Martin Hinton (00:00)
This is the Cyber Insurance News and Information Podcast. I'm Martin Hinton Executive Editor. Every week we talk to the underwriters, brokers, and security leaders shaping the market.

Martin Hinton (00:11)
Whether you're new or back for more, if you haven't hit follow yet, do it now so you don't miss an episode, and thank you.

Martin Hinton (00:18)
All right then. Welcome to the Cyber Insurance News and Information Podcast. I'm the executive editor and your host today, Martin Hinton. And joining us today is Jim LaRoe. He's the CEO of Symphion, which is out of Texas. And Jim, it's great to have you with us. How's your day going so far?

Jim LaRoe Symphion (00:34)
fabulous, Martin. Thanks for having me. Appreciate it.

Martin Hinton (00:37)
No, my pleasure. So why why is Jim here today with us? Well we're here to talk about the blizzard of Internet of Things and forgotten endpoints, if you will. Jim,

that's the that's your tease. What does all that mean? What is what is I let's start for the the audience that stumbled across this on YouTube. IoT, Internet of Things. What does that

Jim LaRoe Symphion (00:55)
mean? Well, it's it's a broad class of devices that are connected on the the network. They most folks corporate networks. They're the hallmark is disparate operating systems. Most of them are Linux systems and and this is in the corporate world. And it's really grown up with the the advent of wireless

networking. But it the hallmark is you've got typically a Linux based operating system. They're different, even in the same the same type of device. We're really heavily focused on the the Mount Everest, the most mature Internet of Things device, which is the printer. The the multifunction, the single function, the scanners, the thermal printers, all that, and also the cameras, but it can broad

It can go broaden into like remotely controlled power supplies. You see a lot of those. a lot of other things like medicine pumps in the in hospitals, i and then you know, building controls for climate, things like that. Everything is really it's really a blossomed industry and and category of endpoints.

Martin Hinton (02:05)
So y if you're sitting at your laptop or you're on your iPad sitting in your living room or a

an office or something like that, the Internet of Things is all the other things that are making that work and that allow you to print something or send a document or you know, scan something while sitting there. Th the this sort of mosaic of devices that are electronic connected to the internet, connected to your network, and they're an enormous endpoint vulnerability. Is that sum up properly?

Jim LaRoe Symphion (02:34)
Pretty close, yes sir. Yes.

Martin Hinton (02:37)
So in this landscape, you've touched on it, printers.

and I'll I'll resist some printer joke, the at the expense of Hewlett Packard or anyone else like that. They make up about twenty percent of endpoints on a typical network is one of the things that we we looked at in our research. What makes them a vulnerability or a weak spot in network security for companies or even homes, I suppose.

Jim LaRoe Symphion (03:00)
you're asking me Martin a twenty mile an hour fastball. it's it's it's it's incredible. you know, first of all they're

They're

kind of a they're thought of as a low value endpoint. You know, they are an endpoint, a node on the network, an IP address. they're also mission critical to a lot of workflows, you know, and they're processing the most sensitive data in our businesses, right? And in hospitals, they're processing which we're the most, you know, they're strongest in the IDNs, the hospital systems, but they're processing patient information.

pr personally identifiable information, you know, the stuff that the the hospitals painstakingly try to protect but kind of ignore at the end point. But, you know, or like you get a a doctor, a lawyer's office or an accountant, they're pushing this data, whether it's from scan to to email it, scan to the file or copying it or printing it out or whatever. It's controlled, it it's it's

receiving, transmitting, processing, and storing the most sensitive data out there. So then you marry that with the fact that it's it's not really considered a how do you put it an endpoint like the mainstream endpoints, like your print your your servers in a data center which have many of the same characteristics as the the most advanced printers, or a a desktop or a laptop.

You know, then you've got a a recipe for disaster, especially with the current state of events.

Martin Hinton (04:38)
I mean, you you you say sensitive information. I just want to to to dumb it down from maybe just me. But what we're talking about, if you're at a law firm, your templates for a contract or a tentative draft of a contract or NDAs or riders to contracts that you might need to physically print in order to execute or sign or save a hard copy somewhere,

the information on that paper

exists in that printer in a in a capacity at some point and thus it's vulnerable to be taken when you're dealing with endpoints and printers that are unsecure. Likewise at a hospital if it's a prescription or clinical notes or any other sort of record like that where you have highly sensitive personal information that's also, you know, a legal liability in the making, sitting there, stuff that you, as a l in the case of a lawyer or a doctor, have sworn yourself to protect, yet printers

according to our

Our pre call were was it ninety nine percent unprotected?

Jim LaRoe Symphion (05:36)
Yeah. It's it's what's happened is you know, in intellectual property, all the hidden secrets are are, you know, kind of nonchalantly utilized in the printers, right? I mean, people have to do business. They've been apart, even with electronic digitization, everything, they're still in critical workflows. Okay. So, you know, you get

The

printer it's not just the data risk though Martin, it's the the access that the device allows, the the the unprotected device. It's the the the i you know, the ingress and egress, the the the the the invisibility, not not you know like a like a superhero being invisible, but it's not being visible to normal IT, you know, security measures and practices because it's really

grown up outside of information technology and procured like in the case of hospitals like rubber gloves and syringes and supply chain and they built a management ownership you know strategy around that and it hasn't really leaked into information security and IT like the other endpoints have.

Martin Hinton (06:48)
I mean you're you're basic the phrase endpoint, I think, given what you've just said, is a bit of a misnomer. This

is a doorway into the network of a law firm or a hospital. Like th th that's ha th that the the unprotected endpoint or end a printer is is a door. And if it's unprotected, you can just walk right in. Is is is that too simple a way to think about it?

Jim LaRoe Symphion (07:10)
Hundred percent. But here's here let me let me let me set the table for you, Martin. You said ninety-nine percent. Okay, that's for that's our number that we've seen from investigating and managing hundreds of thousands of printer endpoints for the

the last almost a decade. Okay. And it's it's something that we see prevalently. The manufacturers and just focusing on the printers, they haven't built in configurability for security. They built in advanced features that are capable of hardening and protecting the printer endpoints, but they're not being used when they're put on the network because there has been no

edict on the people that have owned the printers, you know, the supply chain procurement largely to protect them and certainly not at the level you would expect to experience for such a prominent endpoint in 2026 with all the artificial intelligence and you know state sponsored actors out there. it's it's just so it's being put on the network at what we call factory defaults. They shifted devices out at a factory default state, which means the ports and protocols are open. You've got to

Fax a a web server, an email server, an FTP server like Dropbox, you got a fax server all built in and all available. You've got all these ports and protocols for remote control that maybe set on the network where it's phoning home back to its manufacturer for automatic updates, or phoning home to a managed print service provider to give them usage metrics for them to build a customer. It just hasn't been

Govern under the watchful eye of governance or information security like all other IT endpoints have.

Martin Hinton (08:54)
You say default settings. I mean that's like it arrives with password one, two, three is the password. I mean, is that the simplicity of it?

Jim LaRoe Symphion (09:02)
that's the main one. That's that's one of the main ones because it's not just a password, it's the administrator password. And the administrator password for a lot of these printers.

has historic I mean we're talking about forty years of history, okay? They've been around about forty years. They they combine the the copiers and the printers and you know built cameras and sorting and all this other stuff, you know, to make them incredible advanced business machines that are sort of, you know, our number one marketing hook that we send to people send get get traction on is I don't care about printers. I mean that's kind of the

the the you know, the thought of it, it's not thought of as a mainstream endpoint and it's grown into that from that analog device in the corner to something that's, you know, belongs in the data center. You know, we call it the glass house, right? It's the it's the data center where the servers reside. They've got all these systems that constantly scan and and you know, protect those those valuable, you know, whether it's in the cloud or physical or whatever, they're always protecting those

application servers, you know, you've got system administrators, you got all this infrastructure. So you got physical access, you know, locks and doors and things like that and cameras, all this to protect those inputs. Well, the server that sits as a printer, a multifunction or a single function or something like that, that's sitting out in the middle of the hospital. It's got three hundred and sixty degree risk associated with it, including walk-up risks from USB ports and things like that. And

The administrator password likely has not been harden or if it has, it's something that's easily accessible that's you know, by anyone trying to do it. So it's a real real big risk.

Martin Hinton (10:47)
I mean you the way the picture you paint there is one where people look at the the we see the obvious, right? We we put locks on the doors to the building, maybe we add security guards and security cameras, and that all creates a more secure environment. But if we're not addressing the issues that we're discussing now with a printer, it's

like the soft underbelly, right? It's like a secret trapdoor that that you you you just leave open that it's quite easy to find and get inside and then g goodness knows what might happen.

Jim LaRoe Symphion (11:14)
I mean it's it's like I don't know about you, but I lock my door every night, make sure the windows are locked. You know, I I you know, maybe have an alarm system. I wear a seatbelt when I drive in my car. You know, I mean we I haven't had anyone come and smash down my front door, n you know, knock on wood and come into my house, but I've got valuable

valuable, you know, things that are really valuable to me, like my family and my, you know, my household, you know, furniture, all that stuff is in there. It's valuable, so I'm doing what's necessary to protect it. You know, it's not most information security professionals, Martin, what we're talking about, they know what they know this risk lives. They know that it's their the GRC, the governance, risk and compliance, they know it, but it's been owned by

The

supply chain procurement with the dotted line to IT ops. You know, there's a whole industry called managed print service industry that does that is managing the endpoint, especially in large fleets, but it's not protecting the endpoint. You know, and it's certainly not, even if it does like set the settings or harden it at the beginning when they put it on the network, they don't come back to it. Maybe they'll update the firmware, but that leaves them really vulnerable, especially in today's.

environment, you know, where the the AIs are scouring the internet to find vulnerabilities in weak spots. And it and and I can show I can if we're on risk, let me give you a little bit more. Okay. we're doing a series of podcasts with Rapid7. They're they're one of the top pen test in industry leaders out there and and one of the fellows over there who's the head guy he wrote an article on some of the results that they've had and they did

I let me they did he counted a hundred and thirty six assessments that they did of enterprise print fleets and a hundred and twenty of were sitting at factory default. So it's it's it's highly prevalent even today. You know, I mean that's from all the way through last year for like two or three years before that. And it's it's something we see on every account. It gets even bigger than that, man. It's go ahead, ask your

Martin Hinton (13:25)
No, no, I was gonna say you you you those numbers sort of portray

Jim LaRoe Symphion (13:30)
It's a hundred and thirty-six penetration tests of a place that might have a thousand printers, right?

or some of our fleets are over thirty thousand printers, Martin. You know, so you know it's not unheard of. It's it's it's amazing. We go into an account and I'm I'm gonna come back to risk in just a second, but we go into an account and the customers don't have an a valid inventory of the the printers. It's not like you go in the pantry and you're gonna count the cans.

It's a it's a dynamic state endpoint. It's constantly being swapped with spares and added end of life, beginning of life devices. It's a it's a nightmare and and a real big opportunity for the bad guys. Here's the big risk, man. Okay, the big risk is like, man, well, you know, we think the blast radius is not that big on a printer, right? They're just gonna steal the data or something. Well, the printer, and this is the reason I brought up the Rapid7.

One of the the lead authors over there has written about this and we've talked about it and others like how I met your printer is a speech that's out there from the LMG Security guys out in Montana. You know, they're professional hackers, they're ethical hackers, the red team to test the protections, right? They all know that the printer endpoint is like, you know, the throw down thirty-eight that the cops used to have out of the handkerchief, right? They'd pull that

That

38, well, we know he did this, right? You know, well, they they can hide in the printer though. They can they can exploit the printer, have it pass back credentials that the printer would normally access, like the credential system of the business. The printer, when you log into the printer to use it, whether through an application or directly into the user interface, it has to to say that it's you, right? It has to know.

that that's you, whether it's with the badge or whatever it is you're doing, it has to access the credential system of the business. And it's trusted access. Well it it it may be unencrypted. It may be stored at an administrator level. So if and it looks like normal communication. So when someone exploits the printer, they can look at you know attack these these corporate systems and it looks like normal traffic to the

network sniffing and things like that that's going on for security. Same thing with the email system. You scanned something to email it to somebody from a printer before I'm sure. Or scanned it to file it to the file server system. Those systems are ancillary systems that the printer enjoys, you know, administrator access lots of times to. So it's a it's a big deal to you know, we say one printer can take down a whole company. And it's absolutely true. You know, I mean it's it's a

The blast radius is is is wide. Well,

Martin Hinton (16:23)
I mean y again, you you you you touch on things you you can't know what to protect if you don't know what you have. you have to have the attitude that every single device like th this that's left unsecure is a is a way into your, if you will, to use your analogy, your home, where the things you value are kept. What what is it what does an attack look like? I mean, give me the the walk me through how an attack starts

on a printer. What what unfolds?

Jim LaRoe Symphion (16:46)
like what we talked about. I'm not a hacker, Martin. I'm I'm on the red blue team. I'm on the protect team. I'm the one locking the doors. Okay. We're the one doing continuous cybersecurity operations for the endpoint with the program. Okay. So it's it's adapted and and protected. But you know, like what I told you about, the pass back attack where they they some the the printers oftentimes are set to phone home to their manufacturers off network, you know.

They're set to be exceptions to the access control network settings. They're set to have you know the capability to be exploited and then access these other systems of the company to steal not only, you know, to to insert, you know, in check malware or ransomware, that sort of thing, to use that as a a place where they hide to, you know,

otherwise exploit things about that that business, you know, they could steal the data, you know, so the companies are exposed to not only, you know, the outage, the risk of of the outage, but the the all the costs that go along with that. So it's it's just it's a myriad of different hacks. They're published out there. And you know what? The big deal right now in 2026 is artificial intelligence knows all those. Okay. You've got you've heard of

common

vulnerability exposures that that a lot of manufacturers publish well they there are a lot of those that are published out there in in the you know the national vulnerability database the printer manufacturers don't do that many you know it's not as thorough as some of the other manufacturers do but those those are all published hacks. I mean those are published hacks and if you're not on it you know and they're not on it because they they don't even have the inventory piece of it in most cases

You know, you you're you're really vulnerable to the nanosecond type exploitation of it, you know, and it's not you've got you've got everybody and their dog trying to attack you right now, where you've got state sponsored actors, you've got agentic AI that's operating for the bad guys, you got all these ransomware entities, you know, it's a it's a business now of crime. And we're sitting here with twenty percent of our endpoints and and unprotected.

You know, we say unprotected too because sitting it and looking at it every year is not the same. Okay. It's not the same as continuous protection. And that's what's required in this instance because you've got the factory default, you know, habits. You know, in in in security, Martin, one of the things we we preach is don't click on the email, right? You know, hey, I don't know where that came from. I I I got this DocuSign deal, and it's like hey

I should click on you it looks real attractive to click on it and all of a sudden bam you got you know a virus on your, you know, or some kind of ransomware or something like that. Well, in the print industry, that human behavior is reset to factory after you service the device. The technicians have been trained to clear it all out, reset it back to factory after they service a device. I'm not saying they all do that.

But it's something that's been ingrained in behavior for a long time. And if you're not looking at that, or you put a different device on that doesn't have the controls on it, or may not be updated on the firmware, or may not have a valid certificate on it, and nobody's looking, but once a year, you've had you have a flawed system that will never detect the changes that are rampant in that. The changes in the network, the business, all that stuff.

Martin Hinton (20:32)
I I y that's a that's a good point because I think that the presumption might be a lot of people just don't know you need to do this. But the idea that during a service like you described you could reset, it's one of the reasons these factory default passwords survive, right? They they they come back, right? They're like they rise from the dead, if you will. I in and and not unlike all other parts of cybersecurity, particularly to your point about AI, the need for persistent, you know, three hundred and sixty degree twenty-four-seven, whatever you want to call it.

awareness about this and how Yeah, exactly. Like this is this is a security in this sense in this world is perishable. And if you're not maintaining it, then you are l losing the the your level of security. You

Jim LaRoe Symphion (21:17)
that,

man. Security is perishable. It that is exactly what it is, Martin. Is it it you know, you can't just like okay, let's take it let's take the building analogy again, right? People gotta go in and out of the front door of the building.

But they may have the the the scanners, you know, you gotta walk through them, or they may have the stuff you gotta run your your bag through or something like that. They know that people have to come around and do that. They've got people manning that, they're constantly looking at that at night, they lock it up maybe, or they've got some sort of controls on it. It's the same thing with anything you're trying to protect. You know, you you have to maintain the controls or you've got a huge risk there. And it it's, you know.

This is no exception. You know, let me tell you why this is the case. Okay. The the the the the reason that this is the case is is because of the ownership of the endpoint and it's focused on cost elimination. Okay. The whole print industry, you know, the printers and manufacturers, they make printers and they've been competing by jamming all these incredible features.

on the printer so they're more like a a multi-server device that belongs in the data center, right? And then the managed print service industry, they're selling cost elimination and delivery of the print service. Okay. Security is not a cost elimination. Okay. It can be in certain aspects like where they're doing the the scan to make sure that their output, you know, where it prints out is sitting on the tray when only when they're there and not somebody else that allows them to

reduce the number of printers. Okay. So they just had the one in the hall or something like that. Or they've got other aspects of, you know, adjacent security. But the device security has not been done. And it's not been monitored or maintained. And they we've seen it in a couple of different ways. We've seen, you know, I may be getting ahead of myself here. You got probably a question. I'm I'll suck all the oxygen out of there here if you let me, man.

Martin Hinton (23:25)
No, no, no. Just to drill it down, is that the reason this problem persists is politics and budget, personality and money. Right? And and you know, who owns the printer fleet of the company or the CISO just views adding another layer to their print management cost as a, you know, the that brings security. What do you mean that should be secure?

Y y the there's

not unlike a lot of tech, we've stacked, you know, it all w it it was all started with efficiency, speed, economy. security was the you know, the lagging indicator of the the health of the business. And we're now at a moment where it's like, wait a second, we've got all of this technology, specifically in the Internet of Things world and more specifically in this conversation, printers, that we've realized we haven't really been taken care of. So the analogy I may have used when we did our pre c pre interview call was that

It's a bit like when you get to middle age and you got that physical with the doctor and they they

give you that serious chat about your blood pressure and your diet and you know, you you how well are you sleeping, you can't live like you're 22 anymore. We're we're we're middle-aged in some respects, tech wise, with regards to security, and and we're paying a big price for not being more secure. In this space, politics and budget seem to be a big factor. Tell me a little more about that.

Jim LaRoe Symphion (24:44)
absolutely. So we're we we come in so customers I I can just tell you from our experience and we talked to

hundreds of of leaders across the United States. Okay, so we're we're coming into an account and it you know lots of times the customers can be problem unaware, you know, like they're we don't know about the risk, and that's usually not the case. Okay, that in a in a larger enterprise, that's usually not they know they've got the issue. Prioritizing it is another another deal. But like your information security department, your GRC people

They know they have the risk, they've got to account for it. Maybe they're blowing it off. Maybe they're they've got something in there. They believe it may be managed by the guys that bought it or the managed print service that they roll the those companies over every five years hoping to get a better deal, you know, for that. So it's it's managed by somebody, but it's not protected. And they don't have any way really to go and investigate the governance of the endpoint. I've seen do we've seen do two things really, Martin. That the

the maneuvers that they've seen. We've seen them scan the printers. You know, they're already scanning the endpoints for vulnerabilities with the pen test software to p to turn those on some of the printers and say, look, and then tell IT, look, you got to fit this in your budget. You need to put get rid of these endpoints. Okay. the these these risks and these these IoT endpoints, you may not understand it.

You know, they they find us, okay. They find us one way or the other. The IT group does a lot of artificial intelligence will recommend us and and then, you know, we'll work with them to set up the complete program to protect that endpoint, keep it protected with the controls that they want and live with them for like three years and then renew and all that. So that's one mechanism. Another thing we see them try to do is to put requirements in that five year RFP that falls on the the print industry.

the endpoint, you know, the the managed print service industry for buying the devices or or or you know the the carry and feeding, the uptime, the break-fix, the supplies, all that stuff that that whole industry is built around. And it's not just independents, it's the OEMs that have it too. So those guys, you know, they're protecting turf a lot of times in the organization. So they're, you know, they get an RFP requirement, but it's lip service basically to secure there's no, you know, put

you know, to be a valid program, you've got it you've got to implement the controls, prove that you've implemented the controls, monitor the controls for change, set them back, and then be able to prove it in a in a risk register or in a board report or something like that. Now so the stakes have gotten so much higher, but that's what we're seeing. What we're seeing also, it's the first time there's been a budget for that. They try to cram it down the managed print service.

There's never been a budget for that. They're just trying to make do it for free and it's getting in the way of what they're doing, you know, 'cause they're they they've been operating at factory default to save money, have an economy of scale, actually eliminate that cost for the customer. And now it's like, what do you mean I gotta do this too? You know, so we're partners with most of the industry as the resellers too, to catch it from that side too.

Martin Hinton (28:02)
I in in the mosaic of all this, there's

in the cyber insurance world, pivoting to that, there's a there's an underwriting gap, right? Cyber insurance applications ask about MFA, EDR on endpoints. Does anyone say asks specifically about printers?

Jim LaRoe Symphion (28:18)
We had not seen it in and that's that's a that's a big deal. Okay. So your your your information security group is your

They're your influencers, right? They're the ones that set policy for the organization. And it may be truncated to an IT director who's got that hat, right? In a smaller company. Or it may be somebody else, the IT guy, right? So they know that they they've got to they've got to do something about that.

So your insurance, especially cyber security insurance, is a nascent industry.

Right, it's beginning right now. And it's it's got just it's a private contract that's governed by the the history and the law that's out there on it. But it's what the insurance company and the insured agree to, right? You know, they underwrite the insurance companies underwrite based upon what they believe is their traditional risk associated with that. But then there's underwriting after the claim too, lots of times. So, you know, we see this, and the reason I was headed that with the CISO is

And then in that group is because a lot of them in the back of their mind they're like, hey man, we got insurance for this. You know, it's it's why protect, you know, why protect the the endpoint and go around about that and maybe get myself caught into something that I wasn't expecting to get caught into, you know, caught up in, you know, when we have insurance. And the insurance is something that that we can, you know, rely on well, not necessarily, but w to answer your question directly,

We have not seen them ask about IoT or printers, you know, and in and where that comes into play is that, you know, printers have or insurance policies have their coverage representations, right? What we're gonna cover this claim, this occurrence, maybe we have all these exclusions like state sponsored actors or agentic AI or something, you know, all that cottage industry stuff that they're selling the premium, you know, they're

They're getting paid premiums to insure. And then, you know, maybe you didn't get that at coverage that you thought you did. So it's like they're I believe they're moving towards that more granular, more granularity and underwriting. We have not seen it, but we're not dialed into the exact underwriting for every everybody out there. We've got some relationships with the the brokers, but we haven't really investigated that. That's one place we're gonna go to next. But then

In and one of the things I wanted to talk to you about was the O and D liability, right? I mean, officer and directors, they're the fiduciaries of the business. And and if they're not I mean, you see now where they have a board member who is who is a cybersecurity board member on a lot of businesses, you've got the one six attesta item one hundred six attestations from an annual risk, you know, standpoint and the officers have to sign off on things.

We don't have the GDPR here in the United States, but we certainly have a lot of risk associated with, you know, leaving out twenty percent of your endpoints from any sort of protection. So I believe it's moving in the right direction. I to answer a question, I don't know yet, you know, I know that it a lot of people write about it and and author, you know, the underwriting after the claim activities, you know, where it's like you have an event.

You know, you call your broker and it's like, it's state sponsored actor, maybe we're not gonna cover that. Or they investigate what your setup was and what you represented in your underwriting and maybe use that to deny the claim. I'm not vilifying the insurance companies at all. I'm just saying it's it's you know, I'm agreeing to take your premium to do a certain thing for you if I'm an insurance company and maybe you need to have your, you know, have it straight that your representations are accurate.

You know, and I I I don't know that they're getting to the granularity of printers and IoT endpoints.

Martin Hinton (32:21)
No, well, I mean, well, so you it's funny. We just put up a podcast today and it was with a chief marketing officer about the amount of data they have and that that is often some of the most sensitive PII, right? And it isn't thought of that way because it sits out of IT and it's you know it's you it's supposed to be fluid and that it gets used in all these different platforms in order to market

the company and that kind of thing. And not unlike perhaps these IoT devices.

it it's not traditionally thought of as a place of vulnerability or, you know, risk, if you will. You you you touched on the the underwriting part of this. You know, if you could give an underwriter a s a few questions to ask to help someone be insured properly, to make them aware that what, you know what, I don't know the answer about our endpoints with regard to our printers.

Tell me about that. What what what what should underwriters be asking if they want to make sure that this is something that doesn't become an issue when a claim comes along?

Jim LaRoe Symphion (33:17)
Well, you know, that's up to them, but I would say I would say, you know, some basic questions we ask, you know, to we do we do 30 to 45 minute one on one assessments. Okay. We're finding out what what someone's done, what are they currently doing to protect this endpoint class? Okay.

You

know, how do they ha is how how are how often is it refreshed? How are they proving that it's being done? You know, and how often are they investigating that to see whether it's being done? You know, I mean those are the kind of things like, you know, you could get granular on it too. Like we build in components of the system for configuration items like closed unused ports and protocols, harden the passwords.

The admin passwords rotate them every 90 days, keep the certificates valid and applied properly, keep the firmware, you know, at least an N minus one state on the device. You know, all these sort of things that that really you know affect the risk associated. Follow the device through its life cycle. I mean, ITS at life cycle management, because you know, one of the big things out there is I don't know what, like you said, if I don't know what I have, how can I protect it, right? So

And then you get to the the the the end of life of the devices, okay. So what we come on, and this comes into some of the things that we see, man. We see we got on an account, they may have 25-year-old printers. Okay, support ended five years after the model was introduced. That was 20 years ago, okay, or 30 years ago. They still work, you know, but they don't have any of the protections that that would be addressed in a firmware update.

You know, they y we see that all the time, especially where they bought the device, you know, rather than leasing it or something like that. So we've got all this, you know, all those sort of things that we could easily give them, you know, but basically is, you know, what's your plan? How d how do you know it's working and how do you prove it? You know, those are the kind of things around those big swim lanes that I would ask about the endpoint, you know.

Martin Hinton (35:26)
Yeah. I mean

it's it's it's becoming increasingly the norm, right? The instead of a checklist and a checkbox sort of, you know, annualized questionnaire that a insurer might provide, they want some sort of verifiable proof. And and even in some cases, constantly verifiable proof. And and we we see that product out there in in the marketplace becoming more and more popular because it provides the data that is so lacking in the underwriting of this space. You you you you you touched on already, and I just want to come back to it.

the healthcare environment.

Right? We we we think we don't print anymore and nobody prints more th I mean, the amount of printing that goes on at a a a at a hospital or a medical facility is kinda hard to comprehend given that we think we're all digital and we've gone to medical, electronic medical records and that sort of thing. Just if y take a second to dismiss the myth that that that printers are something that aren't really involved anymore.

Jim LaRoe Symphion (36:19)
Mission critical to workflow. Okay. Affects your re revenue, your operating expense, your regulatory, your data.

All the third party risk, everything if you get an outage from the printers. Okay, think about it. So so let's say Jim went in for a scan, okay? Just a scan, right? So Jim filled out all this stuff on the internet before he got there. They checked the insurance, copies of the driver's license, copy of the insurance card, all this stuff. Jim gets there and he's gotta go to a bin and sign wet signatures on all these consents that they turn around, you know.

and scan into the the the deal they've got to get wristbands that are printed that anything specimen wise has to have labels on it. Any medicine that's provided has to have, you know, labels from the pharmacy. The emergency room is doing the same thing. You can't admit or discharge patients without giving them, you know, they take wet signature with with without giving them the the the discharge papers. It's absolutely mission critical right now. I mean I go in

And and I you know, I look at at a just a radiology department, okay, or a re a scan a diagnostic center, okay. And they've got like f four or five people there, they've got like ten to twelve scanners, huge multifunction in the back, multiple single function printers, and that's just at the front, you know. So it's it's highly prevalent. And if they go down, they can't process the patient care. They can't process health care, you know.

So American

Martin Hinton (37:56)
Yeah.

Jim LaRoe Symphion (37:56)
Hospital Association's talking about, you know, security is patient care. You know, I mean they make the jump to, you know, some of the pundits over there are talking about that's the really, you know, the if we have discontinued health care, you know, that's pa patients at risk. You know, so it's I think it's one of the more prevalent, you know. Let me tell you a story, Martin. Let me tell you a quick story. Okay. So when we first launched this this

program in August of 2018. We did a webinar. We had the former head of the Office for Civil Rights the on there. They're the enforcement arm for the Health and Human Services Department. And she did it, she we're I was like, you know, her name is Iliana Peters and she's a lawyer up in in DC. And I I said, hey Iliana, what's the what's the the HIPAA viol? Man, we see so many HIPAA violations from not protecting the printer and

point.

She said the main one is the risk analysis. You know, you have to do a comprehensive risk analysis. But the truth of the matter is it was falling on deaf ears with the customers because they know they're not going to get caught. You know, and then when they do get caught, they give them so many times that it doesn't move them to do this. Now that you're all that forward eight years, you know, you're getting your business shut down, you know, you're you're you can't process patient care.

You know, the stakes are so much higher now that and and then the risk is so much greater too, you know, to the business from many angles.

Martin Hinton (39:29)
I mean you you you you you touch on a couple of the the very real things that that it's important to understand. Hospitals can't stop. So if they get ransomware and their data's unavailable to them and their surgeries need to happen, they're not in a position to stop. The other thing in the very simple way the you know, someone listening this might be think, Do they really print a lot?

I asked you the last time you left the hospital after any kind of thing or a doctor's appointment, there's a very, very good chance you had wads of paper in your hand. Right? All of that had to be printed. It didn't just

It didn't just appear out of magic and it' out of thin air rather part of me. So I you know, again, like it's it it is when you th you see the MRI image and you think of the you know, all the little carts with computers on them and the everything's electronic and that sort of thing. There is this amazing reliance still on the physical copy.

And it it's it's it's i it gets overlooked. You you you touched on the D&O liability and that sort of thing. One of the things that we hadn't w had

our notes and prep for this was that a lot of companies don't disclose the root cause of a breach. And it may seem obvious, but wh why is that? Why why wouldn't they?

Jim LaRoe Symphion (40:37)
the lawyers, man. I mean it's it's you know, well lawyers will find

If there's insurance to cover it, if there's liability or maybe a class or you know, the you know, a mass situation, they're all over it. So, you know, it's like, hey, I'm gonna and in the SEC and I'm I'm I haven't studied it all, but the SEC has some more recent, you know, refinements of of deadlines to disclose, you know. So it's but the actual root cause

They're not coming out in the press and talking about, man, we forgot to do this or something like 'cause that's like, you know, leading with your chin in the prize fight or something, right? You're not gonna do that. You're you're you're you're gonna say we're still investigating, we haven't determined it unless they're trying to blame a vendor. And then they'll put it out there. You know, I mean it's like

Martin Hinton (41:25)
Yeah, yeah.

Jim LaRoe Symphion (41:27)
you know, the days of early days like ten years ago, the target hack with the HVACs vendor, you know, I mean, you've got all these sort of things that

You know, it it's it's just commonplace now. You know, I I I believe that it's something that that is accelerating too. It's not leveled off and certainly not decelerating. So, you know, the stakes have become much higher.

Martin Hinton (41:49)
I mean you y y th they certainly have and you you you touch on I think that w the closest we get to the root cause is sophisticated impersonation or you know agentic AI or something like that. That they blame some very, very

reactive boogeyman, right? So that th we we see it. All of this silence creates a real problem when it comes to a making people appreciate why it's important that they're secure in their own behaviour.

But also it makes it really hard for underwriters to properly assess risk because they don't have it's not like weather, right? We all know that storm you're not hiding the weather in California, right? That's there for everyone to know. And historically there as well. Tell me about the insurance side of this and the implications of of this silence for

sort of prolonging the problem. You know, it's a it's almost like classic human scenario where where the only thing that happens as a result of us delaying difficult conversations

is the increase in the amount of regret we'll have when we finally do have the conversation and realize it wasn't that bad. You know, t t tell me about that, the blindness that exists here.

Jim LaRoe Symphion (42:55)
blindness to the endpoint or blindness to the risk or blindness

to what? Well

Martin Hinton (42:58)
Well those well,

I guess the blindness to all of it and how it impacts the ability for you know, an underwriter in the cyber insurance space to to properly assess risk and and for brokers to help help organizations and companies get the right coverage and the right policy.

Jim LaRoe Symphion (43:14)
Well, I I tell you, man, let me s any of your audience in the insurance industry wants the right want some underwriting questions about this endpoint class, they can call me, I'll write for Okay. I mean it's it's

There will be no hiding, I promise. We'll have a little deposition in the underwriting questions. You know, three or four succinctly placed. But, you know, they still, you know, the representations go to coverage, right? I mean, it's something that you've got to have accurate in your company if you're gonna represent that, or you're not gonna have any coverage, you know. So the underwriting has to make them represent, you know, the safety of the endpoint. It's something that, you know, they can choose.

to protect it however they want, there's certain things that you're gonna look at as a as an insurer to make a decision about whether I want to get, you know, collect the premium and assume that risk. You know, I mean I don't know if I wanna be on that risk if if if they're doing X, Y, or Z or they don't have an answer for that and then make them represent it. So, you know, they have that as a as an out on the deal. it's you know, it's just maturing. You know, it's maybe

Maybe our talk here today will help influence some of that. you know, awareness is the key. It's it's you know, but it's something that in in in defense of of businesses, right? You know, they have to prioritize what they spend their money on. And in especially in information security, everything is a competing priority, right? You know, one of the things we've done, we've designed our program where there's no lift for the customer. It's done for you. Okay. It's

adapt it to their IT ecosystem with the program management office that we house and and staff and and work with all the stakeholders and we deliver it seamlessly to them. You know, they can have whatever printers or whatever managed print service or whatever controls or business change, whatever they want to do, we we absorb all that complexity for them, you know. So that's something that, you know, the the that they should look at, those kind of business

you know, controls that we have, you know, where we're monitoring the endpoints a couple of times a day, remediating it back, changing the passwords, those kind of things that you would expect that NIST NIST proposes, DISA STIG, all the the standards include those in the management of of IT endpoints. And there's something that that they could center on in their underwriting, you know, to say, hey, you know, what

are you doing here? Get into the ground. I'm not gonna tell you what it's like manners, means, and methods in a construction contract, right? I'm not gonna tell you how to build it, that I'm gonna tell you what it better look like when it's being built and what it and when it's done, it better not fall down, right? So, you know, falling

Martin Hinton (46:01)
Yeah, yeah, yeah.

Jim LaRoe Symphion (46:02)
down here would be, you know, increasing the risk of of a cyber event, you know, that I gotta pay all this money for and the long tail that that you know involves. So well

Martin Hinton (46:13)
Well you you you you you touch on the long tail and you you brought you

brought d D and O liability up earlier. We discussed just a moment ago about why companies don't report and and well, why would you wh unless you're absolutely required to by law is a short answer to that. The the the long tail of this is one where the the ability for a class to come along and data to pop up later. I mean, I'm I'm I'm thinking a little beyond the conversation we we had planned, but even this the theft of encrypted data should it become

decrypted

as a function of quantum computing advances in in the n that a lot of people suspect are coming in the near future. There's a real long tail di liability for a director or an you know, a a member of a board who is not involved in the minutiae in the detail of how everything happens every day to your point just now. But their liability is no joke. I mean, is is is that it there's a there's a real you you may not see the danger, but it's right there in the shadows.

Jim LaRoe Symphion (47:12)
we

We do Martin, that's great question. Sit or great observation. One of the things that we look at in in in customer like s say for a board member, we have white papers where we've done a five factor analysis of what it costs not to protect this endpoint. Okay. Any just a modest, you know, sensitivity applied outage from you know not having a certificate or a min minor incident. We've done it for hospital systems.

And for multi-site retailer manufacturer, you know, where a distribution center might depend on printers and things like that. And we looked at it from five factors, okay? So this is your long tail revenue at risk. What is my revenue at risk from the outage? I mean, that can be profound. And we talked about mission critical usage of the printers, you know, even in a departmental level outage, you know, or let alone a ransomware event or something like that. You've got

operational cost increase to figure it out, find out what happened to address it, to work around it. It's enormous. You've got regulatory fines and and and risk. You know, you've got your your data costs because if the data's gone, what you're talking about, it's not encrypted or or it's it's ripped off and sold, you know, you've got to watch people's credit, you know, all this other stuff associated with the cost per record. Okay. Not just

Hey man, we got hacked and they stole all this data, you know, for that's stored for fifteen years on this printer or 10 of these printers or something like that. We don't know what it was, or you know, it it's it it's it's you gotta watch all the pe if I and then the the class comes out of that too, lots of times, right? The class action, that that sort of deal. Then you've got the third party risk where you've got

You've got the lawyers, the the you know, all this other stuff that comes into it, man. It's and then on top of that, you've got the goodwill, the reputation of the business, the cost of that, this kind of shadow expense of the incident. And then you're gonna sit there and tell me that you can't spend the money to protect this endpoint with a complete program. I mean it's it's it's it's you know more than ten X. I mean, just at a modest

level.

Martin Hinton (49:32)
You know, you

you the the just to just to to touch on that last bit of what you said, the reputational damage, which is a bit like fog, right? You c you can't count it's not money you can count. But you look at historically, there've been some stories like in the nineteen eighties, the Audi car manufacturer had a situation where for reasons nobody could explain, there were all these reports of their cars suddenly accelerating without and the driver would claim, I n I didn't have my foot on the gas, you know, I don't know what happened and I

As my memory goes now, I can't r I don't

think they ever discovered why. But this ongoing problem, this idea that they were they were involved in something that made people unsure about their product, is something that took years and years to deal with. We hear all increasingly as as individuals, we hear about data and social media and privacy rights and what you know, your T V listening to you and the you know, Meta just paid billions of dollars in I think is it Arizona?

for a data privacy thing,

that is the kind of thing that they can write that check. But the cost of overcoming the taste that leaves in the public's mouth is one that is really hard to to I don't know, bean count, which is probably one of the reasons it gets overlooked and set aside, 'cause well we can't count it, right? Yeah.

Jim LaRoe Symphion (50:50)
it's you know, it's like you're not protecting me. You know, you're supposed to be protecting me. I'm your customer, right? I don't want to be part of a class action. I want to be protected.

You know, especially when it comes to like healthcare and all that. I mean, it's like, you know, I don't want it you to have an event while I'm sitting on the operating table or something like that. You know, I mean I I don't want to wait and have to sit around waiting on you to process my data. You know, I mean it it's it's it's it's it's we're I still it you know, the insurance associated with that, the protection, it's all still

I me we're we're in twenty twenty six, I've said this on other podcasts and articles, is you know, we're we're exponentially accelerating right now. I mean, I think you brought up the the Jaguar hack, you know, I mean the Jaguar Land Rover, wasn't it you that brought that up? Yeah, I mean, I mean it's Yeah, we when we first met,

yeah. Yeah, you talked about that or the Stryker event worldwide. I mean it's it's it's you know, we have a cybercrime exposure now.

I mean it's I mean, you know, warfare is cyber crime, you know, so it's it's

Martin Hinton (52:04)
Completely agree. And the the the fact of the matter is it sounds sometimes insurmountable, but there used to be a massive piracy problem on the seas. And countries got together and sorted that out. Arson used to be a huge problem. Now it still exists, but investigators and laws and leaders got together and they

dealt with the problem to the point where it became not a huge drain. You know, the the Jaguar Land Rover hack's a great example.

If that had been a malicious event that was physical, as in someone had blown up a factory, it would have been the subject of news coverage and parliamentary inquiries and documentaries about the rebuilding of the next great SCAR assembly line. The headline J Jaguars got now is that they just laid off four thousand people, right? And these are the sorts of things that that you know,

your death by a thousand cuts any organization, right? All these things you don't manage. I and in that context, I wonder whether you could tell me if I'm a CISO.

What am I doing between now and the end of the year and this quarter? What's something I I have to I have to set into motion or start asking about?

Jim LaRoe Symphion (53:11)
about the endpoint? Our endpoint, yeah. I mean

Martin Hinton (53:13)
Yeah, about the endpoints. Yeah.

Jim LaRoe Symphion (53:15)
they can look they could call me, Martin, they can get me on LinkedIn or go to Symphion dot com. We'll brief and and give everything they need to know about what they're doing now. It's

It's

an executive briefing. I do most of them personally, you know, and it's like, look, we'll do we'll we'll listen to what you've tried or what you're doing, help you understand what your level of protection is, what you and then and then tell you what the other folks in your industry are doing because we see it, you know, we just Symphion, maybe you're already you're good enough for you. Okay. You're assuming risk whether you like it or not, right now. And taking no action is assuming a lot of risk. And you may not be aware of that, but

You're you're doing something right now by not acting. Okay. So we're we'll look at your systems, what you're doing now, and maybe nothing or have no visibility, or we'll empower you with the questions to ask to find out and stay with you through the analysis of what you're doing. We'll look at, you know, we'll tell you what others are doing, and then we'll give you the options that we see for you to fit you. Okay. So each one of these deals, a the IT, we call it the IT ecosystem, right? Everybody's got

their own IT ecosystem. It's like we're all humans, but we have different ethnicities, different, you know, orientations, different pocketbooks, you know, we have different finances, different process, all that. We're gonna hear about your IT ecosystem. And the big the big deal with us is we're gonna fit this program. If you choose us, we're fitting a a managed program into your IT ecosystem. Like for instance, we come into some of these accounts, I mean

Most of the accounts they don't have an accurate inventory. They don't know what they have. They're not keeping it up to date. We do that by it's an hourly evergreen inventory, so we call. We don't you know they don't have any way to make any decisioning platform over the endpoint. They don't know what they don't know. You know, in in you know, they don't know what they should know and they don't need to know. We had one we did in May, we did eight thousand printers in a month. Okay. And they told us it took them

a pretty good while to pull the trigger with us. And, you know, they told us, you know, Jim, hey, when you're talking to us about this this s program that you guys have, you told us we didn't need to know anything about printers. And you're right. We didn't need to know anything about printers. So what that does, Martin, is it takes the the governance, the the the proof, the the visibility and puts the the result of that in the hands of the people that

own the the own the risk in the information security but it places the the ownership of the Symphion program in our case if they choose that option in the IT department with the other endpoints you know so and they don't have to allocate people they don't have otherwise they would have to like take each manufacturer's software because each manufacturer has a different operating system like we talked at the top of the hour, right? They have a software that'll manage their device

but only their device and it's a straddle and it's not a programmatic approach. So it's like they have to cobble it all together and come up with something on their own and staff it. It's just not a viable solution. They can we can give them the questions to ask to, you know, set policy without getting the ownership of the endpoint. You know what I mean? That it fits

Martin Hinton (56:40)
Yeah.

Jim LaRoe Symphion (56:41)
within the politics of their system. Lots of them they don't have any change control on the devices. So they change the device

And they don't know what it does. I'll tell you a story about us, okay. It Symphion 2004, I was over started with a company called Pier 1 Imports. You ever heard those guys? They they used to

Martin Hinton (57:02)
I have.

Jim LaRoe Symphion (57:03)
make rattan furniture, okay, over in and they're in Fort Worth here, you know, Dallas, Fort Worth. They're it's it's like 45 miles apart, okay. But it's it's you know, it's one big metro place. Well I was over here, I was talking to the CIO.

And he said, Jim, you know, what you're trying to sell me is great. You know, we were doing huge enterprise systems, integrating those together. And he said, What you're telling me is great, but what I really need is something that puts everybody on the same page. And what he was describing, because they had they had somebody take blindly take down a database server two weeks before Christmas on a Saturday to maintenance it and it had taken down credit card processing worldwide.

So, you know, for like hours. They didn't know the interdependency. So what he was describing to us was, you know, we need a configuration management database, which you've seen that is very prevalent now. So we built a configuration, we own all the IP rights, we get we sold it to them. And and they we built agentless scanning. So we've been and when we put it out to our big customers as a managed service, we've been doing this for you know twenty something years, man. And it it it it's that knowledge.

that ability to see when something's changed it and the inner interdependency of it applies to the printers now. You know, it's got to be deliberate. You need to have deliberate actions to avoid outages and things like that. So our program also addresses, you know, one of the things is man, I don't want to touch that because then I'll own it and I'm putting security on the endpoint. And it's like, man, I don't want to have that outage because it's tricky. You know, a lot of the the firmware

Files from the manufacturer say don't update the firmware or you might break it the device or something like that. So we put in all these measures to test and roll out and and and prove up the you know the the effects of the, you know, the change, the endpoints, because somebody might be using it or something like that, like SNMP v2 to v3, you know, it might make it where they can't print. We we copiously protect against that. So the customer doesn't

have to worry about disruption. We take we do backups and recovery and all that. You know, so the mission critical endpoint of the printer, like we talked about in these workflows, is not affected by putting the security in. You're not, you're not going to get that, you know, with just some people operating some manufacturer software. So, you know, that's what I would tell them. It's like something, come meet with us, we'll share that with you. We'll talk about your specific situation. We'll empower you to go investigate more or to to to own

the

risk, you know, in your register and be have a proof, you know, point where you know that it's been protected, whether you choose us or not. There's other measures to do that are lesser than us, you know, that you're you're assuming certain risks, but you need to identify those risks that we're going to assume that as a company. You know what I mean? So it's like, yeah, I know the risk of leaving my front door open, you know, or not wearing a seat belt 'cause I've seen what can happen and but man, I just I don't feel like doing it, you know, or something like that. So

Same thing, you know.

Martin Hinton (1:00:08)
Yeah. So Jim, we've been talking about an hour. and I don't have any more questions. Is there anything we didn't get to or anything else you'd like to say some more about?

Jim LaRoe Symphion (1:00:17)
you know, Martin, it's been great talking to you. You've been very thorough. we talked about most of the stuff. I mean, it's it's really you know, we'd like to talk to the people, really. You know, I mean if a customer is you know, it's not a pressure situation. We're here to help. You know, we're evangelizing. We spent

We spent the last year and a half eventually we we went to market with reseller partners in the print industry, the the OEM, you know, the printer OEMs, household names, the the managed print service, and they're they're they're doing what they do, you know, and security may not be at the forefront of what they're trying to sell or trying to talk to customers about until they need to, you know. We've we've seen

Martin Hinton (1:00:57)
Yeah, yeah.

Jim LaRoe Symphion (1:00:58)
everything. We've seen customers hack through printers, we've seen, you know, all sorts of, you know

nefarious acts through the printers that we come in. And we've seen ones that just want to protect, you know. So that w but everybody's different. We do the briefings all the time. They could contact us anyway. We'll we'll get on with them. And it's really effortless for us. And then that gives them at least an idea of where they stand. We do full assessments too. We can do those if we need to, you know, a lot of it's processed like what we were talking about change control or the IMACD process of

identifying when you get a new one and putting everybody on the same page or, you know, and this really hits hardest. I'm glad you asked me that question because I didn't talk about this really hits hardest. The best countermeasures that you have against artificial intelligence is is is zero trust principles, you know, where you you establish not the perimeter security only, but you establish you establish a machine identity of the device with valid certificates.

And and you know, the valid certificate is something that's shrinking in its lifespan. You know, to to apply it, you know, there's a bunch of solutions out there that do certificate lifecycle management, but the printer endpoint is where they stall on that last mile. So you've got to get the firmware updated to make sure it's capable, to bring up the latest features, find out where it should be applied on the device, how they're using the device, and then the the it has to be the

The record has to be created, the sea the the certificate has to be issued by the certificate authority, applied to the device, validated, you know, all that has to be tested, it has to be done when device is not being used, all that stuff. We have a closed loop program for that. That's that's the latest and greatest Symphion that's part of our program. You know, and it and it, you know, when they're the the s the security life the certificate lifespans are going down to forty seven days validity.

So it's something all the customers are asking us about. And then also the the Microsoft driverless printing is coming down too in the next few years. it really they're trying to inch everybody into it and use IPP access to direct from the printer, from the computers to the devices to print and those have to be protected by the certificates too. We have programs for all that. So you

Martin Hinton (1:03:28)
Sounds

like it's got a lot going on. Jim LaRoe, CEO of Symphion. There's all kinds of notes, show notes here. There's links to Jim's LinkedIn page, Symphion, so you can find him, reach out if you if you find yourself listening to this and thinking, boy, I need to check in this, check in with Jim. Jim, thanks so much. Really, really enjoyed talking with you today. absolutely very grateful for the for the time. Everyone else, thank Cheers, Jim.

Everyone else, thanks for watching and listening. wherever you are, if you want to leave a comment or you got a question, you can drop it in in in the platform you're using and we'll do our best to get an answer. If we can't, we'll get it back to you. And again, thanks so much for taking the time to listen and watch today. I'm the executive editor of Cyber Insurance News, Martin Hinton. Thanks for watching. Enjoy the rest of your day.

Martin Hinton (1:04:16)
If you're getting something out of the show, follow or subscribe wherever you listen, and leave a rating or review. It helps more people find us. Thank you.