Cyber Insurance - Panacea or a House of Cards?
Discusses cyber Insurance - Panacea or a House of Cards and evaluates key implications for security practitioners.
Summary
Cyber Insurance in Context
Optiv's Bill Young closes Source Zero Con 2023 by framing how cyber insurance evolved from 1990s professional-liability coverage into a young, fast-changing market. Traditional insurance relies on actuarial predictability, which clashes with security's constantly shifting threat landscape.
Threat Evolution and Market Stress
Young walks through perimeter-era web attacks, 2014 retail and healthcare breaches, 2017 credit-agency incidents, 2020 ransomware premium spikes, SolarWinds supply-chain risk, and Log4j shared-library exposure. Each wave forced insurers to rethink coverage as attack surfaces expanded into cloud and SaaS.
Misaligned Stakeholders
Security teams focus on technical risk reduction while CFOs often buy policies without deep security input. Enterprise table stakes increasingly include security features, yet carriers still seek statistical models for incident cost.
Conference Themes and the Road Ahead
Drawing on Source Zero talks, Young highlights AI-driven attacks, cloud exploitation, EDR evasion, native-tool abuse, and emerging risks like critical-infrastructure insurability. He argues better intelligence sharing and scoring could help align security investment with insurance as a risk-transfer tool.
Related talks
Source Zero Con·45 min
Evaluates developers Gone Wild and evaluates key implications for security practitioners.
Source Zero Con·22 min
Reviews managing Perspectives for Assessment Reports with Few or Zero Findings and evaluates key implications for security practitioners.
Source Zero Con·39 min
Evaluates pre-Windows 2000 Backdoors and Bypasses and evaluates key implications for security practitioners.