Opinion | Guest contributor – Mitchell Spicer, co-founder and COO of Revelion
Estimated reading time: 6 minutes
ASOS has now disclosed two cyber incidents in about ten weeks. The first, detected in late July, saw attackers get into customer accounts using passwords stolen from somewhere else and reused. The second, on 6 October, saw thousands of customers receive a threatening “ASOS Hacked” notification sent through a third-party platform the retailer uses to message them. The company has said it carries cyber security and business continuity insurance.
That last detail is the one I keep coming back to. Somewhere, an underwriter looked at ASOS, made an assessment and set a price. On the evidence available at the time, it was probably a reasonable one. The problem is when that assessment was made, and how long it was expected to hold.
The Snapshot Problem
Most companies are underwritten once a year, at renewal. Most are penetration tested once a year too, often in the weeks before renewal, because that is when someone asks for the report. An annual pen test is a snapshot. Annual underwriting is a snapshot of that snapshot.
For a long time that was tolerable. It no longer is. AI-enabled attackers can probe continuously, cheaply and at scale, and new vulnerabilities can be weaponised in days. A company could pass its test in January, change its systems in February, be breached in March and still be priced as a good risk at renewal, because nothing in the process ever looks good again.
As continuous testing becomes more accessible, I expect insurers to place less weight on a single annual report and increasingly ask for evidence of recent testing, remediation and verification. The question will move from “have you been tested?” to “when were you last tested, what did it find, and what did you do about it?” Right now there is a lag between the threat and how often companies test, and a second lag between that and what underwriters require. Both have to close, and the second one is in the insurers’ hands.
Risk You Don’t Own But Still Carry
The two incidents highlight different but connected risks. The first involved attackers accessing customer accounts using passwords stolen elsewhere and reused. In the second, ASOS said an attacker had obtained an employee’s login credentials through impersonation and used them to access third-party platforms involved in customer communications. Together, they illustrate how risk can emerge through compromised credentials and systems outside an organisation’s direct control.
My advice to businesses, and to the insurers assessing them, is to start at home. Before you audit a single supplier, you need to know your own security is being tested and is holding. Otherwise you are asking vendors for assurances you cannot give yourself.
Then look at the supply chain with clear eyes. ISO 27001 certification and SOC 2 Type II reports can provide valuable assurance, but they are not a substitute for ongoing visibility into how a supplier’s security holds up over time. Annual security questionnaires are a reasonable start, but businesses and insurers should also seek evidence of regular testing, timely remediation and verification that identified weaknesses have been addressed. A supplier’s security gap can become your breach, your disclosure and your share-price problem.
For an insurer, the implication is uncomfortable but unavoidable: underwriting a company today means underwriting its supply chain, whether the policy says so or not.
What Two Incidents Should Tell An Underwriter
One incident can be bad luck. Two in ten weeks should prompt an underwriter to ask deeper questions, and I would say that about any company, not just this one. What changed after the first incident? Were the lessons applied beyond the immediate problem? And was the effectiveness of the response tested?
The measures that matter are proactive ones: finding weaknesses, fixing them and verifying that the fixes work before those weaknesses are exploited. Repeated incidents should prompt an insurer to examine whether that cycle is working, rather than relying on a questionnaire or a point-in-time assessment alone.
Where This Goes
Cyber insurance is still a young market, and it was built on an annual rhythm inherited from every other line of cover. The threat does not run on that rhythm. The companies that will be easiest to insure in a few years’ time are the ones that can show, at any point in the year, that they have been tested recently, what was found and that it was fixed. Insurers who ask for that evidence at renewal will price risk better than those who do not. And companies that cannot produce it should expect to be asked why.
FAQ – ASOS Cyber Incidents
What happened at ASOS?
ASOS detected unusual activity on customer accounts in late July 2026, using passwords stolen elsewhere. On 6 October, app users received an “ASOS Hacked” notification after an attacker used an employee’s credentials to reach third-party platforms.
Does ASOS have cyber insurance?
ASOS has said it holds cyber security insurance, including business continuity cover.
What is the argument against annual underwriting?
Spicer argues an annual pen test is a snapshot, and annual underwriting is a snapshot of that snapshot. A company can pass its test, change its systems and be breached before renewal.
What should insurers ask instead?
Spicer says insurers should ask when a company was last tested, what the test found and what it did about it.
What should two incidents tell an underwriter?
Spicer says one incident can be bad luck. Two in a short period should prompt questions about what changed after the first and whether the fix was tested.
Opinion | Guest contributor
This is a guest opinion piece. The views expressed are the author’s own and do not necessarily reflect those of Cyber Insurance News & Information. The author is co-founder and COO of Revelion, which sells autonomous AI penetration testing. Cyber Insurance News & Information publishes opinion submissions for perspective, not promotion, and was not paid to run this article.
Related Cyber Insurance Posts
- When A Hacked Robot Breaks Something, Which Policy Pays?
- A Pen Test Is A Snapshot. Annual Underwriting Is A Snapshot Of That Snapshot.(Opens in a new browser tab)
- Penetration Testing To Grow With Cyber Insurance – Report(Opens in a new browser tab)
- Malwarebytes Brings Personal Cybersecurity Tools To Claude(Opens in a new browser tab)
- Resilience Updates Cyber Risk Solutions with New Loss Prevention Features(Opens in a new browser tab)