Do Security Companies Need to Issue Warranties?

Jeremiah Grossman outlines how IT security firms are starting to offer guarantees with the backing of insurance companies.

BLACK HAT USA – Las Vegas – On a day when keynote speaker Dan Kaminsky told the security industry that it must do better, industry veteran Jeremiah Grossman offered a path to some meaningful change.
In a one-hour session on cyber insurance, Grossman underscored why with all the high-profile hacks there’s good reason for companies to feel vulnerable today and that security companies need to start thinking about offering guarantees.
Citing a Dark Reading survey, Grossman said that 15 percent of security managers have
no doubt
that their company will have to respond to a major security incident in the next 12 months.
“Our industry must change,” said Grossman, who now works as chief of security strategy at SentinalOne. “Not many people believe us anymore, so the best way for us to move forward is to share our knowledge. Think about it, the security industry is one of the only businesses that doesn’t offer any guarantees or returns policies.”
Grossman talked about recently-introduced guarantees at SentinalOne, WhiteHat Security and Trusona. At SentinalOne, for example, the company now insures up to $1,000 per endpoint with a maximum cap of $1 million if a customer experiences a ransomware attack. The insurance costs about $15,000 to $30,000 a year and is tied into a company’s general liability insurance.
Parallax reported that one-third of U.S. companies buy cyber insurance, a market that PwC estimated will grow to $7.5 billion by 2020.
Grossman crunched some numbers and found that companies spend $3.8 billion annually on traditional security equipment like AV, firewalls and intrusion detection, but they also spend $3.2 billion on cyber insurance.
“So a lot of the companies out there just opt to spend money on insurance when they get hit with an incident,” he said. But the numbers from some of the leading incidents also show that companies are not buying enough cyber insuranace. The Target breach cost the retailer $248 million, but the insurance company only paid out $90 million. And Home Depot lost $43 million on its breach, with a payout of about $15 million.
“So what this tells us is that big companies are buying insurance, breaches happen and the insurance companies pay,” he added.
And companies finally understand that they need more insurance.
Anthem, which experienced a major breach in February 2015, now has a policy in excess of $150 million, Grossman said. And companies are now stacking insurance policies. For example, one carrier may cover up to the first $50 million, while another company may cover the next $100 million.
Grossman predicted that the cyber insurance market will explode in the next few years. Companies will need to work with brokers who can piece together coverage from different sources. He also said there’s a market forming for security ratings services that use analytics to issue a rating similar to a FICO score for home buyers.
Related Content:
10 Things Cyber Insurance Wont Cover
12 Tips for Securing Cyber Insurance Coverage
How To Bridge The Cyber Insurance Gap

Last News
▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security	▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps