The SafeHouse

Brandy Vargas, Senior Manager of Cyber Solutions at Crum & Forster, offers crucial insights for small to midsize businesses (SMBs) on cyber insurance. She emphasizes that these policies are not like traditional insurance and require proactive engagement. Brandy stresses the importance of thoroughly understanding your policy's nuances, like sublimits and exclusions, to avoid being caught off guard. She also highlights the immense value of the free resources often included with policies, such as phishing simulations and incident response templates, which can dramatically improve an SMB's cyber defenses at little to no cost.The episode also focuses on proper incident response. Brandy warns against the common mistake of reacting to a cyber event by acting alone, as it can jeopardize legal protections and insurance coverage. She strongly advises that SMBs immediately engage their insurer's emergency response teams to ensure the incident is managed correctly and privileged communications are preserved. Her core message is that SMBs must build strong relationships with their brokers and carriers to access expert support, prevent recurring attacks, and ultimately strengthen their cyber resilience.#CyberInsurance #SMBs #RiskManagement #Cybersecurity #IncidentResponse #SmallBusinessTips #CrumAndForster #CyberResilience #BusinessSecurity

In this Safe House Initiative podcast, Brandy Vargas (Crum & Forster) offers vital insights into cyber insurance for small and midsize businesses (SMBs). She blends cybersecurity expertise with insurance risk management, stressing that policies go beyond just limits—SMBs must understand sublimits, exclusions, and nuances.

Brandy highlights the often-overlooked value of free resources from carriers (like phishing simulations) and emphasizes proper incident response. She warns against common mistakes, like wiping systems without insurer involvement, which can jeopardize legal protections and coverage. Always engage your insurer's emergency response teams immediately to preserve privileged communications.

Key takeaways for SMBs:👉 Understand your policy: Look beyond headline limits to sublimits and exclusions.👉 Utilize free resources: Carriers offer valuable tools to boost your defenses.👉 Respond correctly: Involve your insurer immediately during an incident; don't act independently.👉 Keep contacts offline: Have printed copies or offline access to your policy and emergency numbers.👉 Work with expert brokers: Ensure your broker specializes in cyber or involves a wholesale broker for tailored coverage.👉 Be vigilant: Cyber attackers can persist in your environment, requiring thorough remediation.

This episode is a crucial guide for SMBs to not only secure cyber insurance but to actively use its resources and navigate incidents effectively.

#CyberInsurance #SMBs #Cybersecurity #RiskManagement #IncidentResponse #PolicyTips #BrandyVargas #CrumAndForster #BusinessSecurity #CyberPreparedness

In this episode of the Safe House Initiative, we're joined by Heather Mongeau, VP and Director of Cyber Product Solutions at Allied World Insurance Company. Heather takes us deep into the world of cyber underwriting and its critical role.

She clarifies that cyber insurance is more than just financial aid post-incident; it's about proactive risk management, including services like penetration testing and vulnerability assessments. Heather stresses the vital importance of accurately completing cyber insurance applications, especially for SMBs, and highlights how essential Multi-Factor Authentication (MFA) and other strong security controls are for securing coverage.

Key insights you'll gain:

• Underwriting is risk evaluation: It bridges the financial gap and enables business continuity.
• Applications are complex: Accurate details and knowledgeable brokers are crucial to avoid coverage denials.
• Security controls are prerequisites: Lack of MFA and other basics can lead to declined coverage.
• Cyber incidents are inevitable: Preparation is key to minimizing damage and downtime.
• Insurers offer more than just money: They provide valuable pre-breach risk management services and immediate access to incident response teams ("breach coaches") during an attack.

Heather emphasizes that cyber insurance is an evolving field, urging businesses to partner closely with brokers and carriers to find tailored coverage. Don't face cyber threats alone – leverage these resources to strengthen your security posture.

What's one security control your business uses that you think is absolutely crucial for cyber insurance? Let us know in the comments!

#CyberInsurance #Underwriting #Cybersecurity #RiskManagement #SMBs #MFA #IncidentResponse #CyberAttacks #BusinessSecurity #AlliedWorld

In this episode of the Safe House Cyber Insurance Summer Series, we dive deep with Ryan Mercer, VP of Cyber at McGriff brokerage. With over a decade of experience, Ryan pulls back the curtain on the evolving world of cyber insurance.

He explains why many small to medium-sized businesses (SMBs) still aren't getting cyber coverage, shedding light on challenges like broker education and the increasingly detailed application process.

Here's what you'll learn:

✅ The crucial role of brokers: How they're becoming consultative advisors, guiding clients on cybersecurity best practices (like MFA and EDR) to help them get better insurance terms.

✅ Why prompt incident notification is key: Why you must immediately tell your broker and insurer if a cyber incident occurs for smooth claims and recovery.

✅ The truth about cyber insurance: It's not a magic shield that prevents attacks. It primarily helps with the aftermath—think legal fees and recovery services—but it doesn't protect your reputation or guarantee business continuity.

✅ A dynamic market: Understand how this relatively young market is rapidly changing, with new tools like automated underwriting emerging.

This conversation bridges the gap between insurance and effective cybersecurity, highlighting how well-informed brokers are essential partners in navigating today's complex cyber risk landscape.

What's your biggest takeaway about cyber insurance? Share your thoughts in the comments below!

#cyberinsurance #SMBsecurity #Cybersecurity #RiskManagement #BrokerAdvice #MFA

In this episode, Jeff Edwards and Tawana Johnson from the Safe House Initiative podcast are joined by Steven Schwartz, Chief Insurance Officer at Safe Security, to kick off their cyber insurance summer series. Steven emphasizes that cyber risk quantification (CRQ) is essential for making informed decisions about cyber insurance.

He explains that CRQ translates technical cybersecurity metrics into business-relevant financial terms, moving beyond inaccurate methods like basing limits on revenue. Every organization has a unique risk profile, making a data-driven approach crucial for balancing risk mitigation, transfer, and acceptance.Steven highlights the FAIR Institute's methodology as the global standard for CRQ, stressing the need to understand asset values and the business context, including often-overlooked business interruption risks. For practical CRQ, he suggests starting with basic metrics like sensitive data volume and revenue, using public breach cost data to estimate potential losses.

The conversation also covers common overlooked risks, such as third-party vendor vulnerabilities and social engineering, with the human element remaining the weakest link, now amplified by AI tool usage. Steven then introduces emerging security warranties as alternatives to traditional insurance, offering faster payouts embedded within cybersecurity products. He also discusses how insurtech MGAs are simplifying cyber insurance for SMBs, providing quick, affordable policies and incident response services.

Steven concludes by advising security leaders to quantify cyber risk in financial terms to better communicate with executives and boards, enabling smarter decisions and stronger cybersecurity.

Key Takeaways:

• Cyber Risk Quantification (CRQ) is vital for understanding your actual risk and making informed cyber insurance decisions.
• Traditional methods of setting insurance limits are often flawed; every organization's risk profile is unique.
• The human element remains a significant vulnerability, exacerbated by new technologies like AI.
• Emerging security warranties and insurtech MGAs are changing the landscape of cyber risk financing.
• Translating cyber risk into financial terms is key for effective communication and strategic cybersecurity.

#CyberInsurance #CyberRisk #Cybersecurity #RiskManagement #CRQ #SafeSecurity #Podcast #TechTalk #DataSecurity #BusinessInterruption #FAIRMethodology #Cybercrime #Insurtech #SMBsecurity #RiskQuantification #StevenSchwarz #SafeHouseInitiative

The Safe House Initiative podcast, hosted by Jeff Edwards and co-hosted by Tawana Johnson, delves into cyber insurance for small to mid-sized businesses. This series builds on previous discussions about incident response flaws, now focusing on the lifecycle of cyber insurance from risk assessment to claims and litigation.

Tawana Johnson, a former litigator and current cyber breach coach at Lewis Brisbois, shares her expertise in handling cyber incidents like ransomware attacks, emphasizing cyber insurance's role in mitigating damage. A key point is the alarmingly low adoption rate (around 4%) of standalone cyber insurance policies among SMBs, attributed to a lack of understanding or perceived complexity.

Tawana explains her role as a breach coach: supporting clients in crisis, ensuring attorney-client privilege during investigations, and coordinating with insurance carriers, forensic teams, and vendors to navigate legal obligations and recovery.

The upcoming series will cover risk quantification, the role of brokers, underwriting, the claims process, class-action litigation, coverage disputes, and business interruption claims. Tawana highlights the evolving nature of cyber insurance, with carriers now using threat intelligence and penetration testing. She stresses the vital importance of standalone cyber insurance, as standard property and casualty policies often fall short in cyber coverage.

Overall, the episode introduces the complexities of cyber insurance, addressing long-term risks beyond immediate incident response. The goal is to raise awareness, boost adoption, and offer practical guidance for SMBs to better protect themselves from cyber threats.

Highlights:

🔹 Low Adoption: Only ~4% of SMBs have standalone cyber insurance.

🔹Breach Coach Expertise: Tawana Johnson offers unique insights from her legal and breach coaching background.

🔹Privilege & Coordination: Breach coaches are key to maintaining attorney-client privilege and managing incident response.

🔹Risk Quantification: Essential first step before purchasing insurance.

🔹Educated Brokers: Crucial for proper cyber insurance advice.

🔹Comprehensive Series: Covers claims, litigation, and disputes.

🔹Standalone Policies: Provide critical, specialized cyber protections.

Key Insights:

🔹Awareness Gap: Low adoption indicates a lack of understanding and accessibility of cyber insurance.

🔹Breach Coach Role: Provides crucial legal and emotional support, ensuring privileged communication.

🔹Evolving Market: Requires greater due diligence due to sophisticated underwriting (e.g., pen testing).

🔹Broker's Pivotal Role: Knowledgeable brokers are essential for appropriate policy selection.

🔹Incident Response Coordination: Multi-stakeholder collaboration, often led by a breach coach, is vital.

🔹Litigation Risk: Increasing class action lawsuits and coverage disputes necessitate preparedness.

🔹Standalone Benefits: Offer unique services (breach coaches, negotiation support) beyond financial coverage.

This episode aims to empower businesses with knowledge and strategies for managing and mitigating cyber risks in the digital world.

#CyberInsurance #SMBsecurity #Ransomware #Cybersecurity #BusinessProtection

In this episode of the Safe House Initiative, host Jeff Edwards welcomes Craig Bowman, Vice President at Trellix and the visionary co-founder of the Redwood Project. Their conversation dives deep into the urgent need for a federal cyber enterprise that seamlessly integrates public and private sector efforts to fortify national cybersecurity.

Craig shares his unique journey, from his early days in business and computers to pivotal roles within the Department of Defense, Adobe, Verizon, VMware, and now Trellix. His extensive background in both offensive and defensive cyber operations has shaped his profound understanding of the industry's collaborative needs.

Discover the origin story of the Redwood Project, born from the recognized gap in government-private sector cyber collaboration, particularly post-Snowden. Craig unveils the project's five key workstreams, designed to bridge this divide: expanding the Special Government Employee Program, creating proactive disruption strategies, fostering voluntary partnerships through "Operation Dynamo," introducing vital legal protections, and bolstering cybersecurity for smaller companies.

The discussion also explores navigating legislative challenges, the current administration's approach to deregulation and AI in cybersecurity, and the critical role of Information Sharing and Analysis Centers (ISACs). Craig emphasizes empowering small and medium businesses, advocating for democratized access to cybersecurity resources through grants and incentives.

This episode offers invaluable insights into creating a more resilient cybersecurity landscape for the United States, highlighting the power of collaboration and strategic foresight.

Key Takeaways:

🔹 The essential role of a unified federal cyber enterprise.

🔹 Challenges and strategies for enhancing public-private cybersecurity collaboration.

🔹 The Redwood Project's five key initiatives for national cyber security.

🔹 The impact of legislative changes and the current administration's focus on AI.

🔹 How to empower small and medium businesses in national security efforts.

Tune in now to understand how leaders like Craig Bowman are shaping the future of cybersecurity collaboration and protecting our digital infrastructure!

Don't forget to like, subscribe, and follow the Safe House Initiative for more critical discussions on national security and cyber defense!

#SafeHouseInitiative #Cybersecurity #NationalSecurity #RedwoodProject #CraigBowman #Trellix #PublicPrivatePartnership #CyberDefense #CyberThreats #Podcast #JeffEdwards

In this episode of the Safehouse Initiative, host Jeff Edwards sits down with Daron Hartvigsen, a former technical services agent and cyber program manager for the Air Force Office of Special Investigations (OSI). Now a leader in the commercial cybersecurity sector, Darren shares his incredible career journey, offering invaluable insights into the evolving world of cybercrime and defense.

From traditional surveillance in the late 90s to pioneering cybercrime investigations, Darren reveals how the digitization of everything transformed his roles. Discover the pivotal shift from reactive incident response to proactive threat pursuit, and how government cyber operations have increasingly converged with commercial cyber intelligence.

Darren sheds light on his move from military and government into the private sector, driven by the expanding monetization of cyber threats like ransomware and extortion. Learn why cyber threat intelligence and active countermeasures gained prominence around 2019-2020, reshaping the landscape for everyone involved.

The conversation delves into the inevitable integration of government and commercial cybersecurity efforts, highlighting how even core government functions like the Common Vulnerabilities and Exposures (CVE) process are now influenced by commercial entities. Darren envisions a hybrid cyber ecosystem where seasoned government professionals leverage their expertise in commercial roles to fill critical gaps.

For anyone considering a transition from government service to the private sector, Darren offers essential advice: seek mentorship, embrace optimism, and project confidence. He emphasizes the crucial role of networking and believing in your value to thrive in a new environment.

Darren Hartmixson's story is a practical and hopeful roadmap for cyber professionals navigating career transitions, reflecting the broader trends of collaboration, evolution, and resilience in cybersecurity.

Key Highlights:

✅ Darren's career evolution from traditional surveillance to cybercrime investigation with Air Force OSI.

✅ The strategic shift from reactive incident response to proactive threat pursuit in cyber operations.

✅ Why the expanding monetization of cyber threats fueled his transition from government to commercial cybersecurity.

✅ The increasing integration and hybridization of government and commercial cybersecurity sectors.

✅ Critical advice for career transition: mentorship, optimism, confidence, and networking.

Tune in now to gain a deeper understanding of the future of cybersecurity and how expertise from both government and commercial sectors is shaping our digital defense.

Follow the Safehouse Initiative for more in-depth discussions with leading experts in national security and cyber defense!

#SafehouseInitiative #Cybersecurity #CareerTransition #GovernmentToCommercial #CyberThreatIntelligence

What does it take to defend national infrastructure in a rapidly evolving threat landscape? In this episode of the SafeHouse podcast, host Jeff Edwards sits down with Luke Tenery, Partner at StoneTurn and former cybersecurity leader at Kroll, to unpack the human and technical layers of building a federal threat pursuit model.With experience rooted in digital forensics, incident response, and working alongside former federal agents, Luke shares how blending public-private talent is reshaping how agencies and vendors approach threat defense. From cyber leadership and culture to the future of enterprise-wide visibility, this episode takes you inside the evolution of cyber strategy at the national level.💡 Why public-private collaboration is vital for modern threat pursuit🔍 How the government is aligning with commercial best practices🔐 The role of mission clarity and culture in building cyber resilience#Cybersecurity #FederalIT #ThreatPursuit #DigitalTrust #RiskManagement🎧 Watch now and learn how federal cybersecurity is becoming more proactive, agile, and integrated than ever.

System Backup operations are often viewed as separate from the Cybersecurity policies and procedures. But listen to W. Curtis Preston, known in the industry as "Mr. Backup” & host of "The Backup Wrap-up" podcast, discuss with Jeff Edwards, Co-Chairman of the SafeHouse Initiative, the importance of Backup as part of your cybersecurity and operational resilience plan.