Hacker News Reader

Comment by jollofricepeas | Hacker News Reader

[secexec here with F500 company.]

Over time every security executive learns that there’s only three important things in security:

- How big is our cyber policy?

- How do we make sure the insurance company pays out?

- Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y?

That’s really it. When growth and insurance won’t cover it then you’re plugging holes until the equation balances itself out. Everything else is theater.

Doing anything other than the above ends your career...quickly.

View on HN

Some companies care about their brand and how a breach can negatively impact that, add this to your list and now you have four things.

Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.

Sort of.

Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report.

Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and...

Whether your attacker used a nation-state toolkit if so then they don’t have to pay.

Most cyber policies will not protect against “acts of god” or “acts of war” without paying top dollar and having a cap on damages.

They will also look for gross negligence. The worm hit out-of-support Windows XP machines that the company couldn't bother to upgrade in the past 10 years. No compensation.

> Whether your attacker used a nation-state toolkit if so then they don’t have to pay.

Definitely seen that one.

I'm curious as to why an insurer wouldn't look at a bottom-tier pen-test for signs of gross negligence. They'll readily turn up things like failing to have authentication on key file shares, no access controls on the network, or no MFA in use. The sort of stuff that's easily exploited and shows utter neglect on the part of the insured.

Basically, it's been my experience that a tick-box pen-test exercise does a reasonable amount to check if the supposed controls are actually there.

Definitely agree. I just haven’t seen them (insurers) kick off an audit pro-actively without there being a breach.

I’m sure insurers understand that if they are proactive in auditing then a company will stay vigilant and probably patch all those old systems.

Reply on news.ycombinator.com