Martin Hinton (00:00.51)
Where did they go?

Martin Hinton (00:06.53)
Alright, recording, all good.

Martin Hinton (00:36.984)
Good, good. Okay. All right, here we go.

Martin Hinton (00:46.638)
All right then, welcome to the Cyber Insurance News and Information Podcast. I'm the executive editor of Cyber Insurance News, Martin Hitten, and also your host today. Joining us is Jonathan Pardon me, Jonathan Palmer, the CEO of CDL Cyber out of out of the Great Britain, United Kingdom, England. Jonathan, thanks so much for joining us today. How's your day going so far?

JP (01:09.375)
Thank you, Martin, for inviting me onto the podcast. Yeah, my day day's going great. Thank you.

Martin Hinton (01:15.48)
So we discussed in advance to this a number of things which we're gonna get into, but one of them is and I wanted to jump right into this, is CDL's sort of mentality and motto, and I've got a quote here I'm gonna read for the audience, when you know. You've got to think like a criminal, act like an angel, and you've gotta be street wise when you deal with cybersecurity. Explain that to me. What is what does that what does that all mean?

JP (01:41.109)
Well, Martin, I've been involved in cybersecurity for about twenty six years now. And I I kind of especially for people that aren't involved in the industry to say it's good old fashioned crime in in many respects. There are only two really motivations there, maybe three if you count disruption, but either to gain information in order to turn that into some sort of monetary value.

or to gain some financial advantage or potentially to disrupt you if you're you know maybe a sovereign state actor. So in effect what I'm saying is that as you would kind of lock your door and take provisions as as a normal kind of human being rather than thinking this is very technology based, you know, when you're going about your business within your organisation or in the senior senior leadership team you should really

look at cybersecurity in in the same manner. and the kind of wraparound you have in terms of business process and technology should be kind of secondary to the way you're thinking about who's going to come after you and why they're going to do it and what provisions can I take to stop that happening.

Martin Hinton (02:55.969)
So it's a it's an old an old piece of advice in what I guess conflict or warfare is understand your enemy and and and put yourself in their shoes so you can anticipate their moves and protect yourself better. I i do I have that somewhat right?

JP (03:09.332)
Absolutely, Martin. You know, in the early days, you know, twenty-six years ago, I was kind of saying the same thing is that if you're at late at night and you're on your own and you're in an area that maybe you don't know, you wouldn't walk down the dark alley. and unfortunately in technology, you know, we get people, for example, to click on links every day to do their job of works and emails, and then we say, but they could be very bad. So

I think using that analogy of the dark alley, you've kind of got to think, and and and a lot of, you know, a lot of these emails are quite highly emotive these days, but you've got to think, well, is that is that an alleyway that I really want to walk down? and you kind of gotta view your whole strategy along those lines. Is that a risk to me? And if I do it, what is that risk gonna be? And what what may be the app?

Martin Hinton (04:00.929)
Yeah, so twenty-six years, take me back twenty-six years, to a basement in the English city of Leeds, which is toward the north.

JP (04:10.163)
Well, y yeah, it's it is. So the north of England, it was never my intention to get into cybersecurity or in fact stay in it. but I had some investors at the time who had made a lot of money in telecommunications in the in the late nineties. And to be perfectly candid, when they didn't want to go and do a meeting but didn't want to upset the person they're meant to be meeting, they would send me on occasion. And on this occasion it wasn't very glamorous, it was

actually in the back end of Leeds in an old Nat West bank that had been disused and only door open was the into the basement and as I'm walking down to the basement two gentlemen come up the other way and I go, I think I meant to be meeting you. And they said, no, we just sold this for two point six million pounds, which back back in the early two thousands was a lot of money and I said, I've come all the way from Leeds if you don't want to meet can I make

Cup of tea and said, Yeah, just shut the door behind you. And so as I went down to the basement and I was just putting the kettle on, I just now turned round to the left and there was two guys sitting there. And I said, You okay? And they said, Not really, we've just been fired. And I said, that's that's a bit harsh. And I said, What do you do? And they say, they said to me, we do something called encryption. I said, Well, what's that? And they said, Well, moving things securely from A to B. I went

That sounds really cool. You're gonna co come and work for me. and the rest is history. So encryption as you know today, believe it or not, there was two I I I the other other party at the time remained nameless. Wholesale, the kind of principles you have in encryption today, these two two guys are very clever, us and another company, really exported encryption technology back to the US market to start with wholesale. And that's what got me into into cybersecurity.

Martin Hinton (06:03.799)
I I think that the moral of this story as a as a fellow Englishman, despite my accent, is that you should always take time to make a cup of tea. You never know, right? I think that's the you know it's a it's a it's a bit it's a bit like putting a moment of friction in your day. You know, slow down, stop, think c who knows what you might meet. Wha what what did what did you what did you learn in those early days that that teach you that still applies now?

JP (06:27.049)
Well, it's really interesting. I I was I I had a business and we we were doing due diligence for the big outsourcers and co really counting things and just counting things better than they they could themselves. and I was on and off planes the whole time and I unfortunately was caught up in the the the nine eleven or just a week after and we were dealing with a Pentagon and the CIA and everyone, you know, was was using our our technology.

And so it was a very sad time. But then suddenly the whole rules of engagement changed overnight, really. there was some legislation in the UK came sorry, in the US came in to protect US citizens and against having encryption. obviously we weren't we were partly a U U US company by that point. And so the whole the whole concept of security where before you could just wander onto a plane and the kind of general ethos of

security was quite relaxed. And that kind of followed over to a degree into technology as well. And and there was a big kind of push on becoming more secure, you know, bringing systems in that would look after your, you know, look after your environments because obviously they saw s sovereign state actors, you know, do tremendous damage to Western company com countries. And it kind of went on from there. So there's a there was a massive growth

kind of spurt in the whole world of cyber at that time.

Martin Hinton (07:57.368)
Yeah, well me when you touch on an early day reality, I mean, for a huge percentage of the audience, flying pre nine eleven was a lot like going to a train station. I mean security was it was all designed y you know, the the the airlines had lobbied for security to be a little more lax because they wanted people passing through it quicker so they could be buying things inside the secure zone more frequently or have more time to do that sort of thing. And, you know, that's a lot that that attitude make it cheap.

JP (08:09.353)
Yeah.

Martin Hinton (08:27.275)
make it efficient, make it work smoothly, what was and to to s to a large degree still is the attitude around s cyber and digital software and that sort of thing. You y that's an interesting analogy. Do I d do I have that sort of comparison right?

JP (08:41.693)
Yeah, a absolutely Martin. And I I well, in my life I've had five near death experiences. one was sadly I was well, I was a week later on the same same flight after after nine eleven. I was you know I was running a bit late, so otherwise I'dn't my schedule would have been I would have probably been on that flight that suddenly came down and you know and and

Yeah, at the time it was very it was very relaxed and it was like you know, I remember going through security afterwards and the person in front of me had knuckle dusters and knives and suddenly he he was affronted saying, Well, why can't I do that when security's checked everything? Everything was checked and then there was kind of a realisation and so I thought kind of because I've had, you know, five near death experiences, I've always been slightly more attuned to what might come and get you than maybe someone who hasn't.

For example, and I've tried to put that back into cybersecurity to say, you know, it's not about in the the old days it used to be a green box with flashing lights, or box with green flashing lights even. And everyone get very excited about the late the latest great and greatest thing. But you know, it was even back then in the early two thousands, it was more about doing the boring stuff. You know, I was very much involved in ITS management, accounting stuff, knowing what you had.

Doing the boring stuff, is it up to date, which is massively relevant now in the world of AI? And and just like almost a checklist of ten things. And technology was kind of I guess the once you've done that, then yeah, go and get some stuff that will actually help you protect yourself. So that was that was kind of the the start of it all. And then you know, even back then I was going, Do you know what? You know, these these things don't happen in isolation, all right? There is planning.

Right. So if you're a a larger company, and now sadly you can be any organization at all, but back in the day, I wonder what the bad guys are doing. I wonder what these cyber criminals are doing. And and I wonder how they're getting to a point where they can work out that you're a you're a better target than your competitor. So I started doing a lot of kind of reconnaissance reports before they were really a thing, and they used to take days and days to do to tell organizations that

JP (11:07.913)
And there was one bank that I got locked in because I said, by the way, I went in with a a very well known te technology company. He can you just do any reports? I said, Well, it takes days to do, but if there's a lot of business, hopefully we we can do more business for you. And I walked into their boardroom and I said, guys, you do realize that it does say welcome to the bank of X in the middle of China. They ran out of the room, they literally switched off half their servers and came back and accused me of hacking them.

I said, no, no, it's the Chinese. and I did get a letter of apology eventually because I was in there for two hours whilst I was explaining it had absolutely nothing to do with me. But those and and back back then in the kind of early 2000s, if the technologists didn't appreciate the threats they were facing, how could normal people trying to and senior leadership teams actually try and try and work out what their risks are? And you know, we're seeing this again, this cycle goes round.

If you ever heard of Aesop's Fables, which w which gives some core about eight cautionary tales on life. If you haven't, then it's well worth a read just to bring human nature into perspective, is we're kind of doing a real circle now in terms of AI and everyone getting very excited about that and and and you know, saying it's terrible and it's scary. But you know, you go back to the early two thousands, what the fundamental, you know, human nature was there that was able to do damage.

and and hack and and get financial gain, is still as relevant then as it is now. It is just slightly different it's singing a slightly different tune.

Martin Hinton (12:49.887)
I I I think that any time we take old ideas and present them in a digital frame, it's very useful because as much as things in the threats are very different and dynamic and they require different defenses and and there is the underlying reality that all of it is driven by human nature and that is fundamentally unchanged over millennia. So you know, if if you if you think it's hard to comprehend why someone would break into your servers

JP (13:13.937)
Absolutely, Martin.

Martin Hinton (13:19.789)
Pardon me. Ask yourself whether you have trouble comprehending why someone would break into a bank and your your confusion should evaporate. I want to step back to the CDL sort of philosophy that we touched on at the very beginning: that think like a criminal, act like an angel. How does that work in a practical way? I know that that that that understanding your enemy, as I as I paraphrased it, involves.

reconnaissance, intelligence gathering, and that steps us into a world that for even some of the more sophisticated people gets a little bit hard to comprehend. And that would be say dark w web mem excuse me, dark web monitoring. Tell me about that part of how the that that that's how the philosophy plays out in in real time day day.

JP (14:09.097)
Yeah, absolutely Martin. So the Dart Web, for those that don't know it, is it can be used for a number of things, but nine ninety percent of the time it's used to trade illicit information, drugs, ammunition, all sorts of stuff. So you just can't get on it as an individual. in fact, if you try to in the UK and you don't know what you're doing, you'll probably get a knock at your door actually. It's quite quite impressive.

And I have seen that happen. and so on there, unfortunately, is that when you have a breach, the first thing that's probably gonna happen is you are gonna have a you are gonna have a a message come up and say, if it's ransomware, for example, would you mind paying five million bucks or whatever? They do a credit search on you. If you're a UK company, it's very easy to do. Work out what your balance sheet is and try and

act it accordingly and hopefully you see that and you you can take a number of courses of action. Now if you take no action the next thing they do is they basically put your information on the dark web and we work with a company called Searchlight which is very effective in in the dark web space and basically what they will do is they will say right this information and it can be bundled up into lots of different companies or it can just be you to embarrass you to start with

There are access brokers like the insurance market, you've got brokers and underwriters. The brokers will come along and say, right, okay, it's I don't know, one cents per bit of information or more, depending on how current it is. Some of this is ten years old, so that is a a problem itself. And then basically say, Okay, you can buy it. And and you know, it could be your customer information, it could be your information, it could be highly sensitive information if you're, I don't know, law enforcement, which sadly has happened quite a lot. It happened

Unfortunately with the FBI last week or the week before. And so, you know, that information is then to the people who know, and it's not difficult, to go and buy and do as they will and sell it on or use it against you. So what we do is obviously try and stop you to get to that stage. And there are some parameters there that if you're being looked at on the dark web, probably means that someone's targeting you.

JP (16:35.305)
And we try and do a wrap around in terms of looking at your reputational risk review, sentiment, who's talking about you, is there anything untoward going on? And just getting a general feel. And more importantly, if you're a senior leadership team, what can I see on on what can the team see on your senior leadership team just on the kind of social media and that kind of thing? And if you've and just as a a bit of free free advice, if you've got things like Google mail.

that is linked to your work account in any shape or form, we we can see a lot. And we we can build up a picture just like the bad guys do and and work it through. So go on, go on Martin, no, please.

Martin Hinton (17:14.839)
So if I'm go pardon me, go ahead. No, no, no. I was gonna I was gonna ask you, you know, one of the things that we know about leadership, particularly at a large enterprise, the C suite, the CEO, even board members who who are, you know, not I mean, they're not entirely full-time employees, if you will. One of the things I've been told through years is that very good senior executives at large organizations are not particularly detail oriented.

JP (17:26.269)
Yeah. Mm-hmm.

Martin Hinton (17:42.754)
Because if they've done their jobs properly, they have subordinates and a mosaic of leadership that is based on trust and capacity and ability, right? So they know that the head of their marketing department doesn't require daily check-in or, you know, have to worry about them all the time. And that's when you see people move their move positions. So when you gather all this information about some a company that that might exist on the dark web, how is that presented in a way that best benefits, say

JP (17:51.656)
Absolutely.

Martin Hinton (18:10.177)
the C suite or a CEO or CFO who's then looking at, you know, a s a budget line item for security, for insurance, to protect themselves against the threats that might exist there. W what is that what does that presentation look like?

JP (18:27.007)
Well, it's interesting you use the word presentation, Martin, because you've gotly a bit like entrusted. So you probably got a chief in in a large company, a chief information security officer, CISO. they they have to convey their risks and and and their budget to the boards normally, or to the CFO or whoever their their their kind of their their communication line goes up to. And and and there has traditionally

in many organisations being a very much a big gap between the communication of what a CISO, the kind of language they speak, to the the the kind of business leaders that are running the the business. So you can often find that things fall between the cracks and where, you know, I I I guess if it was pitched or presented in a different way may mean that the CISO gets what they need, is on occasion, and more than one occasion,

Perhaps some of the stuff they need to do their job is not budgeted for that year, because it's seen as a a nice to have rather than a must have. that presents obviously issues because if I'm looking at you on the dark web, unfortunately the damage is already done and your information's out there, and there is absolutely no way that you can get that back once once you've done. You know, in theory you can pay you can pay a ransom. That sometimes works and

Sometimes it just doesn't work depending on whether it's for financial gain. but you know, once that information is out there, the damage is done and the reputational is done risk is basically run on your organization.

Martin Hinton (20:06.593)
You you one of the things that we we've sort of touched on and that there's some some studies that you have done. There's a Mars study that that we've we've looked at in our research for this, and it's the idea that if there's information about your company on the dark web, it it significantly increases the chances of a breach of of some kind. And you mentioned searchlight and we had taught discussed in in in the notes we've shared in advance of this the Black Basta breach and that sort of thing. And I just want to look the the the we're talking about two and a half times

likelihood of a breach if you've got stuff on the dark web. You know, do you do you when you deal with companies, do they comprehend the that what the dark web is or is it just this sort of mysterious thing? What do they usually imagine it is?

JP (20:48.997)
Yeah, so to clarify Martin, yeah, it's a it's a great report Searchlight did, or got done done in conjunction with Marsh. And and basically if someone starts, so the the kind of unique spot that Searchlight have is the ability to see people d almost doing a drive by. So what they're doing, they're giving you a poke. They're having they're having a look. They're having a look at your kind of surface web what they can see.

And if that's happening, that's kind of where the two and a half times based on the research that you've you you've seen comes comes about. And and therefore you you you should start to become a little bit more mindful. And it comes normally every three months and peaks, and then you know, maybe nine months down the line you get hit because they've got enough off you off on you to see what they want to see. So in effect, yeah, the

Everyone knows what the dark web is. It's a bit like AI. Everyone thinks they know what AI is. Everyone thinks it's a very bad place. And quite frankly, it it is not the best place in the world, it's not wholesome, put it like that. But you know, that doesn't mean that you you know your stuff is there, or that but equally, it doesn't mean it won't be there. So when we talk about actually using a mechanism, and there are various messaging

communications are used equally as much now that we we monitor. when that stuff starts to happen then you should you should start to get worried and actually put provisions in place to say probably in the next couple of months we're gonna get hit. Yeah? And start to build up your your defenses in order to mitigate the fact that something bad is probably going to happen to you.

Martin Hinton (22:38.273)
I I mean we we we I I now that I you've you've begun us with Aesop's Fables references, it sounds like if you've got a ton of stuff about your company on the dark web it's it's a bit like a canary in the coal mine singing away saying, you better do something, it's gonna get worse.

JP (22:51.367)
Yeah. Yeah, it's g it's gonna get worse or I might have used some of that information just to call you up and gain some vital information like your admin passwords or for financial gain, you know. I've got a big transfer done because I've got enough enough on the CFO or someone who works with the CFO, to be convincing enough to pretend that I'm authorized to make sure that payment happens. And yeah, sorry, go on, Martin.

Martin Hinton (23:17.825)
Yeah, I mean No, I was gonna say you touch you you touched on the idea that, you know, that there there's phases to this. look, there's a lot of things about my company on the dark web. Not doing something about that is a a problem, right? Because there's every indication based on the research that that's a real precursor to some significant problem. So you touched on the idea of improving defenses. I would assume making sure your incident response plan and your capa you know, quote unquote resilience is is robust is an idea there.

I mean are there any other dangers to to to not reacting to that? I mean is it is a bit like sort of, you know, feeling a a pain in your heart and thinking, you what, I I I'm just gonna go about my day and and and not not not not talk to my cardiologist?

JP (24:02.099)
Yeah, yeah it's a very good point, Martin. So when I talk about if your stuff's on the dark web, you've y you you've kind of this has probably already happened to you. what search I give you is the ability to see when someone there's spikes in in traffic coming from the dark web to your to your websites or whatever is that is available to the you know, public could be able to be seen, right? So if that's happening then yeah, you should I mean the one I always say and it is

People go, well, of course we do it. It's like, well, do you do it well? Can you restore your data? Can you restore your data? Because people it's such a boring task. Everyone backs it up, but you'd be amazed how many people can't restore the data. other things like just send round a message to you know employees and just you know, you're anti phishing, just be aware, you know, just be aware s you know, you're in Marcom's communications.

Just step up that actually don't obviously say we're we're you know, we're it's the the threat's higher, but just make people more aware by reminding them of their duty and care they have as employees of the company when it comes to cyber. and simple things like if you don't know this this email or this person, don't respond or ask someone, you know, before you do something. You know, just take five second pause.

I know I've seen emails that are highly emotive and I always take a five or ten second pause to go, Is this real? And is this really something that, you know, I I know the person I should really be clicking on? For example.

Martin Hinton (25:36.6)
You know, it's funny back in May I was at an insure tech conference and a gentleman in the crowd of one of the sort of talks I was attending used the phrase, not all friction is bad friction, right? We we we started as we discussing about the speed of the internet, efficiency, you know, jobs is famous for his friction free iTunes store. And we're now in a situation where, you know, double checking that someone did in fact change their bank account for that fifty thousand pound invoice to be sent to all these things.

JP (25:53.855)
Mm. Mm. Yeah.

JP (26:03.401)
Yeah, yeah.

Martin Hinton (26:06.565)
And and even in your personal life, if anything makes you think that you should get rid of money faster than makes you comfortable, that's that's that's a canary in your coal mine, right? That is that is the the the chill in the back of your neck you should be feeling like, wait, you know what? I wait a second. You know, and I I I I again I I think that one of the things that we're you know inclined to do is get things done quickly. Click, send, read, reply. And this is, you know, again, back to your point about the human condition, the way w we are

We are maximizers, right? We we we seek efficiency. We we you know from the first time we realized a stone was better with a maybe a f a fine edge on it to to to cut up some meat, though we started making tools. And I think that that is again, a part of the human condition. and I I that's a bit of an aside, but maybe this is our our public safety message about the fact that, you know, if if you're a boss and someone's slow to do something and then the reason is because they thought it was a

fraudulent email or that they were being duped by some kind of phishing attempt. Maybe that's a time to as as I said earlier, make a cup of tea and and realize that you know sixty seconds or three minutes is not that long. but but yeah. You Go ahead.

JP (27:17.021)
No, no. And and and yeah, so j just just on that, Martin, I mean, obviously you you see, we've seen some horror stories where email communications get intercepted as well. And and maybe just picking up the phone and speaking to that person to say, do you really want me to do that? There there was a small yoga business near where I live in southwest London. And there's only five of them.

And yeah, and she was transferring the executive assistant was transferring the owner's money out the bank account thinking that she'd been asked. And it was only when Barclay stopped it on the fourth attempt. And I've seen, but then equally at the other end of the scale, I've I've seen shall we say of very large companies where the CEO and CFO sit almost desk to desk going, I've just done that transfer for you. So

You know, it's not just small companies that suffer from this, it's like we can all be duped. And it's just taking a pause, as you said, just just to go, well, actually, is is that really what's required of me? Is that what I've done every time is as things changed? And some some companies are very good at just putting those checks and balances, others haven't. And the and the the the kind of the final point on that, Martin, is that if you are a well-known brand, as a

as a bad guy, I'm probably not going to come after you. I'm going to come after your third party suppliers. And I I can pick anyone and I can find anyone and this is one that needs to be monitored, that has access at some point and and I will use them as a stepping stone to get into you as well.

Martin Hinton (28:58.805)
I I mean, you you have just touched on so much that I've learned in the several years I've been in this field of journalism. Everyone's a potential victim. There's a hundred and one ways into you what you think is your safe environment that you haven't thought of. the the efficiency of our supply chain, both in a digital sense and in the on demand sort of, you know, delivery of items creates all this sort of vulnerability that that really, really is something to be aware of, whether you're

you know, at a c a large enterprise with thousands of employees or a five person yoga company studio, it it is it is scary but not impossible to deal with. But yeah, it's it's a very, very good point. I just want to step back to we were discussing the the dark web. from the insurance point of view, from the cyber insurance point of view, where do you see that threat intelligence that it's fair to say can come from finding material on the web

factoring into the underwriting and policies and and you know the cyber insurance part of all this.

JP (30:04.007)
Yeah, that's a very good point. So I think as I said, if your information's on dark web, that's unfortunate and you've had a breach and you probably, you know, probably hopefully have declared that to your cyber insurance provider. Where where it gets more interesting is sentiment. So and and and looking at this, it's you know, back in the day you'd probably fill out if you wanted cyber insurance policy, and I'm sure it still applies in s in certain cases, eighteen pages.

To a degree, self self-certification with some caveats in there to say you must have multi-factor authentication on your devices, possibly. you must have maybe some accreditations hopefully help you. where we come in and we work with a number of vendors in this space to say, well, actually, what's pertinent to you? You know, what what as an organization and more importantly, this is obviously a massive challenge for the insurance companies, is well.

We've taken this as face value, and as one CEO of an insurance company once told me, my clients aren't doing this purpose. They're kind of leaving the keys in the car with it running, and they go out and they just go to the back of the car, the car gets stolen. Yeah? They don't mean to do it, they just didn't realise that perhaps that was not the best thing to do to leave the keys in the car, and they didn't really understand, you know, the risks that they were potentially facing by doing that. Which is a very gentle example of saying, well, actually

You've probably not fulfilled your obligations in terms of the insurance policy you've done, but you didn't do it in a victic or any, you know, it wasn't a fraudulent matter. But obviously that ruins the relationship of the the broker who supplies that policy, which may be supplying another a million pounds worth of you know, written business in other areas of insurance. And they don't want to ruin that relationship that might have been around for 10, 15 years. So it's a it's a it's a really

it's really important that intelligence is factored in when you when you're both sides of the equation one to make you sure that you're not overpaying as a as a customer or client but equally to actually get to the most accurate position you are with the client to say well from an underwriting position this is your this is what's happened this is potentially what could happen and these are the things that

JP (32:29.267)
you you need to be aware of, yeah. now I'm sure everyone listening to podcasts say, well we do this anyway. It's like, yeah, but it's to the level you do it which is the absolute key. And I know that obviously thousands of cyber insurance policies are written every year and you know underwriters I'm sure will take the worst case scenario and and price it out accordingly but wouldn't it be better if certain things could be done to actually

kind of for every single policy that goes out there, makes it as tight as it can, which has the the effect of ensuring protecting the client as much as they can. And intelligence is a big part of that.

Martin Hinton (33:11.307)
I mean I mean it's you know, I mean we we hear a lot about cyber being difficult to underwrite because there isn't decades of information about claims like there is in say homeowners. it seems to me that this sort of preemptive I mean it's almost like looking into the future, seeing this information in the dark web, right? Go ahead.

JP (33:31.947)
Well yeah. Yeah, well traditionally, and this is where the this is where the industry kind of falls down, traditionally it was a very reactive industry. You had a breach or someone's attacking you, technology traditionally was there to protect you from something happening. Now we're in a position where, you know, we we've built the walls of the castle as high as we can, but we need to be able to see over and look.

to see what's coming at us. Yeah. And so organizations and and also, you know, in terms of getting the insurance, and one of the reasons why cyber is it's not even trend analysis because technology changes and and the threats kind of the motivation stays the same, but the threats kind of change is the variables are too there's too many variables. And and so you know it's very difficult

to you can insure a car or a plane because you kind of know what's going to happen. You know, there are some out certain outcomes. God forbid a plane falls out of the sky or a car crashes, but you kind of know what the variables are. In run underwriting cyber, the the variables can be almost infinite because you've got so many different types of technology and scenarios that could hit a client. And obviously you can say, actually no, we're not going to pay out. But that goes back to my point that if you're writing a lot more business in other areas,

That's not going be very good for the business relationship you have your client. So what can you do to protect yourself and actually go? This is the best we can do for you. And we've done everything we can to protect you against the threats you've got. And this is your policy. And these are the kind of things you probably want to be thinking about to make yourself even more secure. And that br brings goodwill. that that is in the market now. There are there are stuff done. But again, you know.

Things like the Marshall McClellan report that we we touched on about if you are being hit and you're being poked online in effect and some people from the dark web are looking at you, you you know, you know that that risk is gonna be it's gonna be heightened. And therefore, yeah, it gives an indication to the insurance company what may happen and to yourselves.

Martin Hinton (35:43.896)
So we have touched on disparate, confusing, complex, changing, all the sorts of things that we know exist in the sort of cybersecurity, the the threat space. When it comes to communicating this to a board or a C suite, when it comes to asking for money for the budget for whatever it might be, that that task often falls to the chief information.

security officer, the the CISO. And then there's a communication problem there where sometimes, you know, all of cybersecurity is looked as a a a cost center and the there there isn't the capacity to see how protecting against these very real and potentially financially damaging threats is about continuity of business, resilience of the business. you know, you you wouldn't let a leak in the roof of your warehouse storing furniture.

persist over time because it would be bad for the the health of the business going forward. Cyber doesn't really fall into that same space. There's an irritation. So one of the things that we joked about was if you gathered all these CISOs in a pub and a in a safe space where they could, you know, off the record share their deepest fears and their greatest qualms, they would tell you what? What what is it they can't say to the boardroom or they have challenge communicating to boards when it comes to this

JP (36:42.603)
Yeah.

Martin Hinton (37:10.475)
situation and this reality for businesses as we've said of all sizes.

JP (37:15.722)
Yeah, that's a a very very a very pertinent point. If I if I look at it from, you know, a business perspective now, c cyber security is his own, you know, it's his own profession, you know. And the the n the number of times over the years, getting less still happens. I've got a an IT person to do this for me. Well, actually they they've spent a lot of time getting accreditations and doing their stuff and they might be very niche in

in cybersecurity and that's really got very little to do with technology. In the US, it's a lot more advanced in terms of how it's viewed and how it's managed and you know and how CISOs are are are actually treated. in the in Europe it's kind of it's kind of different. It's still seen as a very technical role. and therefore when they're presenting, you know, the first thing you know from the kind of empirical evidence that I have

Is they go, Well, you're asking us money for technology. And it's like nine times out of the ten, they're not, they want support. they they they want to know that you know the culture, the business is taking on board what they're saying. And and a good example of that is AI. Everyone's going, it's so powerful. Yeah, it's powerful, it could do some neat stuff. But it comes down to vulnerability management where your software's not up to date, right? So, what will happen?

Is the CISO and the team, whoever the team is, will go to the business or whatever their peers are in IT say this needs patching, right? And they go, Well, we've got a lot to get on with. And so therefore, if it's not patched, it's not secure. And AI is way fast at picking that up, faster than digital, but that doesn't matter because the bad guys are scanning the entire internet every single day. So they if they can see and what's known as attacked service management, they they can see some vulnerabilities looking

From the outside in, they they will go after that. So a lot of it is support and and the perception that actually they've got a very important job of work to do and that they are supported. So when they when they ask for something to be done, it gets done. Because if it doesn't get done and there's a hack, they get blamed nine times out of ten, even though it wasn't them because they said, please patch this. And that's just that's one example, but it is

JP (39:35.262)
In the world of AI and where people are saying everything's so powerful, it's like, well, nothing's really changed. It's got a lot faster, but things weren't really being reacted to in a way that they should have been in the first place. And I understand people are very busy, but it's a huge problem.

Martin Hinton (39:52.034)
Well so in that in that context, is there is there something that CISO should be saying to boards or not saying?

JP (40:00.661)
Well, I I I I guess traditionally, you know, you probably got it in the ballpack, half a page or a page of what what the risk is. You've got the risk register. you know, it's always been this thing that y y you you you should probably have someone I I I would argue, a bit like you're seeing in AI, a lot of AI, you know, head of I I head of I I is are actually come from the business and not from technology, for example. Seeing a lot of that.

And therefore, why not take and probably won't want the job, because the statics that they went talking about insurance, I think the the mortality rate of a CISO is seven years less than any other professional. So it's a very stressful job. but to to have a you know, a not lip service, but you know, someone on the main board who kind of gets this, who speaks the language, who understands the business, and then can go and ask all good questions.

And it has has the the latitude and and the power to go, right, okay, has this happened? Because if this doesn't happen and then have the CISO doing their job and keeping the safe and secure that can go to them without judgment and go, this hasn't happened and if this doesn't happen, this could be bad. And for someone to go and say, Right, okay, we're gonna deal with it and we we will deal with it rather than say, Okay, it's on the board.

minutes and it's gone in the risk graduate, it's gone up. Now it's number two. Okay. When's that gonna get looked at? And I think it's is a change of culture, it's a change of mentality and that would help. And and just definitions in terms of the cultural if you haven't got the right cultural mix at the top about risk, yeah. How to manage risk right at the top, and an understanding of that, then you you you the these guys, you know, are gonna struggle to do their jobs.

You know, and and it comes down to chance then. You know, it just comes down to chance and I hear a lot people going, Well, I'm gonna have it in the budget for next year, whatever it can be and it can be a fundamental part of cyber that you would expect, but they've just not had the sign off on it. It's not their fault, they wanted it, but they couldn't have it.

Martin Hinton (42:14.541)
So I w I want to sort of move to tying this communication sort of struggle to the buying of cyber insurance. You know, when a business buys cyber insurance, what should the board understand about what's going on, that process that that that's occurring through the sort of, you know, which you took you touched on the the the questionnaire reality, which we hear is fading away as as you know, full time monitoring, but the the assessments so the outside in, inside out, of of the of the risk.

that a company faces. What what do board boards need to understand about the the the difference in buying cyber that that is not like others?

JP (42:53.204)
Yeah, it's a very good question. It is gonna be the support you get. I mean, unfortunately for most organizations of any size, it's gonna be when, not if. They they are I mean, they face obviously multiple daily threats at large companies anyway. So it's it's always gonna happen. So what is the support? What what instant management are they gonna get above and beyond? What mark ons are you gonna get in terms of managing that process?

What external expertise is going to happen? Because even if you have a team of people who may or may not be able to respond to the crisis themselves or having to manage other other bits, who can you bring in within hours of it happening to help you? Because if you were to go into the market and and of want the same service, it would be by a factor of at least 10 you would pay if you could get them, if they were around to actually.

come in at very short notice and do that. So a lot of people say, right, okay, I've taken it, I've ticked my box and I I I've done it, or I've got a really good relationship with my current provider. and therefore I'm gonna do them. And hopefully the broker will guide you through that process. I mean the the other thing is capacity in the market as well. You know, how much capacity is there? The UK government many years ago said right, I want everyone

Insured on cyber and the market came back and said we just don't have capacity. There's just there's no way we could do that. So in terms of and I don't know what the up-to-date stats are, but in terms of the overall market in the UK, you know, it's growing, but it's still relatively modest in terms of the actual people who take cybersecurity as a policy. the other thing, of course, it's a bit like in the eighties, certainly in the UK, where you had certain types of cars.

they become they basically become uninsurable. And anecdotally, I I know of a number of companies where the excess is becomes so high or the policy the the policy is so costly, it's almost, you know, they're getting to a point where we might as well self self r insure ourselves because commercially it's just not going to work for us.

Martin Hinton (45:13.985)
I mean, one of the things that I've I've asked a few people is that the the rate of adoption of cyber. I mean, the example I think of lately is Jaguar Land Rover who were in the process of negotiating their their cyber when they were hacked and those results didn't have cover. There's an enormous if if some of the topics we've addressed, like the ability to use all the information out there to assess risk and underwrite a policy effectively, to price it effectively, if all those

disparate points can be brought into a place where they can be analyzed s efficiently and effectively. There's a real upside here for the insurance industry because there's a lot of people who don't buy this product, and as we've discussed and as we know, who could use it because breaches happen, incidents happen. I mean, w what do you think about that from a sort of sales pitch point of view, about figuring figuring all this out and using the tools that exist as a way to to grow an insurance company?

JP (45:58.453)
Yeah. Yeah.

JP (46:08.756)
Yeah, absolutely. I mean we're we're working with some very, very advanced AI at the moment, which would allow y the the issue you've got, because you've got so many variables, and until now it's been very difficult to bring all those variables into one place and really analyse them to see what they truly mean. and we're working on some very advanced AI that's not ready. Well, it will be ready available very shortly, to be able to do that.

And actually have a look at risk, probably in a way, and very boring again, just taking all those components, assessing them, and going, right, okay, well, this is this is the situation with XYZ Company. So, therefore, you can then put against your usual pricing model and actually say, Well, based on the trend analysis we have, this is what it looks like. This is what it truly looks like in terms of this, rather than have to go every time to the worst case scenario.

Which is completely understandable based on the variables that kind of stick out and and work it through. So I think that will be a huge sea change. I think yeah, we're you know, we've had a big problem in UK around flooding and houses, big debate because we've had a huge number of houses built on floodplains saying, Well, who's gonna insure them? And, you know, throwing it out there is is it gonna be have to be a point that the government underwrite X number of

Not that we have the money in the UK at the moment, but a s a a segment of the market that has to be insured, for example. You know, how's that going to play out? Is things, you know, critic Go on. Sorry, Martin.

Martin Hinton (47:43.766)
Yeah. No, I mean you you you you you you no I was gonna say you raise a really good point, right? You can you can deal with these things piecemeal as they become impossible to ignore. And again, back to Jaguar Land River, the government stepped in there and I I think that the the running total is is it two and a half billion pounds, which is you know the combined losses across their supply chain and everything like that. But coming up with a

I don't know, is holistic system in the right way, like a an a a literal plan for when this happens regardless of who it happens to. You've got some sort of, you know, idea about how to respond in place, which I mentioned because one of the things that I wanted to ask about was sort of the tabletop exercises, the the the if you will, the fire drill for digital. How much are

role do you think those should play? How important is is that sort of, you know, practicing for your worst day when you come in on a Monday and every screen is blue and you can't access payroll and you can't access any of your data to have a checklist probably printed out and available to you in a non-digital form that you can react to and begin the process of dealing with what is in fact an emergency.

JP (48:57.094)
Absolutely, Marty. It is critical. some of it's done extremely well. And a lot of a lot of it still, to be perfectly candid is is lip service. So you know, the first thing I always ask a client is how do you restore? What happens if this happens? Simple stuff, you know? And they i if they pause and go,

then I know that perhaps yeah they they need they need to kind of look at their whole strategy of what they're doing. And it is important, you know, if you go on as a CEO onto onto the news and say the wrong thing, you know, we live in a sophisticated world, or at least you can Google it or chat TTP or whatever you want to do to see is that correct? Are these people telling the truth? And the number of times I've seen you know senior leadership teams go on

And say stuff, and I'm going, well, I'm not a practitioner. I I'm I'm someone that's lived and breathed this 26 years, but I'm not not necessarily technical, but I kind of know what you're saying. You probably want to frame that in a different way. So having these exercises and actually, you know, from the top down and being able to give leadership is absolutely crucial. And whether you call it a tabletop exercise or you just expand that out into

other ways of actually managing that and just making sure that people know their roles and what they're doing is is is crucial.

Martin Hinton (50:30.551)
I think back to the times I've worked in large corporate media environments and there were routine more than once a year, I feel like, fire drills. And this wasn't a school fire drill where you all got up and you walked out and t y the you gathered by the nearest stairwell on your floor. You went through the map of your floor in case that stairwell was was not available to you for whatever reason. And then a fire warden talked through how to respond in case

JP (50:41.941)
No, no.

Martin Hinton (50:59.053)
smoke alarm or the fire alarm went off. Where to go, what to do. You know, w don't go down to the lobby. Go down to the next floor where the door, you know, the the this is a fairly sophisticated building that I'm I'm thinking of in this moment. And that idea that we do these things in the real world for things we know that exist because we know. And that you should apply this to the digital threats seems like something that would be obvious. But again, proximity as as you and I are close to this world.

makes you think that everyone sees what you see and that's not the case. and it is it is a it is a dynamic reality that that you need to prepare for and that'll make you much, much happier the day it happens.

JP (51:41.342)
Yeah, and and I it's a really good point. I love the analogy, Martin, because for many years, up to about ten years ago, I always I always viewed myself between a real estator and HMRC, our tax authorities, as the kind of funeral undertaker of the technology world. As soon as you mentioned during cybersecurity, people either walk away or go, it's really scary, and then walk away. So

You know, a and and it still has. People still come up to me of all sorts of levels and go, Well, it's really scary and there's not really we can anything can do, it's gonna happen. It's like, well, and I love your analogy, I will use that, Martin, in future because that is the best way of looking at it. And today we haven't really talked much about technology because technology, as I said, is i is it has its part to play and it builds your castle walls, but just the kind of things we've discussed today.

And and just rehearsing, as you said, a bit like you did with your your far drills, it is a good way and it will just make everyone much feel much more confident, should and when the day happens to you.

Martin Hinton (52:45.685)
I I you know, I also think, you know, having sat through those rather irritating fishing powerpoints and click this, don't click that, should you click this, should you click that. The act of physically getting up and having to do something makes it more real, right? You know, you know, if you were to sit at your desk and read a PowerPoint about what happens if there's a fire, that's one thing. You get a retired firefighter standing there talking about this, and maybe they throw in a couple of stories about being on the job and that sort of thing.

It creates a moment. Even even the camaraderie of doing something like that with your employees, the idea that it makes it real is again back to the human nature of this and and the you know the the enormous percentage of of breaches that are a function of human event, right? Like whether it's social engineering and you're tricked, or you click something inadvertently, or business email compromise where you don't realize an account number's changed, or you're changing the delivery of a an im a a a a payment for an invoice and you just do it.

Because you're doing fifteen or twenty of these an hour and you just gotta, you know, you've got a, you know, a monitor saying, you're you're a little behind schedule, that sort of thing. These are all things to create a reality about this. Cause what I say all the time is, you know, most of us have no idea how the ones and zeros make Netflix play movies on my phone. I mean, I I I don't get it. But we all know when it doesn't work, and we know when it stops working, what that means for us, you know. And I and I think that that is there's this sort of

JP (54:03.626)
Yeah.

Martin Hinton (54:08.151)
connective tissue there that sort of brings brings us to to the next point I wanted to make is that sort of the shared threats across say the supply chain. And you know, we talked about the retail incidents. Well we haven't really we touched on the the j the laguar ja Jaguar Land Rover hack, but not Marks and Spencer's and co-op and and some of the other retail hacks that have occurred. We did talk about CISOs and one of the things that that we know is that the threats exist across industries and across whole sectors of the economy.

And a few CISOs I know have spoken to me about how they find it very valuable to even talk to competitors in their own sector about the threats they're seeing, because these threats are shared across supply chains they might share, whether it's software or a literal s physical supply chain. What about that idea of sort of you know you know a World War II mentality where we're all in this together, loose lip sync ships, kind of helping again, because you in the Jaguar Land Rover hack we're talking about j the UK GDP taking a hit.

These are national security issues, as evidenced by in y in in your country, some of the efforts the government's making to build build resilience across the nation, not just here or there.

JP (55:17.738)
Yeah, absolutely. And and CISOs are basically the unsung heroes of just keeping keeping the lights on from from people that want to harm us as a as a whole. So we we absolutely encourage it. In fact we we tend to quarterly do a somewhere in the city of London take them all to the pub and they can all t talk to themselves. There's no nasty people trying to sell them stuff and they can just t chat and just swap stories and stuff going on.

There are industry sectors that have groups that are specific to them. But I would equally I would say, and you do you do get trends as we saw in retail and JLR and Co op and S where there was a there was a bit of a run on retail. but whether you're you know a small shop or a big a big you know high street name

The the the problem is certainly since the Ukraine war with the Russians in the UK, I'll just pick that as an example, is it's just unilateral damage. Yeah. So you can just be, you know, collateral damage in terms of what hits you. So the days of saying, right, my industry needs to do XYZ because I'm in banking, which is obviously a very high risk, crypto being number one. but the North Koreans obviously like to like to go and keep their economy going by

Taking vast sums out of crypto exchanges. And then probably banking and finance number two, depending on how you view things. But ultimately, you know, everyone now faces the same risk. So that poor small business now has the firepower potentially of a state actor. I'm in it. I picked out Russia. That's a good one for the UK. And they may get hit by the same power, firepower that they put towards a bank.

if it's financial gain or if it's reputational risk, one could argue that some of the names, I'm not going to mention them again, you know, were you know were actually to embarrass as much as to as to you know gain have a financial gain. using third parties to to you know to get to where they need to again, a c a classic way in. So, you know,

JP (57:39.969)
The the threat vectors are, you know, dynamic, but as the world becomes, you know, horrible saying, a more dangerous place in terms of geopolitical aspects of it, it means that motivations that probably weren't there and and the kind of resources thrown at it are much higher than they would have been, say, five years ago.

Martin Hinton (58:02.381)
I mean you you you touched on something we really haven't explored that that people need to keep in mind is that the threat that we're facing is highly organized, in many cases nation state backed, and the they're extremely and have been for a long time pre AI, extremely profitable. And the idea that that you you could be in a conflict in that scenario and increase your security and threaten their bottom line without getting a strong and severe reaction is

JP (58:12.64)
Yes.

Martin Hinton (58:32.085)
naive in my opinion. I I I I I I wonder, you know, the obviously the the the the the phrase or the reality that's landed in this world in the last couple of years is artificial intelligence. And I and I wonder as we move to the close whether you have any sort of thoughts about is AI making cyber clearer? Is you know we hear about threat actors using it. W what I have started to increasingly call just criminals using AI to steal from you digitally, right? The the

There is the talk of it being used to monitor threats 'cause it can see things faster than humans can or react more cleanly and then alert to to maybe a human in a sop that needs to do something w whether the human in or on the loop. I can never get those two quite straight. what about AI in this space?

JP (59:21.268)
Well, well, what a what a buzzword, Martin. Yeah, I'm I'm working on the on the very latest frontier model that no one no one on this would have heard of that doesn't have the the issues that we're seeing. So what does that mean? Well, at the moment it means there are some fundamental issues around AI frontier models, around integrity, around data sovereignty. but more importantly, as you intimated.

they can spot anomalies much quicker than obviously a human being will ever do. So that can be used for good and bad. So if you're running a kind of software for operation center, that the the the kind of SOC world is it's always been where you've got people monitoring your network and stuff is always been a bit of a flawed business model because it's open to interpretation however you look at it. I reckon the SOC companies will not be around in in five years' time.

no need because or certainly the first two levels, apart from the real specialists, will be done by AI. Probably in 18 months, you you you can do that. And I've seen technology that will do that. So that's the positive. On the negative, you've got the ability now to see things and see anomalies far, far quicker. And a very mundane example I mentioned, software vulnerabilities that are just out there in the wild that by scanning the network.

the you know the outside world looking in, you can see. Now AI can do that in seconds. So if you're not able to react to that, or if you don't have a policy that actually means that for things that are dear to your heart, like your software and your systems, that are not up to date and there are vulnerabilities, you kinda need to know how to do it really quickly. And there are ways of doing it, but again, empirically, I don't see enough of it. And and that's that's a large company's down. So

Martin Hinton (01:01:18.967)
Well, JP Jonathan, we've been talking about an hour and as as as promised and discussed we we didn't get to everything. Is there anything we didn't talk about that you'd you'd like to say something about? Or anything you want to say something more about?

JP (01:01:29.78)
Yeah, I'd just like to end on the fact is that you know, I I'm dys I'm dyslexic, so I see things I think slightly differently. And I, you know, I don't want people to walk away from this podcast to think there isn't any hope or there's nothing they can do, or that they are scared. They just need to be aware, you know, it's just really important to be aware. It's really important again to look at it from a a human perspective and say, Well, what is my risk?

And are, you know, are are my suppliers doing the right things? Are we doing the right things? As the senior leadership team actually protecting us. And again, with your brokers and you know insurance brokers, you know, have we have we got the right fit for this? Or have an honest conversation with them to say, actually, it's too high. What can I do to help me? And and they will they will have expertise, a lot these guys. So thank you, Martin. Really good talking for you.

Martin Hinton (01:02:28.193)
my my pleasure, my pleasure, JP. I guess I I w one last question. what does streetwise cybersecurity look like in twenty twenty six?

JP (01:02:38.901)
it means take the Euphora out of AI and have a very, very good look at what you're implementing on your desktops. If you can't audit AI on your desktops at the minute and shadow AI, that's the first thing you want to do as an organization. 'Cause some of it out there, and some of the household names, you need to be very, very careful what you're what you're putting on there because otherwise you're gonna f you're gonna you're gonna have some real problems.

Martin Hinton (01:03:05.131)
Yeah, I I I hear, hear, here. Well, JP, CEO of CDL Cyber, thank you so much for your time today. Really, really appreciate it. Really interesting. For the audience, we've referenced a bunch of things, Mars study, a few events in the news. There'll be some links in the show notes for those. so you can find them. If you've got a question or a comment, please leave it wherever you're listening or watching this and we'll we'll get an answer back to you. And if we can't, we'll we'll go on to JP and get some expertise.

but thank you, JP, again, for taking the time to chat with us today. Everyone else, thank you so much for listening, tuning, tuning in. if you could give us a like, a subscribe, all that helps us reach more people with this really important information. again, I'm Martin Hinton, the executive editor of Cyber Insurance News and Information. Thank you so much for your time today. Enjoy the rest of it.

JP (01:03:54.485)
Thank you, Martin.

Martin Hinton (01:03:57.836)
Beautiful standby one sec.