um, have you guys seen anything work or get traction? Um, I mean, there's deliverables. We make YouTube videos or things like that, but I just, it's, it's almost like,
00:42:53
Speaker
The challenge around the agency space is now I guess where you hit the nail on the head, I always advise our MSP partners. I was like, look, you can't force your client to get a policy with one person over another. So will you can make them do reviews with fifth wall because it's in your best interests that their policy understand what's on their policy. That's fine. But.
00:43:15
Speaker
I always like to advise clients in general, if you're going to work with your agent, make sure your agent has someone at their agency who is cyber-focused and cyber-minded, because most don't. And I think that is probably part of the challenge is they're so spread thin that then you have to come in and say, not only are you doing insurance, but I'm going to teach you all these security controls too. And it just goes over their head.
00:43:41
Speaker
They don't have the bandwidth. It's nothing against their ability to retain knowledge or their ability to be technical or anything like that. It's just the bandwidth to check out all these security controls. I know some agencies partner with MSPs and they kind of work off one another, which is great. And you don't need to be, I mean, I'm not an expert in EDR. I don't know how it works on every, like how you implement it on every single endpoint and what all that looks like, but I know what it does. And I can explain it to a client and
00:44:09
Speaker
Ultimately, the agent shouldn't have to sell it, right? So it's the kind of thing where if the agent can at least talk about it on a real base level and understand what those core security controls are to your point. I mean, I think that's a starting point. And then say, hey, do you have someone who handles your security? So the agents probably should have MSP contacts locally that they can send clients to. But I think being able to speak on it
00:44:37
Speaker
very high level is important for agents and I think that's that's the challenge is I would get phone calls when I was in the agency space from uh I got one from an agent who called me and she was amazing she wanted to learn everything it was really awesome but she called me she's like
00:44:54
Speaker
I was talking to a school and we are, that already sets off enough red flags, right? But I was talking to a school and the person, they said that they were going to, they wanted to do MFA, but they were getting pushback from teachers because teachers didn't want the MFA organizations having all of their private information. I was like, what are you talking about? And they said, they said, if we give them our cell phone numbers, they can find out everything about us. And I was like, so it's just, yeah. Yeah.
00:45:27
Speaker
There's a huge gap. When people come to me, a lot of people come to me agents that want to get into cyber. I get really excited because there seems to be a really growing interest in people specializing in cyber.
Understanding Cybersecurity Exposure and Policy Evolution
00:45:43
Speaker
I think cyber insurance does a really good job at marketing itself as this really growing and up and coming line of business. And I think it's true. So usually the first place I point people is I say, hey, go pick up this book by
00:45:58
Speaker
Uh, uh, Joe, uh, Joe Brunsman, uh, damage control, cyber Joe who were mutual fans. Um, so I say, go pick up that book and then really everything after that, I'd never really recommend anything related to insurance. I usually just recommend like, Hey,
00:46:19
Speaker
like study the different exposures, study the different attack vectors, uh, really read mostly cybersecurity related content. Have you seen, have you seen something similar like that where I'm kind of disinterested in the insurance policy itself? Cause I'm like, uh, the insurance policy works similarly to other policies. It's, it's this cybersecurity exposure aspect that actually changes and is what most interesting to me.
00:46:49
Speaker
Yeah. Do you see something similar to that? Yeah. I mean, once, especially on the policy side, once you've seen one policy from one of the carriers, you've seen them all for the most part. Um, so it's like after you've read through a policy enough times, you kind of know what to expect when it comes to that particular carrier. So you know, if, if your agent brings you a client's policy and it's one page and it's attached to their general liability, you're like, well, this is a problem.
00:47:19
Speaker
You just kind of know, right? But you're right, the security side is evolving and rapidly changing, and the changing in security is what's going to ultimately change the policy.
00:47:36
Speaker
The security is going to come first. It's like we were saying before that carriers are two years behind when it comes to security. So if you're not keeping up to date on security, you're going to be thrown when the carriers start implementing new requirements. But if you can keep up to date on the new threat vectors and you're aware of the controls that help to at least mitigate those threats, then when the carriers start requiring them, you're already equipped to at least talk at them about them on a high level. I think that's brilliant. That's great. Yeah. It makes a lot of sense.
00:48:06
Speaker
Yeah, I think there's a huge, if you want to do really well in a certain industry and be a big fish in a small pond, I always say like, if you've worked in cybersecurity, come over to the insurance side. And we see that with a few people like Matt Thompson at M3. There's just, it's an incredible opportunity if you're on the security side. Just as we kind of wrap things up here,
00:48:37
Speaker
kind of tell us what's going on with fifth fall I know that you guys have to be honest I don't really know what it is but this is a perfect time to get it explained to me what is what is ibex and then I
00:48:53
Speaker
And then I know you guys are doing, doing some stuff on the, on the inside out, uh, side of things, at least I talked to Dustin a little bit. So I have X is something that we preemptively launched a year and a half ago that was not at all prepared to be talked about. Um, so no, but effectively it's that whole thing where, you know, you have, you have MGAs and MGUs and all that kind of stuff. And we're working on developing our own.
Fifth Wall's Ibex Initiative and Future Direction
00:49:19
Speaker
Um, that is taking longer than we would like because of all the fun legal red tape behind all of those good things. I can't imagine. Oh my gosh. It's so annoying. I feel like every time you get the, this good thing happened, all of a sudden you're like, Oh, well now this is taking way longer or this thing's happening. Um, but, uh, when it is available, it's going to be really cool because it's going to, um,
00:49:44
Speaker
take into account your security posture and hopefully offer some tangible reasons for getting that security in place as opposed to currently, you know, the process. I love when partners come to us and they say, hey, so do you have like average numbers of how much they can save if they implement these things? So it's like, no, because the numbers change like every six months. It doesn't exist. Don't pitch cyber on saving money, pitch cyber on security maturity and hopefully they save money and then they're just happy.
00:50:14
Speaker
And that's kind of, but hopefully, I know Ibex is trying to do it and I know I'm hopeful that in general carriers are going to start recognizing that these security controls work. And because of that, the system, we are seeing a softening market in the cyberspace right now. It's not soft, but it's softening. And hopefully that's due to this good security and it's going to lead to some more favorable policy options and pricing and all that kind of stuff.
00:50:42
Speaker
Fifth wall in general, one of the reasons I love it is, it's like you're saying, in SureSec, it's not in SureSec, that's not what we do.
00:50:52
Speaker
It's a very security driven and security focused model for cyber insurance. And I love that. Um, and it functions kind of like yours. It's a small company. It's functions like a startup, which means we get to experiment. We get to be creative. We get to, um, focus a lot on education and conversations. And when I say, Hey, I'm going on a podcast with another wholesaler, they're like, great, go do it. It's going to be awesome. Um, not, not don't waste your time. We'll go, go do go sell. Right. It doesn't, it doesn't feel like this grind. It really feels like the opportunity to say, Hey, how can we,
00:51:22
Speaker
How can we really get that education out there so people really understand what drives everything we do? That's why I love it. I'm a teacher at heart. I love it. By the time this episode is released, one of my favorites in the industry,
00:51:43
Speaker
I won't say his name, but I'm gonna interview him next week on the podcast. He's got great hair though. Great hair. He'll be joining your team. And yeah, I mean, you guys are stacked. I'll put it that way. You guys still work with agents, right? We do. We have an agency channel. I am admittedly not very connected with it anymore.
00:52:10
Speaker
Um, I still have a couple of agent relationships I keep in touch with, but I'm not, again, I'm not doing any policy sales or anything with that. Um, but, uh, on the MSP side, I'm really excited for our new hire because I mean, ultimately one of the biggest challenge is in. Yeah. And I have to imagine it's similar to what we're talking about with agents of like, Hey, you have to go talk about security controls with your clients on the MSP side. Hey, you actually have to.
00:52:36
Speaker
implement, somehow implement a secure and insurance review process into your annual approach to security with your clients. And that's really hard for a lot of them. So some of them get it right away and they're awesome, but a lot of them struggle to implement that because it's another thing on top of everything they're doing. So I'm really excited for a little more ability to nurture there and lead there and guide there and say, Hey, you know what? Really, you're struggling. We'll come to you. We'll help you out. You know, it's just that kind of, that kind of extra bandwidth is helpful.
00:53:05
Speaker
Absolutely. So obviously, like you said, I don't necessarily work with MSPs a lot, but a lot of them are in my network and I enjoy their content because unlike most other people in cyber insurance,
00:53:23
Speaker
We're kind of like quiet, to be honest, we're not putting out a lot of content and the MSP guys, man, they're just like hopping on webinars. Like it seems like every single day, like having like panels together, really cool people talking about cool subjects. Yeah. So I enjoy their content. Uh, if there's an MSP or agent or an insured, like how, how would they get in touch with you guys? How can they get connected with you? What's the best way? Um, if it's an insured, I would say.
00:53:53
Speaker
Talk to your agent or your MSP and tell them to get in touch with us. I mean, it's that, you know, it's that side of things, but I mean, fifth wall solutions.com is the best place to go or linkedin.com slash will bow, but the L is a one.
00:54:05
Speaker
Um, that's me. But really, like I said, mostly education is what Wilbo Baggins is my nickname slash gamer tags slash Instagram handle slash everything. Um, but, uh, again, education is everything. So if you go to fifth wall solutions, you're just going to be hit in the face with cyber insurance education is there for you. Um, so that's a great place to get started.
00:54:26
Speaker
So you, uh, so you're a gamer. Would you say that you're a gamer? Oh, yeah. Okay. Look behind me on my fake wall. It's full of game consoles. I was, I was going to say like, I, you know, with that being a green screen, I didn't know if like, is that an actual setup? Yeah, that was, that was our apartment before we moved to this house. And then I just did editing to make it look a little less like white light and more like blue and orange light. Nice. Nice.
00:54:53
Speaker
Well, we talked to Travis Kroger yesterday and he's a gamer and he was saying that, do you ever play with him? No, but I was talking to him a couple of weeks ago and it turned out like somehow it came up that we were both, I might've had this background on actually, that might be why, but we were talking all about it, yeah.
00:55:15
Speaker
Apparently he has some, he plays pretty frequently with some underwriters and apparently the guy at coalition that he plays with is pretty good. But we just all need to get like some sort of game that we play, that we all play, that we're all familiar with and just- And then livestream it. Talk about- Twitch or something. That'd be sick. Yeah. I'll do LinkedIn live. You guys do Twitch and we'll be all over the place. MSPs will watch that.
00:55:44
Speaker
Yeah, absolutely insurance bros gamer podcast. Yeah, so I think that's like what we got we got a strategize and get that together
00:55:52
Speaker
I'm about it. Yeah, let's do this. That'd be sweet. I'm terrible. I'm terrible at most like online shooters or things like that. Most of my bread and butter is co-op. I mean, I've always been a team player. So, um, and co-op where it's like, you're not fighting it. Like Halo don't, I'll play Halo campaign, but not Halo multiplayer. Cause I get destroyed. So Travis might not like me in that regard, but we'll figure it out. It'll be great. I told Travis I really like,
00:56:23
Speaker
I've played many types of games, but the only one that I've ever frequently played is zombies, and I get addicted. Cod zombies can easily play like 12 hours straight, which to some people might not sound like a lot, but to me that's wild.
00:56:40
Speaker
I mean, it's fun. I recently got the PlayStation Virtual Reality 2, the VR 2, and they have all these amazing games. You can play Resident Evil, you can play some zombie shooter, and you can play all sorts of things. I play mini golf with my friend James. That's it. That's all we play. It's amazing though.
00:56:59
Speaker
That's so cool. Well, we'll have to get that set up because I mean, surely that's more entertaining than some boring podcasts. Like that's definitely a better format, right? I love it. Well, cool. I appreciate you coming on, man. Really great conversation.
00:57:16
Speaker
Uh, would love to have you on again in the future and, um, really looking forward to getting this released. If you want to find will go on LinkedIn, definitely worth a connection or follow on LinkedIn. Love his content. Love his memes. I got to make some of those. Exactly. Yeah. Yeah. Well, my dream is to be mean by, uh, by will one day. So I'm going to keep just saying crazy stuff till he, till he does it. Yeah. Um, but appreciate you, man.
00:57:45
Speaker
Yeah, awesome. Thanks so much, man. So good to see you.