Security Confidential S20 E6 Joe Erle

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon, and welcome to another episode of Dark Rhiino Security’s Security Confidential. Reminding you, please, folks, hit the like and subscribe button. We are told by the analytics that a lot of you watch and listen, but you’re not subscribed. So please do that. It’ll make our life easier, and it’ll allow us to keep bringing you great guests. Today we have a great guest. He is Mr. Joe Erle. He’s a cyber insurance broker, cybersecurity content creator, and host of the Ransomware Rewind podcast. He specializes in helping businesses understand cyber liability, data breach coverage, and the security practices that can affect their insurability. I think this is very timely, Joe. Thank you for being on the show today.

Joe Erle: Thank you for inviting me.

Manoj Tandon: So Joe, this is a hot potato topic, man. I tell you, we work with small and medium-sized businesses all the time, and there is a lot of misinformation. But before I have you drop right into it, we do always like getting a little bit of our guest’s background. So give us a little bit of your origin story here.

Joe Erle: Sure. I started in insurance shortly after college. I was selling industrial supplies at first, and then I dropped into the family business. About five years ago, around COVID, I saw what an impact cybersecurity, cyber insurance, and all the hacks were having on businesses. One in particular, I was at a trucking convention because I used to be on the trucking team before I started the cyber insurance practice group here. And one of the guys who’s always so nice and excited to see you was all stressed out. It was like, “Did your dog die or something? What happened to you?” And he was like, “No, I got hacked. I’m negotiating with the Akira ransomware group right now.” And I was like, “What? Wait, you’re doing the negotiations? You don’t have a breach attorney or incident response team?” He’s like, “No, my people have been working 24 hours a day, and I’ve been talking back and forth with this guy. I think we can get our servers up soon, but I’m not sure if he’s in or out or whatever.” And I was like, “Dude, you need to help yourself out and get some help here with the professionals.” He’s like, “No, we got it. I’m about to pay this guy. I’ve got some money in Coinbase. They said I had to open up a Coinbase account.” And he did a good job negotiating with this guy. The original demand was $250,000, and he got it down to $115,000. He was able to get his servers back on in around two weeks, but it was a double extortion. They had exfiltrated the data, and they were threatening to put his parents’ tax information on the dark web. He didn’t want that, so he was going to pay to protect his family, which is very honorable, of course. But the problem was, you can’t just put $115,000 in Coinbase and expect to be able to send it off right away. They have Know Your Customer laws. So that money got frozen, and he had to go on LinkedIn, find people who worked at Coinbase, and ask them to unlock his money. Finally, they unlocked it, and he’s like, “I’ve got to pay these guys. I still don’t know how, and they said I only have two more days.” I connected him with a vendor that helps people pay for this kind of thing, and they were able to check if the ransomware group was on the OFAC sanctions list because, of course, if you pay someone who’s on the OFAC list, you could face legal consequences for paying a sanctioned entity. He was able to get the ransomware group paid, which sometimes is the best thing to do, and then he was able to go on with his life. But the thing I saw there was that insurance would have done all this for him if he had cyber insurance. The first call you make is basically to the cyber breach attorney. They answer the phones for the insurance companies, basically, for most companies. They bring in the incident response people and the forensics people to make sure the hacker is out of your system. Incident response people help you get your system back and make sure that there’s no persistence of the hacker. Then they help you negotiate. Of course, a lot of people think, “If I have insurance, they’re going to make me pay the ransom.” No, they don’t make you pay. You’re in control of whether you pay the ransom or not. The insurance company and the breach attorney are just going to guide you and give you that choice. They would have done everything that he had to do on his own, which caused a huge amount of stress for him. Obviously, it’s still stressful, but having an insurance company in your corner helping you manage the entire process is huge.

Manoj Tandon: He had the money to pay it. What if you don’t have the money to pay it?

Joe Erle: What do you do if you don’t have the money to pay? You figure it out, I guess. I mean, I think a lot of business owners have to figure things out or restart. You know, it’s kind of like looking at your old text messages to figure out which customers you still have the numbers for if you’re locked out of your emails and the rest of your systems. You’re looking at paper files, trying to rebuild it yourself. But yeah, it’s really stressful for a business. And he didn’t get paid back for that downtime, those two weeks that he was out. An insurance company would have paid for his lost net income during that downtime. So it’s really tough, especially in the trucking market, which has very slim margins. People are basically trucking stuff for free right now with the price of gas. So yeah, it’s tough. A lot of small and medium-sized businesses don’t have a lot of cash flow to float for two or three weeks, where the average breach causes about two weeks of downtime. You still have to make payroll, right? And it can be very difficult for a company that’s going through a breach if they’re doing it on their own.

Manoj Tandon: That’s why Inc., I think, had the quote that 60% of small and medium-sized businesses are out of business six months post-breach. That was their statistic, or that’s what they published.

Joe Erle: Yeah, I think it’s a great statistic, especially for getting people to understand whether they should go and do it.

Manoj Tandon: Yeah, well, there was another one, and that one came from an industry association, that the average payout on a cyber policy is 30 cents on the dollar in a lot of instances.

Joe Erle: Yeah, I think that’s probably true. The average payout is usually like $508,000, and the average ask is around $2 million. So it depends on the sector. I mean, I’ve heard $5 million is the average cost of the entire thing, but the ransom they ask for is $2 million, and they usually get like $250,000. So yeah, that’s one-quarter of what the original ask was. That makes sense.

Manoj Tandon: Here’s the thing. Let’s do a quick primer here. Let the listeners understand how cyber insurance is actually structured. You have standalone policies, you have packaged policies, and then you have major crimes coverage. Can you give us a distinction here? What is each one, and where is it useful?

Joe Erle: Sure. Most contracts just require you to have general liability, and general liability unfortunately won’t cover any cyber. They added an explicit exclusion on the 2026 form. So if you just have general liability, you basically don’t have any cyber coverage. If you have a business owner’s policy with property and general liability put together, which a lot of small businesses have, sometimes they have an endorsement that adds some cyber coverage. But those endorsements are very limited compared to a standalone cyber policy. They may be limited by how you get hacked. I saw one where, if you weren’t targeted directly, meaning they weren’t specifically going after you, and you just clicked on something from a hacker trying to cast a wide net, then it wasn’t covered. So they’re very limited. Usually, they’re limited to about $50,000 in total coverage, which will get you the retainer for the attorney, but not much more than that. Standalone is the way to go. A standalone policy is going to have two parts, or three parts if you count social engineering. It’s going to have third-party coverage, which a lot of companies are buying thinking they have a full cyber policy. Third-party coverage is for notification and liability. If somebody gets breached in connection with you, and somebody spends money on their credit card or gets into their bank account because of your breach, that’s liability to the other person. But a lot of those policies won’t pay if you’re hit with ransomware or need to rebuild your system. So you need to buy one that has third-party coverage, which is the big number in the front, like $5 million in insurance, but you also need to look at the details. Let’s look in here because we need to see what you have for cyber extortion or ransomware, whatever the company is calling it.

Manoj Tandon: Okay. So third-party coverage does that, like if one of your vendors got breached and you were paying them by credit card, and as a result your credit card got charged, that’s going to be covered under third-party coverage?

Joe Erle: You would be the third party of your vendor. So yeah, it’s like notification costs. You know how you get those letters in the mail where it’s like, “You’ve been breached”?

Manoj Tandon: Yeah, so if you’re in an attorney’s office and you get breached, then if that attorney’s office has third-party coverage, that’s going to cover the cost of those mailings to everyone.

Joe Erle: Yeah, the mailings and the credit monitoring, because it’s like $20 a person or something for all that. But it’s actually interesting when companies do the math. You know, big companies, and I’m not going to call them evil corporations or whatever. I’m a capitalist here, and they do what they do. But a lot of times they’re doing that math where it’s like, how much is it to notify everyone versus how much is it to pay the ransom? How much is it to protect our reputation? How much is this actually going to affect our reputation? And they do that math, and they say, “No, we’re not going to pay the ransom. We’re just going to notify everyone.”

Manoj Tandon: So that’s third-party coverage. Next level.

Joe Erle: That’s first-party coverage. So that’s going to cover your cyber extortion, your ransomware, and the cost to rebuild your system. A lot of times people have backups, but if your network gets compromised, your servers get locked out, and they get bricked, you can’t put your stuff back on your servers. You’ve got to buy all new servers. There are extra expenses involved in getting those to you as fast as possible. You may be on an on-premises system and want to go to the cloud. You’ve got to make all those decisions in a very short time to get back in business. Another part of first-party coverage is business interruption because the insurance company is going to pay you for your lost net income. When everything’s back up and running, and you’ve figured all that stuff out on the back end and you’re running your business, they pay for forensic accounting to figure out how much money you would have made during the breach, and they pay you that as well. So you’d be missing out on a lot of that if you’re just buying third-party coverage.

Manoj Tandon: Got it.

Joe Erle: Another misconception is that if I have a cyber warranty, like say you have an EDR system that you can buy a warranty from, that’s another thing you’re going to be missing out on if somebody gets into your system. If they got through that EDR and the EDR had a warranty, they’re not going to pay for business income. They’re not going to pay for a lot of that stuff, if they even cover the warranty. So have you ever seen any of those warranties pay out?

Manoj Tandon: You know, I haven’t had experience with a warranty payout in particular. We at Dark Rhiino used to offer a warranty, and it was one that we self-funded.

Joe Erle: So you did it as an MSSP, but not like—

Manoj Tandon: We did it as an MSSP, where if you got breached, we would offer you a million dollars in coverage. We were offering incident response coverage in that. We were offering coverage for notification costs up to certain limits, and I forget what they were. But we did it assuming that people would want to do business with an MSSP that was backing up its work. And what we discovered is the market maturity is simply not there. I have no problem saying it. It’s a totally different problem set. The people who handle cyber insurance and cybersecurity don’t overlap a lot of the time. So in the end, it didn’t do us justice as a company to have so much capital tied up in it. Now, I know a lot of people, like I think SentinelOne, offer a million-dollar warranty if you use them as your EDR platform. What do they actually cover?

Joe Erle: Well, let’s take SentinelOne as an example, right? If you actually read into these warranty policies, they will cover their warranty if somebody gets in on a machine that SentinelOne was installed on and the agent was activated. But usually, the hackers get in on a dormant server somebody forgot about or some device that somebody spun up but didn’t put SentinelOne on yet. And that’s how the hacker gets in. They’re going to say it’s excluded because their software wasn’t on that exact device. So that’s where the value of insurance can be greater, as far as what triggers coverage and also what it covers, like business income and other expenses, such as reputational harm and other things that insurance can pay you for that a warranty wouldn’t pay.

Manoj Tandon: What happens if somebody is physically hurt because of the breach? Is that another separate coverage? So, for example, if you’re a medical institution, you got ransomware, and now there’s a certain asset that was required that was unavailable, and as a result, you couldn’t deliver the healthcare that was required.

Joe Erle: Yeah, it’s really sad when healthcare companies get breached. I read somewhere that fatalities go up 20% when healthcare companies don’t have access to their systems. And there are a lot of things that affect it, not just when you can’t get into your systems and can’t get a machine to work. It’s more like, “Hey, we don’t know if this guy’s allergic to penicillin,” and you have to go find that information.

Manoj Tandon: Right.

Joe Erle: And you don’t have a paper chart for him. So what do we give him? What painkiller can we give him? And then you give him the wrong thing because you don’t have that information. Or you have to push out his surgery because you can’t do it without the back-end systems you usually have. And because you had to push it out, that person didn’t make it because they needed the surgery faster than you could give it to them. So it’s really sad, and there are coverages for that, like contingent bodily injury and property damage. You can get sublimits for that. For healthcare policies, you’re going to have certain endorsements that cover stuff like that. But yeah, unfortunately, people in healthcare are actually hurt when hackers go after healthcare organizations. And I think there should be special penalties for hackers that go after healthcare. I don’t think they’re punished enough when people’s lives are in the mix.

Manoj Tandon: So if you’re a healthcare provider, you would need those extra riders for bodily injury on that policy.

Joe Erle: Absolutely.

Manoj Tandon: Okay. Business email compromise. Where does this fall into the continuum? What’s going to cover you from that? That’s very common. So now nobody hacked you. They hacked your process, and you willingly wrote them a check.

Joe Erle: Right. Yeah. So business email compromise is a huge starting point for ransomware and also fraudulent transfers and social engineering attacks. Obviously, if you get a message from a fake vendor, it’s going to hold a lot more weight if it comes from that vendor’s actual email versus a spoofed email. I mean, most companies that have their DMARC configured correctly are going to be able to identify spoofed emails, but a lot of companies still don’t have that configured correctly, so spoofed emails still get through. A lot of times, a lowercase L and a capital I look the same, so unless they’re both capitalized, it’s hard to see that they’re two different things. And then you get into a he-said-she-said situation. You know, say you’re a contractor and you paid the vendor, but it was actually a hacker. They’re like, “Well, we didn’t get our money.” And then your relationship with this vendor is in jeopardy because you just paid somebody $69,000 that you shouldn’t have, and everybody feels dumb. If you have insurance for that, it’s called social engineering insurance, invoice manipulation, or social misdirection. There are a lot of different names for it.

Manoj Tandon: Joe, is that a part of major crimes coverage, or is that its own entity under insurance?

Joe Erle: Usually, there’s some coverage on a crime policy for misdirected funds due to social engineering. Usually, it’s a small sublimit of about $100,000. They put a lot of the money in computer fraud, which is similar, but it’s not a social engineering attack. It’s like somebody actually went into your system and changed the code somehow to get you to change from one vendor to another, versus somebody tricking you or impersonating your bank or a vendor and getting you to send them the money. So yeah, it’s social engineering. Usually, you’ll see it on a cyber policy at a $250,000 sublimit. What most people don’t know is that you can buy more, and a lot of people don’t take advantage of that. I see a lot of companies where they’re like, “Yeah, our average wire is about $2 million.” And you’re like, “Well, you’re only covered for $250,000. You realize that?” They’re like, “No, I thought we had $5 million in insurance.” And you’re like, “Yeah, well, you do if you have to notify a bunch of people or you get ransomware. But if one of these wires goes to a hacker, then you’re only covered for $250,000.” So we can build towers of coverage to get them up to $5 million, $10 million, whatever limit they want nowadays. It’s easier than it was a couple of years ago to get more coverage for companies.

Manoj Tandon: There used to be a time, Joe, when it was a simple one-page form. You could fill it out and you’d just be done. You’d get all the cyber coverage you wanted. You know that. I mean, that was not that far back in the day.

Joe Erle: We still have one-page forms, you know, kind of. The writing is really small, but we can fit it on one page.

Manoj Tandon: Then it became a little bit more complicated when the losses started mounting for the insurance carriers. And then when you were getting upwards of $5 million in coverage, it used to be that they wanted a lot more proof of controls and maturity of the organization. Is that still the case, or no? Can you get $5 million or $10 million in cyber liability, bodily injury, and business email compromise coverage without much of a headache?

Joe Erle: I would say yes, you can. You do have to fill out one application, but a lot of the questions are yes or no. They’re just asking you if you have most of the basic controls, like endpoint detection and multifactor authentication. They’re going to ask you about your backups and whether they’re tested. It’s a lot of yes-or-no questions. But I would warn people out there that if you’re answering yes-or-no questions, like, for instance, MFA: “Do you have MFA on all your critical systems?” You may think that all your critical systems are covered, but when it comes to a claim, what you thought was critical and what the insurance company thought was critical might be different. So you want to list those systems that have multifactor authentication and those that don’t, so there’s no question about whether something is critical or not and you’ve fully disclosed everything. So answer yes, but list any systems that don’t have multifactor authentication. That way, it’s all out there if there’s ever a claim.

Manoj Tandon: Well, on that one, we have seen it where people have answered, “Yes, we have MFA,” and technically, yes, they have licensed an MFA product, but they never deployed it. And they answered yes to that question.

Joe Erle: I guess it would depend on how the question was asked.

Manoj Tandon: I can’t make this up. I’m serious.

Joe Erle: I mean, Travelers, back in I think it was 2016, had a case where they got a policy rescinded, which means they treated the policy as though it had never been issued because the company said they had MFA, but they never deployed it or never had it. So they didn’t cover the claim, and they didn’t cover any possible claims from when the policy started because they didn’t have MFA. So I think you need to be as honest as possible on a cyber policy. I think there are a lot of policies out there with small businesses where they’ve never read their insurance application. Maybe it was filled out for them, and they just signed on the dotted line. So just keep in mind that you are responsible for what you attest to. Make sure you take your cyber insurance application to your MSP, your MSSP, someone like Dark Rhiino, and say, “Hey, I attested to all this. Do I have all this? Do we actually do all this?”

Manoj Tandon: You know what? We have actually done that for several clients where they sent us their application, and we wrote out in great detail, and we actually provided proof, audit logs of, yes, this proves this system is covered. But if you don’t have anybody to do that for you, for example, if you’re a small or medium-sized business with a lot of family involved, and you might have a couple of people who are really smart with computers and they’re kind of your de facto IT department, and you’re answering, “Well, do you have tested backups?” And we know statistically that a huge number of backups don’t actually restore. I won’t mention the statistic because I don’t know where it actually came from, but a number of backups don’t actually restore. They’re not able to bring back those systems. Right? I’m sure that if you file a claim, the insurance carrier is going to ask, “Well, you guys said you had tested and verified backups here. What happened?”

Joe Erle: Yeah, well, people are getting better at it, though. I think they’re getting better.

Manoj Tandon: Good.

Joe Erle: And I think part of it is because insurance companies are asking, “Are you testing your backups?” Because they didn’t used to ask that before. They just asked if you had them. So now you have to say, “Yeah, I test them.” And you’re like, “Well, I said I tested them. I better test them. Can we get this on the calendar? Because I told the insurance company I’m doing this.” So sometimes, we insurance people and cybersecurity people can work together and help people become safer. Because the cyber insurance application looks a lot like a cybersecurity audit. You know, it’s asking all the stuff you’d see on a NIST audit. I would love to see us just using a NIST audit as a cyber insurance application. Maybe we could. We’ll just add the revenue because usually the way they price cyber insurance is based on your revenue, so the size of your company. That’s going to determine the size of your risk. Then your industry, so that’s the kind of risk. They can put you in a box and say, “Okay, he does sports gambling, so he’s going to be really high risk,” or, “He’s a law firm, so he’s going to be somewhere in the middle.” And then they take your controls and give you discounts based on your controls. So it’s like, “Okay, he’s got MFA, he’s got backups that are tested, they’ve got email security, and it looks like their endpoint detection is top-tier.” Those are the things they’re looking for. And the more details you can give a cyber underwriter, the more discounts they can either objectively or subjectively give your company. But what I was saying about the ransoms is that people are paying fewer ransoms because they’re doing a better job with their backups. Either the backup vendors are getting better or people are taking it more seriously. But I think we had a record low in quarter two, according to Coveware, that we’re paying a lot less in ransoms. And Coalition, in particular, they’re a cyber insurance company, said that 86% of their clients decided not to pay ransoms.

Manoj Tandon: Wow. Eighty percent?

Joe Erle: Yeah, 86%, actually. They refused to pay in 2025. So people are refusing to pay because they have backups. They’re doing a better job of segmenting their PII, personally identifiable information, so that when hackers get in, they have less to extract and extort. And they’re just restoring from backups. Sometimes they’re deciding, they’re doing that math where they’re like, “Well, let’s just notify everybody because everybody’s getting all these notifications anyway. Who cares if they get one more from us? It doesn’t really matter. Why should we pay to keep their data safe? It’s probably already out there anyway.” And then they decide not to pay the ransom, which is good because we don’t want to feed the hackers and cybercriminals out there. And we’re seeing that cybercriminals are doing less locking you out of your system and more just saying, “We’re going to dump this data. We’re not going to bother locking you out of your system because we’ll just threaten to dump the data. We know you’re going to have issues with notifications, regulatory issues, and it’s going to be bad for your reputation.” Depending on what states you’re in, if you’re in California or Illinois, or if you do business in the European Union, there are a lot of regulations that you may have to comply with and penalties you may have to pay. So criminals know that, and they’re acting accordingly.

Manoj Tandon: Wow. Well, that’s amazing. That’s actually very positive news. That means the effectiveness of controls has definitely gone up. And like you’re saying, backups are becoming much more effective, and people have learned how to categorize their data or, as you’re saying, anonymize it and eliminate PII, so that when the data is stolen, it’s really not that valuable out on the market.

Joe Erle: Yeah.

Manoj Tandon: And that’s a big deal. I’ll tell you what, that caught me off guard. I think that’s fantastic that Coalition is showing those kinds of results.

Joe Erle: Yeah, it is fantastic, and it’s what’s kind of stabilizing the insurance market a little bit, is that we’re paying fewer ransoms. Because I don’t think the current pricing is sustainable. I think the pricing is very low right now. It’s very inexpensive. I don’t want to say cheap because I don’t think cyber insurance is cheap unless you’re buying it on cyberinsurance.com and you’re just picking out the insurance coverage yourself. Then it’s cheap because usually you’re just buying third-party coverage and nothing else. But it’s these controls that people like you at Dark Rhiino are putting in place that are helping stabilize the insurance market so insurance companies can keep offering lower prices and stay profitable at those prices. Nobody wants pricing like we had in 2021 and 2022.

Manoj Tandon: What’s happening with AI entering the mix? Gotta ask the obligatory question here.

Joe Erle: Yeah, AI is really interesting, and I think insurance companies are evolving really quickly to match it. They’re adding affirmative AI coverage. I think a lot of companies may be confused about the difference between being an AI company and getting cyber insurance versus being a law firm that’s using AI and having AI coverage on your policy. Because if your business service, your software service, is creating AI and providing AI as a service, then you need technology errors and omissions coverage with special AI wording. And you want to make sure it doesn’t just cover the AI software, but also any autonomous actions taken by the AI, especially with these autonomous AI agents. So that’s becoming a differentiator in some of these cyber policies. Like, “Yes, we cover AI, but we don’t cover AI when AI is making autonomous decisions.” So if your employees are using AI and it has a hallucination and they send in a report that says something incorrect because AI made a mistake, that’s different from an AI agent making autonomous decisions out in the wild that could cause damages to other companies or your company. Does that make any sense?

Manoj Tandon: It does.

Joe Erle: Okay.

Manoj Tandon: Are you seeing AI impact the frequency of attacks? Are you guys seeing more claims that are related because it was an AI-driven incident?

Joe Erle: Yeah, I read that AI attacks are up 56%. It was a 2026 IBM report, and one in four attacks is now AI-enabled. So AI is definitely having an effect. The first wave was social engineering attacks going way up because people who didn’t even speak English could now write really good emails, right?

Manoj Tandon: Right.

Joe Erle: Now you have perfect emails. You used to look for mistakes in emails to see if they were fake. Now you almost look for mistakes to see if they’re real. So that’s one of the reasons. But now, with agentic AI becoming very mainstream, hackers are, of course, using it as well.

Manoj Tandon: Let’s ask this: How should a company begin assessing their risks specifically for cyber insurance? I mean, if they’re trying to understand what they should be buying, what kind of coverages do they need? Like you mentioned, you have $5 million in coverage if you have to inform someone, but you only have a quarter million in coverage on a potential $2 million business email compromise loss. How does somebody navigate this? I can see this conversation getting really complicated, and people may not know how to go through and assess themselves or determine what they should be asking Joe for.

Joe Erle: Yes, that’s a great question. Risk quantification can be very complicated because CISOs are out there trying to tell their boards, “This is why we need this new service or new software.” It’s hard to say, “This is the return on investment for this. What’s the return on risk?” It’s very hard to quantify, and we have the same issue in insurance. So we have a couple of tools that we use to quantify risk. One is we run about 50,000 claim scenarios based on your revenue and your industry, and we get an aggregated amount of how much insurance you should buy. That’s one thing that we do at the agency level. Another thing you can do is benchmark against other companies your size. So we use some resources through larger wholesale brokers to benchmark against other companies your size. For example, most companies in your industry, in financial services, are buying $5 million. And the reason you want to know that is because if there’s ever a breach and there’s a lawsuit, and they say, “Well, why didn’t you buy $5 million in insurance? Your peers are buying $5 million in insurance. Why did you only buy $1 million?” If you want to protect your boards and directors, you want to make sure that you buy what your peers are buying so that you have a defensible position in a lawsuit. And on the other side of that, we use those Monte Carlo simulations. Then we ask questions like, “How much is your average wire transfer? What’s your biggest wire transfer? How often are you doing this or that?” We look at your industry, and then we build the policy based on that. And a lot of times with insurance policies, you can have the same company buying, say, a Corvus insurance policy from one broker, and it could be totally different from another broker because it’s missing a ton of endorsements. Endorsements are changes to the policies or additions to them. I think the real coverage comes back to those endorsements. So if you just bought an insurance policy from insurancecompany.com or whatever, you’re not going to know what you don’t know, and you’re going to buy just a basic policy and be like, “Check the box. Yes, I have cyber insurance.” But you’re not thinking about things like, “Wait, I could get sued for using tracking pixels and sharing information with the wrong people, or sending pixel information to Facebook and TikTok.” That could be covered on a cyber policy, and you’re going through this whole lawsuit when you could have had that coverage if you just checked the right box or talked to the right broker. So that’s where a lot of the value comes in when you talk to an independent broker.

Manoj Tandon: So you folks are providing advisory services, then, in a nutshell, to these businesses.

Joe Erle: Yeah, we have insurance for that. In case we give bad advice.

Manoj Tandon: I’ll tell you, though, all brokers are not the same. I mean, I can tell you, even just buying coverages for Dark Rhiino, I’ve had to really educate myself to ask those questions. I’ve seen where we had gaps that we had to close, and I was like, “Wait a minute, we’re not covered for this. We’re not covered for that.” And it’d be great if people would do what you’re trying to do here, which is give that risk advisory, because it’s a heavy lift if you’re doing that as a small or medium-sized business owner. Even if you’re a 200-person company, I think it’s a heavy lift. You really need someone to guide you through it. It’s not as simple as, “Yeah, we got cyber coverage,” which is what we see a lot of. You know, “Yeah, we got some cyber liability coverage.” Okay.

Joe Erle: Yeah, it’s very similar to the MSSP space and MSP space. People can have an EDR, right? But if they don’t have it configured correctly or they don’t have all the right parts of it turned on, and they just say, “EDR, check,” I think a lot of the people listening right now would be doing a facepalm. Like, that’s not how you buy something, and you shouldn’t treat your insurance that way either.

Manoj Tandon: Agree, totally. It’s often after a breach occurs that people learn the hard way what they truly had coverage for and what they truly did not have coverage for. And that’s a very stressful conversation.

Joe Erle: Absolutely.

Manoj Tandon: You know, another thing, like you were describing, there’s a company that’s only going to cover you if you were targeted, but not if you were part of a phishing-net attack. Well, attribution is a very difficult thing in our industry. It’s not easy to say, “Yeah, for sure, this group is who’s responsible, and you were targeted.” So if you’re a contract manufacturer, you probably want to really examine what your policy says there because you might get targeted in a broader dragnet than what the average manufacturer might. Just saying.

Joe Erle: Yeah, so if you have insurance, if you think you have cyber insurance and it’s just an addition to your business owner’s policy, it’s really inexpensive to buy standalone cyber insurance right now. And even the most basic standalone policy will be better than that business owner’s policy endorsement.

Manoj Tandon: In the last couple of minutes here, I do want to give you a chance to talk about whatever you’d like, but I’d like to ask, for our listeners, is there a fundamental set of controls that you would suggest anyone listening to this should absolutely make certain they have enabled in their environment?

Joe Erle: That’s a great question. What controls should you have enabled as the most basic? Well, the first, number one, is multifactor authentication. That’s kind of the gold standard, or that’s table stakes, right? It’s even hard to buy cyber insurance if you don’t have multifactor authentication. We can get you a policy without it, but it might have a $100,000 ransomware sublimit and no social engineering coverage. You need multifactor authentication. Don’t forget about it. It’s so easy to get, and there are so many great vendors out there that can enable it for you that there’s no excuse not to have multifactor authentication. The second one, of course, is backups. You need to have good backups. I think there are a lot of schools of thought on this, but you want to have backups either in the cloud or on-premises. You want to be able to test them. A lot of people have backups in the cloud, and they don’t realize that in order to restore from backups from Amazon Web Services, AWS, they’re going to charge you something like $150,000 just to open the pipes so that you can get that data back to you, and at a slow speed.

Manoj Tandon: Man, thanks for bringing that one up, because that’s very real.

Joe Erle: Really? Did that happen to you?

Manoj Tandon: It didn’t happen to us, but we know a couple of people it happened to. It was really cheap to put the data in there, but when it’s time to get it out, that’s when you pay. And they came knocking, you know, like, “Cough it up.”

Joe Erle: Yeah, so that’s where the insurance company could help you with that extra expense coverage because they know they’re going to pay that extra amount. But don’t use your cloud as your only backup. That’s a last resort to get your data back. You should have a system where you can restore within a couple of hours, if possible, and talk to someone like Manoj to get that in place. And then, of course, next-generation antivirus and endpoint detection. They’re almost the same thing now because endpoint detection companies are doing so much, but you need that protection on every endpoint. And that’s becoming really inexpensive now too. Vendors like Microsoft, Arctic Wolf, SentinelOne, all the big guys. I’m leaving off a ton of names because there’s a ton of competition there, which drives the price down, which is good. But find something that works with your ecosystem. Insurance companies don’t really care who you use. I wouldn’t use the insurance company’s EDR. If the insurance company is offering you EDR, I think insurance companies should just do insurance. So even if they’re offering you a discount on your EDR, I think you should buy EDR from the person who’s helping you manage your whole security ecosystem because it’s a key part of it. You shouldn’t just buy this from one vendor and that from another vendor and something else from another vendor. You should get your MSSP to set all that up for you so that it all works together. And those are the big three. Then there’s email security. They always ask about that too. And they’re always asking about cybersecurity awareness training now too, because even if you have really good cybersecurity, if accounting clicks on the wrong link or they’re socially engineered, you can still get hacked. So make sure you train your people. It’s worth the money because preventing one hack will save you all that money if you have the right awareness training.

Manoj Tandon: Thank you for that, Joe. Joe, take a minute here. It’s your floor. What do you want our listeners to know about you or anything you want to put out there? Anything you want to plug?

Joe Erle: Sure. You can listen to more cybersecurity content on the Ransomware Rewind podcast. We’re on Apple, Spotify, and YouTube, and most places that you can find podcasts. You can find me on LinkedIn at Joe Erle. Instagram and TikTok, it’s Cyber Joe, ITS Cyber Joe. You can email me if you’re interested in getting some benchmarking done for your company, joe@c3insurance.com. And of course, Manoj is going to be on the Ransomware Rewind podcast. So if you listen to him regularly, we’d love to have you come over and listen to me interview him.

Manoj Tandon: That should be interesting.

Joe Erle: I was rewatching it because I do some of the editing, and it was great. Really good episode. You’re an interesting dude.

Manoj Tandon: That’s very kind of you to say, Joe. But everyone, Joe Erle, I really appreciate you being here. Thanks for all the sound advice. Very practical episode that’s highly actionable. Thanks, Joe.

Joe Erle: Thank you. Thank you.