Multi-factor authentication proves a real person logged in. It never proves who owns the credential.

Chris Skipworth, CEO of Passpack, joins Martin Hinton to talk about credential management and cyber insurance. The conversation covers credential sprawl, the offboarding failures behind most small business breaches, and why the insurance industry has an access problem of its own.

Skipworth puts one question to business owners. How long would it take you to identify who owns which credentials? Most cannot answer it.

Also in this episode: what AI changed for attackers, why browser password managers are a bad idea, where MFA stops being useful, and three steps a small business can take this week.

Read the full article: https://cyberinsurancenews.org/credential-management-cyber-insurance-passpack/

CHAPTERS

00:00 Introduction

01:05 How the simple password became complicated

02:12 Security in the 1990s and what got skipped

06:39 What a credential actually means today

09:30 Offboarding and dormant credentials

12:41 The cost problem for small businesses

15:25 Credential sprawl and the question owners cannot answer

20:08 Human and non-human identity

24:20 Why insurance has an access problem

29:59 What AI changed for attackers

37:44 Friction, convenience and security

42:33 Cyber insurance and credential controls

46:27 Passkeys, MFA and what comes next

50:55 Default passwords and browser password managers

55:00 The human side of security

60:26 Three things to do on Monday morning

Music licensed through Soundstripe.Code: 6VZLZBGCKQMDWBMW

A company tells its cyber insurer it has MFA. That answer is true. The claim still fails. Julien Richard, VP of Information Security at Lastwall, and Isabel Castillo, Lead InfoSec Operations Engineer at Lastwall, join Martin Hinton to take apart the cyber insurance application's most misleading question.

Why a yes-or-no MFA question collects honest answers and prices nothing. What phishing-resistant authentication actually resists. How attackers take your session instead of your password. Why multi-factor and multi-step are not the same thing. And Richard's proposal for a live control dashboard that could replace the point-in-time audit.

Covered in this episode: multi-factor authentication, phishing-resistant MFA, passkeys and FIDO2, adversary-in-the-middle attacks, session token theft, cyber insurance underwriting controls, security questionnaires, zero trust, least privilege, identity sprawl, and continuous control monitoring.

Chapters

00:16 Introduction to MFA challenges and evolving threats

01:22 MFA Types and Strength

06:13 Why MFA Still Matters

08:49 Common MFA Implementation Gaps

14:09 How Attackers Bypass MFA

23:22 Phishing-Resistant Authentication and Passkeys

29:06 Passkeys, Friction, and Insurance Questionnaires

35:12 Identity Sprawl and Personal Devices

40:04 Zero Trust and Least Privilege

43:58 Evaluating MFA for Cyber Underwriting

48:27 Authentication Logs and Incident Response

53:50 MFA as Part of Layered Security

57:48 Reducing Risk Through Segmentation

1:00:14 Board Questions and Practical Takeaways

1:04:42 Closing Thoughts

The Cyber Insurance News and Information podcast covers the underwriters, brokers and security leaders shaping the cyber insurance market.

Read the full article

Music licensed through Soundstripe. License code: VDAMY4ZV39WWXJII

Microsegmentation. Poland's cyberwar. AI-powered attackers. The blast radius that decides your cyber insurance premium.

Piotr Kupisiewicz, CTO of Elisity, joins Cyber Insurance News & Information to talk microsegmentation, but the conversation keeps returning to Poland: 270,000 cyberattacks in the past year, a civilian defense corps called Cyber Legion, and why hybrid warfare doesn't respect oceans.

Along the way: what actually counts as critical infrastructure now, why segmentation works for mid-market companies too, how AI is lowering the bar for attackers on both sides, and the one question every board should ask its CISO about worst-case scenarios.

Resources and links:

Cyber Insurance News & Information

Piotr Kupisiewicz on LinkedIn

Elisity

Chapters

00:00 Understanding Micro Segmentation

03:27 Cyber Warfare and Its Impact on Poland

06:28 The Broader Definition of Critical Infrastructure

10:21 The Reality of Cyber Attacks

12:29 The Water Treatment Facility Attack

15:31 Cyber Militia and Civil Service in Poland

18:35 AI's Role in Cybersecurity

20:58 Agentic AI and Responsibility

26:59 Shadow AI and Governance

31:05 The Importance of Critical Infrastructure

34:55 Advising Government on Cybersecurity Priorities

36:40 The Basics of Cybersecurity: Infrastructure and Human Factors

39:41 Human Error and Cybersecurity: The Overlooked Threat

41:48 The Importance of Routine in Cybersecurity

44:34 CISO Challenges: Balancing Security and Business Needs

47:54 Cyber Insurance: Financial Implications of Security Measures

49:54 Micro-Segmentation: A Solution for Mid-Sized Companies

53:27 Building Security from the Ground Up

56:35 The Submarine Analogy: Resilience in Cybersecurity

59:56 The Team Sport of Cybersecurity

01:02:23 Engaging Non-Technical Executives in Cybersecurity Discussions

Follow Cyber Insurance News & Information for weekly coverage of the cyber insurance market, from underwriting to claims to the technology reshaping risk.

"You can be a hundred percent compliant and still be breached."

Joshua Brown, Chief Information Security Officer at Spektrum Labs, joins Martin Hinton to dismantle the industry's most expensive assumption: that passing an audit means being secure. Brown explains why GRC failed to deliver better security outcomes, why attestations expire the moment they're made, and what happens on the other 364 days of the year.

The conversation covers the "cyber poverty line" facing small businesses, why insurers are suing MSSPs after client breaches, how continuous control validation could replace the questionnaire, the Sophos Insurability FastTrack partnership, and the elevator question every CISO dreads: "Are we secure?" Brown's answer, and the question he'd replace it with, closes the show.

Key moments:
02:05 — What is GRC and why has it failed?
08:03 — The cyber poverty line
17:00 — A flight recorder for resilience
22:00 — Attestations vs. proof in cyber insurance
45:01 — Small businesses and the security gap
01:03:49 — The question CEOs should ask instead

Read the full article at Cyber Insurance News & Information: https://cyberinsurancenews.org/cyber-insurance-joshua-brown-spektrum-labs-podcast/

Related coverage: Spektrum's Fusion platform launch, the Sophos partnership, and Max Perkins's January episode are all at cyberinsurancenews.org.

A federal judge just ruled against the IRS on micro-captive cyber insurance, the tool businesses use to fund cyber losses their policies won't cover. Dustin Carlson, a named plaintiff in the case, returns to explain what changed and what's still in legal limbo.

Carlson, president of SRA 831(b) Admin, sits down with Executive Editor Martin Hinton to break down the Drake Plastics v. IRS ruling, the IRS's now-discredited evidence for its "listed transaction" label, and the appeal that could send this all the way to the Supreme Court. They also get into where AI liability exclusions are quietly opening new gaps in standard business coverage, and why a tax-court fight in Texas should matter to anyone buying cyber insurance.

What you'll hear:

• What an 831(b) plan actually is, in plain English

• Inside the Drake Plastics v. IRS lawsuit and the judge's ruling
• Why the IRS's evidence didn't hold up in court
• What's next: the appeal, the circuit split, a possible Supreme Court fight
• How AI liability exclusions are widening the cyber coverage gap
• The real financial cost of a cyber breach for small business

Read the full article: https://cyberinsurancenews.org/micro-captive-cyber-insurance-coverage-gap/

Connect with Dustin Carlson: https://www.831b.com

Cyber Insurance News & Information covers the cyber insurance market, claims, regulation, and the people shaping it. New episodes weekly.

A medical device maker gets hit. Surgery schedules slip. The attacker was a nation-state, and they knew exactly what they were looking for.

Michael Crean, Senior Vice President at SonicWall, joins Cyber Insurance News to explain why the threats targeting power grids and pipelines are the same ones that compromise small businesses every day. The difference is patience, not technique.

We cover the March 2026 Stryker attack, attacker dwell time, the Colonial Pipeline failure, and why cyber insurers are moving from self-attested questionnaires to continuous audit. Plus the two unglamorous controls Crean says cut compromise risk by roughly 70 percent.

A former US Army soldier turned cybersecurity leader, Crean also makes the case for why military veterans are a natural fit for the industry.

Michael Crean

SonicWall

Stryker

Colonial Pipeline

CHAPTERS

00:00 Introduction and Background of Michael Crean

03:15 Military Influence on Leadership and Cybersecurity

08:07 Transitioning Veterans into Cybersecurity Careers

10:22 SonicWall's Evolution and Cybersecurity Landscape

12:19 Iran's Cyber Warfare Capabilities

16:07 Impact of Cyber Attacks on Critical Infrastructure

21:44 The Psychological Effects of Cyber Threats

27:50 The Need for Friction in Digital Security

30:48 Critical Infrastructure Vulnerabilities and Iran's Strategy

33:27 The Inconvenience of Digital Dependency

34:17 Legacy Technology and Cybersecurity Risks

34:57 Fundamentals of Cyber Hygiene

37:52 The Mundane Yet Crucial Practices

39:22 Personal Responsibility in Cybersecurity

40:59 The Economic Impact of Cybercrime

43:58 The Invisible Threat of Cyber Attacks

50:05 The Evolution of Cyber Insurance

54:04 The Importance of Cybersecurity Fundamentals

01:00:41 Empowering Personal Responsibility for Cybersecurity

Most corporate security leaders are doing compliance, not security. That is the blunt opening from Mitchell Amador, CEO of Immunefi, the leading crowdsourced security platform for blockchain, and the argument that drives this entire conversation.

AI has ended the era of crime-scale cyber risk. The number of hacking groups capable of causing serious harm has jumped tenfold. Attack capability that once required a nation-state program now fits in a laptop. Most CISO budgets were built for a world that no longer exists.

Amador explains what crypto security has already figured out and why the rest of the internet is about to be forced to catch up. We cover bug bounties, coopetition, smart contract insurance pricing, and the quantum encryption threat that simultaneously puts every bank, government, and blockchain at risk.

Billy Mitchell

North Korea and cyber warfare

Chapters

00:00 Mitchell Amador's path to crypto security

02:13 What is Immunefi?

03:49 Web3 as a dark forest

06:48 Nation-state actors and North Korea

08:00 The response to constant threat

09:36 Why crypto security stakes are global

12:35 Move fast and break nothing

14:39 What is a bug bounty program?

16:31 Why crowdsourced security beats internal teams

21:32 The culture of coopetition

29:45 AI and the economics of attack

32:51 Force multiplication and AI offense

36:32 The human element in security

40:27 Where crypto fits in cyber insurance

47:18 Smart contract insurance and loss rates

49:14 Quantum computing and encryption risk

52:40 Y2K vs quantum, scale of the problem

52:55 What should CEOs and boards do now?

58:31 Five years from now — what seems obvious

www.cyberinsurancenews.org

Agentic AI can act on its own. So who controls what it does, and who pays when it goes wrong?

Recorded live at the Scout InsurTech Conference in Columbus, Ohio, this episode brings together four experts to unpack the authorization gap in agentic AI cyber insurance. The conversation digs into blame, liability, responsibility, controls, and implementation.

You'll hear how underwriters classify AI risk, why most cyber policies already cover AI breaches, where carriers split on affirmative coverage, and what businesses should do first.

Guests

Julia Garcia-Trombley, US & Canada, CertX

Jeremy Epstein, CEO, Mayflower Specialty

Rich Gatz, Head of Cyber Claims, Arch Insurance

Tristan Morris, CEO, SplitSecure

Chapters

00:00 Introduction to Cyber Insurance and AI

02:57 Understanding Agentic AI and Its Implications

06:04 The Classification Problem in AI Risk

08:51 The Role of Controls in Cyber Insurance

12:02 AI Risk vs Cyber Risk: A New Perspective

14:59 Certification and Governance of AI Controls

17:48 The Future of AI in Cyber Insurance

19:55 The Human Element in AI Risk Management

22:03 Understanding Acceptable Risk in AI

24:03 The Evolving Threat Landscape of AI

27:19 Cyber Insurance and AI: A Complex Relationship

30:24 Defining AI Risk and Insurance Coverage

33:15 The Importance of Risk Assessment in AI

36:44 Navigating Regulatory Frameworks for AI

39:05 Industry Consensus on AI Risk Management

Human error drives most cyber breaches. But the deeper problem is a workforce gap that leaves organizations exposed before the first attack arrives. Yaniv Kapluto, Chief Revenue Officer at nuKudo, joins Cyber Insurance News Executive Editor Martin Hinton to discuss the human realities behind every breach, the true cost of stolen data, and what AI and quantum computing mean for the future of data security.

Kapluto breaks down nuKudo's rigorous talent pipeline, why shadow AI is an immediate threat most organizations have not mapped, and what underwriters should be asking before they quote a risk.

This episode covers:

• Why people remain the most exploitable entry point in any organization.
• How cybercrime operates as a structured, funded business.
• The long-lasting value of stolen data and the ransomware cost curve.
• What good cybersecurity culture looks like from the inside.
• Shadow AI risk and the quantum computing threat to encryption.
• What underwriters should look for when assessing cyber preparedness.

Yaniv Kapluto is CRO at nuKudo, a global cybersecurity workforce company placing trained security professionals across government and private sector clients.

Chapters

00:00 Introduction to Cybersecurity and Human Error.

01:14 nuKudo's Mission and Origin Story.

04:35 Assessing Cybersecurity Needs and Roles.

09:38 The Human Element in Cyber Breaches.

13:36 Understanding the Scale of Cyber Threats.

18:09 The Asymmetry of Cybersecurity Resources.

20:32 The Value and Monetization of Stolen Data.

23:34 Cyber Insurance and the Cost of Breaches.

28:19 The Future of Data Security and Quantum Computing.

33:09 Cybersecurity in Healthcare Environments.

35:01 Understanding Hospital Cybersecurity Risks.

38:44 Bridging the Gap: IT and Cybersecurity.

43:55 Indicators of Cybersecurity Preparedness.

50:25 Addressing the Talent Crisis in Cybersecurity.55:49 The Future of Cybersecurity: EmbracingChange

Every business leader assumes a cyberattack is coming. Far fewer have asked the question that actually matters: how fast can we get back to trading?

Lee Nolan, General Manager UK and Ireland for Hitachi Vantara, joins Martin Hinton to introduce one of the most practical frameworks in cyber risk planning, the minimum viable business. It is not a technical concept. It is a board-level decision about which systems, processes, and data your organization cannot survive without.

In this episode, Lee explains why recovery costs run 20 to 24 times the ransom demand, why the average organization takes 21 to 24 days to restore basic operations, and why full recovery takes around seven months. He walks through the castle and moat model for protecting critical data, explains immutable backups and clean rooms in plain English, and describes what a credible incident response plan actually looks like.

He also makes the case that cyber insurance is most valuable as a partnership not a policy you read after the breach.

One question closes the episode. When did you last ask your CISO how long recovery takes?

Cyber Insurance News Podcast is published by cyberinsurancenews.org and covers the global cyber insurance market for underwriters, brokers, CFOs, and General Counsel.

Chapters

00:00 Introduction to Cyber Insurance and Data Management

04:42 Understanding Cyber Risk and Recovery

09:43 The Role of Cyber Insurance in Business Continuity

14:27 Communication and Transparency in Cyber Incidents

19:38 The Impact of Supply Chain Vulnerabilities

24:49 Data Management and Recovery Challenges

31:31 The Importance of Preparation in Cybersecurity

36:39 C-Suite Conversations: Engaging with the CISO

41:06 Cybersecurity as a Health and Safety Standard

44:42 Incident Response Planning: The Basics

50:46 Understanding Immutable Backups and Clean Rooms

57:20 Hitachi Vantara: A Global Technology Leader

01:00:07 Paying It Forward: The Importance of Mentorship

Lee Nolan

Hitachi VantaraOfficial Website

CyberResilience Act (UK)

Commvault DataProtection Solutions