No Detection and Response? No Cybersecurity Insurance.

Cybercrime is escalating, both in maturity and frequency, with ransomware emerging as the dominant risk. The threat landscape has evolved from discreet targeted attacks aimed at specific data to attacks with the broader goal of taking you offline. Threats are indiscriminate—criminals don’t care about your industry or what data you hold. They want to lock you out of your systems and applications because they know you’ll pay to get back online or to stop them from leaking your data. It’s a broader market for a bigger payday.

This sea change has cybersecurity insurance providers reevaluating the market and classifying more industry verticals as high-risk, which means higher premiums. In 2021 alone, cyber insurance rates increased by 96%. As insurers perform comprehensive, technical, and strategic underwriting, if an organization’s defenses are lacking or data recovery plans are thin, they’re not afraid to say no to new coverage requests or renewals.

Without detection and response programs in place, your cyber hygiene won’t cut it.

What Do Cybersecurity Insurers Expect?

Criminals are taking advantage of poorly configured authentication strategies like weak password management, lack of multifactor authentication (MFA), inconsistent or missing patch management, or network misconfigurations. Any gaps in your environment are an opportunity for possible disaster.

In response, underwriting requirements are more rigorous. The minimum expectations for coverage are increasing. This trend is positive because it encourages defense in depth by layering security controls that reduce risk. Multifactor authentication, endpoint detection and response (EDR), email filtering, and web security are four primary security controls every organization should have in place to prevent threat actors from gaining entry to their system. A fifth is secure backups that are encrypted and tested to round out cyber resilience against malicious actors.

While controls like MFA and vulnerability patch management are established best practices, not everyone has them in place—perhaps due to a lack of information, budget, or understanding. In many instances, firms are only concerned with checking a box for the minimum requirements—an inadequate practice that is coming under scrutiny.

The bottom line is that insurers want to know how you protect data confidentiality, integrity, and availability (all things, by the way, protected by detection and response programs).

Data confidentiality. You can count on underwriters digging into the controls you have in place to protect your data. One area of focus will be making sure that you are protecting and managing access to privileged information. They want to know if there are holes bad actors can exploit to gain access to privileged information. Is your data encrypted? Do you have strong network access controls?

Data integrity. Data integrity requires accuracy and credibility and is preserved through these conventions

• Attributable: You know who created each piece of data and when they created it.
• Legible: Recorded data is readable and can’t be changed accidentally.
• Contemporaneous: Data is recorded when an action is performed, not after the fact.
• Original: Data is maintained in its original form (a form or database, for example).
• Accurate: Data is error-free and truthful. Your protocols must include recording who changed a record along with why and when they modified it.

Data availability. Data backup and regular recovery testing are essential when a criminal’s goal is to take down your entire operation. You can’t earn revenue if you’re locked out of your system and your data isn’t available. Make sure your backups are separated from the rest of your network. It won’t help you to have regular backups if they are encrypted by ransomware as a part of an incident.

Insurance policies respond to both ransom demands and data recovery plans because ransom payment doesn’t guarantee you’ll get your data back. As criminals become more brazen, it’s apparent that many organizations are ill-prepared, and underwriters are concerned that data recovery takes too long.

Timely incident response and remediation can reduce the reputational and financial impact on your business when your data isn’t available. Make sure you have a solid plan in place.

Does Your Cyber Posture Make the Grade?

As you try to stay ahead of the game, how can you protect your data, bottom line, and reputation and ensure you can secure cyber insurance? It comes down to cyber posture.

A mature posture requires basic controls to be in place—MFA, endpoint detection and response (EDR) solutions, and proper network segmentation for starters. With that foundation in place, you can implement an extended detection and response (XDR) program to watch over your entire environment.

When analyzing past security incidents, we rarely see an organization have a serious incident when they’re doing more than the bare minimum. It sounds like a no-brainer, but we see preventable vulnerabilities all the time.

If you’re not sure where to start, our cybersecurity team has a suite of services at the ready. We’ll help you prepare for meeting cybersecurity insurance controls and requirements as well as prevent or handle an incident when it happens. Agio’s suite of detection and response services ensures you’re prepped, practiced, and ready to respond to any threats.

Agio Endpoint Detection and Response

In the wild, most threats are targeted at an endpoint. To minimize incident impact, you need EDR to collect and correlate activity across multiple endpoints. Without EDR, your environment is an open invitation to bad actors.

Over the last three years, we’ve found that in every case of a client who had an incident, if they’d had EDR deployed in their environment, it would have minimized the impact of the incident.

We know robust endpoint protection isn’t just about malware prevention and cause analysis (that’s only the beginning). Our EDR solution goes beyond that and provides forensic analysis and device usage policy enforcement, proactive recommendations to keep your environment more secure, and help creating detection rule sets tailored to your configuration of rules and responses.

We’re constantly evaluating best-in-breed tools, and as the threat landscape evolves, so do our service and the level of protection you receive. Where the other services fall a step behind the bad guys, we remain in lockstep with their tactics.

Given the strict requirements needed to obtain cybersecurity insurance, without top-notch EDR in play, you’re unlikely to find coverage.

Agio Extended Detection and Response

Agio XDR is a solution that combines the tools insurers want to see into a single pane of glass: MFA, EDR, incidence response, endpoint protection, email threat protection, phishing protection, and deception technology. We back our SIEM with industry-focused security analysts with the initiative to apply industry-specific detections across client environments.

You get unified security management, relentless diligence, unrivaled expertise, and innovative technology—all the things you need to ensure you’re ready for an underwriter’s comprehensive evaluation.

When you bundle Agio EDR and Agio XDR, we can detect and prevent critical threats fast. Our full suite of services fortifies your cyber defenses and means the difference between a security threat and a security breach—and successfully applying for insurance coverage.

Key Takeaways

As cybercrime intensifies and shifts its efforts to a broader range of organizations, cybersecurity insurance companies expect to see sophisticated security processes and controls in place. These rigorous requirements can make it difficult for organizations to find coverage if their cyber posture is lacking.

A surefire way to improve your chances of getting that “yes” from an underwriter is to exceed expectations. Agio is a comprehensive vendor and can help you implement programs and tools that stand up to scrutiny.

There’s no such thing as being too safe when protecting your users, devices, and reputation from the world’s most sophisticated threats. Our detection and response programs help you plan for the unplanned. Incorporating Agio EDR—a solution supported by predictive intelligence and human brilliance—with Agio XDR increases the ability to detect, analyze, and respond to threats in your environment.

Are you ready to exceed expectations? We’re here to help. Connect with us.