The Source for Cyber Insurance News, Insights and Data
Fifty-four percent of security leaders admit leaving high- or critical-severity flaws unpatched at least sometimes, a Chainguard survey finds. At companies with $1 billion or more in revenue, it is 66%. Cyber insurers already write unpatched vulnerabilities into their policies. Most security leaders expect attackers to get in through a software flaw this year. Many … Read more
Attackers are getting past multi-factor authentication by having employees complete it for them, Ontinue’s first-half threat report shows. Device-code phishing and fake IT support calls on Microsoft Teams both work this way. For underwriters, a yes on the MFA question now says less. The victim signs in on Microsoft’s real page. They pass multi-factor authentication … Read more
Attackers now often exploit a flaw before a patch exists. In a conversation with Cyber Insurance News, Revelion’s Mitchell Spicer said annual penetration tests can’t keep pace. Neither can the underwriting built on them. His company sells continuous penetration testing. “An annual pen test is a snapshot, and annual underwriting is a snapshot of that … Read more
Since March, this publication has covered at least six proposals to wire continuous monitoring into cyber underwriting. Sophos and Spektrum Labs. Jessica Newman on the podcast. Marsh and Resilience. CyberCube. Silent Push. Black Kite. All vendors pitching to carriers. Mosaic Insurance launched HALO on 17 September. It is a carrier that built the thing itself, … Read more
Mind the AI insurance coverage gaps. A vendor report says carriers are confused about AI. A RAND Corporation report says carriers are diverging, and names the consequences of each path. Sasha Romanosky and Celine Robinson spent the better part of 2026 reading actual SERFF filings, AI incident databases, federal lawsuit records, and enacted state laws. … Read more