When it comes to Cybersecurity Insurance what are most people using? We currently use Beazley and am up for renewal. Before I signed another 3-year contract, I’d like to hear from my peers what are you using?

1.8k viewscircle icon1 Upvotecircle icon6 Comments
Sort by:
SVP in Finance (non-banking)4 years ago

Check out Marsh and CFC. I have seen few policies from CFC and their coverage has been great.

Lightbulb on2
Board Member, Advisor, Executive Coach in Software4 years ago

It may be less important to evaluate who you use but their track record to pay out a claim as well as the restrictions/requirements they may have for them to payout. Perhaps we should do a poll and ask folks who they use, how happy they are with the provider, and any ‘gotcha’ sort of requirements the provider has

Lightbulb on3 circle icon2 Replies
no title4 years ago

Malcolm -<br><br>I&#39;ve evaluated the payout track record and the requirements/restrictions they to retain a policy from Beazely.  They are pretty restricted in what they will cover and making the renewal a challenge.<br><br>A great question to open a poll with? If you don&#39;t mind, I will open a poll asking what people are using and if they are happy with their choice.

Lightbulb on1
no title4 years ago

thats great - we can do our on &#34;yelp&#34; rating for them :)

Lightbulb on1
Associate Vice President, Information Technology & CISO in Education4 years ago

We're currently with Chubb. I've had a really tough time with renewals, and I've come to realize it is likely the broker's fault. I met with Chubb the other week and walked through my cyber program, and they said they felt 5x better about us given the discussion. I've been trying for over six months to get in front of the underwriter, but the broker was playing games.

My advice is, if you are having challenges, try and speak with the underwriters directly. For some industries, the cyber insurance underwriters are trying to divest, and are tough to renew... If you're getting a 3 year option and are happy, I'd say lock it in. It'll be tougher to get renewals before it gets easier, in my opinion.

AIG is another good one to look at.

Lightbulb on3 circle icon1 Reply
no title4 years ago

John -<br><br>Thank you for the information. That helps to move forward and make a more concise decision on which cybersecurity insurance provider to go with. I know the renewals are going to get worse as security challenges increase.

Lightbulb on1

Content you might like

I’m putting together a simple word cloud that captures the top concern of executives right now, in just “one-word.” please drop your “one word” below. I’ll make sure to share the final results here as a small thank-you.

Read More Comments

How does your business train new staff on the core systems they need to do their job?

We have formal training sessions for all critical systems43%

We have Quick Reference Guides available57%

They get buddy training from someone else in the team51%

We don't. It's sink or swim.3%

View Results

Does your company monetize payments today?

Yes33%

No, but we are considering it for later this year32%

No, but we are considering it for next year14%

No, and we do not have any plans to at this time18%

View Results

Securing AI Systems Starts with Data: 3 Critical Threats Every Organization Must Address

New joint guidance from NSA, CISA, FBI, and international partners reveals three significant data security risks that can compromise AI systems and provides actionable steps to protect your organization.

As AI adoption accelerates, securing the data powering these systems has become paramount. The guidance delivers essential insights every cybersecurity leader should understand.

Why This Matters Now

When attackers manipulate training data, they manipulate system behavior. The implications are compromised business decisions and security vulnerabilities cascading through your entire AI infrastructure.

Three Critical Threats to Know

1. Data Supply Chain Vulnerabilities - Third-party or inadvertent tampering, vulnerable to poisoning for as little as $60 to $1,000 USD.

2. Maliciously Modified Data - Deliberate adversarial poisoning targeting training processes and model inversion

3. Data Drift - Natural evolution creates security blind spots that attackers can exploit

Strategic Framework Integration

The real challenge isn’t just implementing these controls; it’s building an integrated defense architecture. Innovative organizations are approaching this systematically:

- Foundation Layer (NIST AI RMF): Governance policies with data provenance requirements

- Architecture Layer (CSA MAESTRO - Model, Application, System, Trust, Risk, Operations): Cloud-native controls with cryptographic signing

- Vulnerability Layer (OWASP): Application-specific protections against LLM threats

- Threat Layer (MITRE ATLAS): Tactical defenses against known attack patterns

- Lifecycle Integration (SAIL): Optional comprehensive methodology encompassing all frameworks

Technical Controls That Enable Success

AI Security Posture Management (AI SPM): Continuous monitoring of model configurations, data lineage, and drift detection across AI infrastructure

Data Security Posture Management (DSPM): Automated discovery and classification of sensitive training data, tracking movement through AI pipelines

Data Loss Prevention (DLP) for AI: Monitoring model outputs for sensitive leakage, blocking suspicious API calls, and preventing unauthorized extraction

The Convergence Opportunity

Here’s what leading organizations are discovering: traditional security tools need AI-aware intelligence, not replacement. Think of the AI Security Data Lake as XDR for models and training data.

The winners are building integrated platforms that correlate:
• Model performance anomalies with network traffic patterns
• Data lineage changes with access control violations
• Drift detection alerts with threat intelligence feeds
• API behavior with adversarial attack signatures

Technical Implementation Reality:

Most organizations retrofit existing security stacks rather than building greenfield AI security programs. Zero-trust networks, SIEM platforms, and DLP tools are getting AI-specific rules and monitoring capabilities.

What This Means for Your Strategy

The maturity model is becoming clear:

- Level 1: Basic AI inventory and data classification
- Level 2: Framework alignment and control implementation
- Level 3: Integrated security telemetry and automated response
- Level 4: Predictive threat modeling and adaptive defenses

Where does your organization sit on this maturity curve? Are you seeing better ROI from enhancing security tools or implementing AI-specific platforms?

Notes:

Strategic analysis was built on the May 2025 NSA AISC & CISA guidance and applied through industry framework integration experience.

Framework mapping based on May 2025 NSA/CISA joint guidance, integrated with NIST AI RMF 1.0, MITRE ATLAS v4.0, OWASP Top 10 for LLMs 2023, and CSA MAESTRO.

Read the full guidance: https://media.defense.gov/2025/May/22/2003720601/-1/-1/0/CSI_AI_DATA_SECURITY.PDF

Cybersecurity researcher Disesdi Susanna Cox shows why OpenAI’s new ChatGPT Agent rewires enterprise risk, and what security leaders must do next.

Three Critical Threats Cox Identified:

1. Non-deterministic decisions - agents reinterpret the same prompt differently, so one misfire can trigger a binding contract or transfer.
2. Cascading failures - multi-step tasks (price compare → pay → verify) give attackers dozens of places to steal credentials or poison data.
3. Emergent behavior: Guardrails cannot cover infinite edge cases; focus on limiting blast radius and recovery time.

Cox argues that math benchmarks ≠ security; what matters is how fast we detect and contain failures.

Three Controls to Implement Now:

30-Day Action | Primary Framework | KPI
Map every agent workflow to attack tactics | MITRE ATLAS | % critical workflows with mitigations
Run weekly prompt-injection & jailbreak tests | OWASP AI Guide + CSA Agentic Red Team | Prompt-injection detection rate vs. false positives
Enforce least-privilege, expiring tokens for agents | NIST AI RMF + CSA MAESTRO “Agent Oversight” | # agents with time-limited creds

Emerging option: The open-source SAIL Secure-AI-Lifecycle framework links these controls to SDLC phases, offering a unified approach to managing AI risks across development and deployment. Pilot SAIL and track % of SDLC phases with mapped AI risks.

Your turn: Which control or framework gives you the biggest headache today, and how are you tackling it? Share a win or a roadblock so we can crowd-source fixes.

Full credit to Disesdi Susanna Cox for her comprehensive analysis: https://disesdi.substack.com/p/openai-just-dropped-their-agentic