Monica Shokrai, Google representative, discusses challenges in the cyber industry, including Google's use of an actuarial team. Topics covered include a TikTok account using facial recognition, information shared in the Google antitrust case, and the difficulties of cyber insurance. They also explore the role of brokers and the increasing concern over privacy invasion.
Google uses an internal actuarial team to quantify risk and develop insurance policies based on the risk landscape within the company.
The cyber insurance market is evolving with increased scrutiny, longer audit reports, and the need for better data-driven metrics to accurately assess and underwrite risk.
Deep dives
Google's Actuarial Team Quantifies Risk for Insurance Purchasing Decisions
Google has an internal actuarial team that quantifies risk to inform insurance purchasing decisions within the company. This team uses risk quantification to assess and understand the risk landscape within Google and translates that into insurance policies. While it is uncommon for companies outside of Google to have their own actuarial teams, Google's comprehensive approach allows for better risk assessment and insurance policy development. The team focuses on cyber insurance and factors in emerging risks such as ransomware to adapt coverage and pricing. The evolving market of cyber insurance involves more scrutiny, longer audit reports, and stricter qualification criteria for policyholders.
Challenges in the Cyber Insurance Market and Data-Driven Approaches
The cyber insurance market is characterized by frequent changes in coverage, premiums, and exclusions due to emerging risks like ransomware. Insurers have started asking more detailed questions and using tailored supplemental applications in response to increased losses. In terms of risk quantification, there is a growing trend toward obtaining better and more relevant data from internal and external scans to inform insurance underwriting. However, the standardization of metrics and the correlation of those metrics to actual losses present challenges. Quantitative and qualitative data that provide an accurate picture of risk mitigation efforts are crucial for informed underwriting decisions.
Google's Risk Protection Program for Cloud Customers
Google offers a Risk Protection Program that combines security metrics and insurance policies to enhance security practices among Google Cloud customers. Through the embedded tool called Risk Manager, customers can scan their cloud environment for risk indicators and send the data to insurance providers for the quantification of cyber insurance premiums. The Cloud Protection Plus policy expands coverage for Google Cloud, rewarding customers with better premiums based on their security practices. The shared fate approach aims to incentivize improved security measures and provide customers with insights into risk reduction within the cloud environment.
The Future of Cyber Insurance and Risk Quantification
As the cyber insurance market continues to mature, there is a need for more data-driven metrics to assess risk accurately. Actuaries and risk managers are exploring ways to quantify risks related to personnel and security measures. While some progress has been made with outside-in scans, there is still a need for standardization and consensus among insurers, brokers, and security providers. Collaboration is essential to develop data-driven approaches that consider the impact on frequency and severity of cyber events. Transparency, early engagement with insurers, and expressing what matters most from a security perspective can help navigate the complex cyber insurance market.
Simone Petrella sits down to talk with Monica Shokrai from Google at the mWISE 2023 Cybersecurity Conference about challenges in the industry from the company perspective, and what Google does with its own actuarial team to calculate it's own risk. Ben has the story of a TikTok account that targets ordinary people using advanced facial recognition technology. Dave's got the story of some of the information being publicly shared in the Google antitrust case.
While this show covers legal topics, and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney.