Tech E&O and cyber insurance with Joe Brunsman

QPC Security - Breakfast Bytes

Tech E&O and Cyber insurance with:

Joe Brunsman of The Brunsgroup – Expert on Tech E&O and Cyber Insurance

YouTube channel – Joseph Brunsman

https://www.youtube.com/@JosephBrunsman

https://www.thebrunsgroup.com/

Damage Control book

https://www.thebrunsgroup.com/book2

Tech E&O and cyber

MSP should have a tech E&O policy. They cover different things. What types of third-party claims will they cover? A guy on the Que recently said that he did not think that E&O was required because his customers have never asked for it. You must have a TECH E&O policy.

What is the biggest thing that you need to pay attention into the E&O policy?

Look at the definition of technology services in the policy. Everything past that point, it does not matter if the definition of technology services is correct.

Avoid the named peril policy. An all risks policy is better. These are becoming harder to come by.

Named peril: Technology services means: there is a list

You have to prove to the insurance company that what you did falls within that definition.

What do you need to look for? “Including but not limited to” contra proferentem = ambiguity is held against the draftsman. The onus is on the insurance company to prove that what you did was not covered under the definition.

How much coverage in the policy should they have?

How much cyber insurance do you need? Here are the variables that I think about. – See Youtube video

Brokers – There is no legal requirement that they understand or read the insurance policies.

Average IQ of an insurance broker is 104. They do not understand what they are selling. The onus is on the business owner to ask and to get the right things.

What is your major loss event? What are we worried about? Is that even possible to insure for those issues?

Step 1: Stop relying on the insurance broker.

Step 2: Fellow decision-makers in the business, what are you worried about? Talk to the broker about that. Then the broker finds “these are the options in the cyberinsurance market that address those concerns”.

Joe: Huge proponent of defense in depth over cyber insurance. Rank order the biggest bang for the buck. Felicia has been talking about that for years and is doing a webinar on 2/9/2023 on that very topic.

Insights from plaintiff’s attorney

Joe had a great convo with a plaintiff’s attorney and got his opinion on risk management.

Risk discovery question: What is the one thing that sinks the ship in the lawsuit?

There is an internal email. You knew you were supposed to do this. But they said it was too expensive. They were not going to do that. They understood the risk and just accepted it.

What could the business do in order to circumvent that email being a death blow in the lawsuit?

Plan of implementation.

No business has unlimited resources. No business is perfectly secure. You sit down the with business owners and MSP. We need to work on a plan to better your security. You don’t have unlimited money. I am a business owner too. You need a roadmap. Everyone signs off on it. We were trying, we were getting there.

Felicia: Wow this is astonishing because this is what we have been doing with clients for 20 years. It is the type of thing that a CISO knows how to do, but few others know how to do well.

Life hack tip from Joe:

Convo with the average business owner:

Obviously you are really good at what you do. You have built this business. Build a relationship with them. The MSP is not the subject matter expert on the client’s industry. Fluff their feathers. Transition that. I asked you a bunch of questions, thank you for hearing me. Now we are going to go through this. Can we just do the same thing in reverse? If you do not understand this yet, let me know and let’s break it down.

Joe and Felicia agree:

One way or another, those controls will be implemented. Read any breach notification letter. Magically we found more money to invest in cybersecurity.

Either work on your information security program monthly at a pace that your budget can absorb, or that decision of timing and magnitude will be taken away from you.