By Kareena Bavisi, Chief of Staff | EC-Council

It comes down to one number: what your worst incident would cost, and how much of it the business can carry on its own. With a CISO, that’s usually a risk decision. Without one, cyber insurance may only be a compliance purchase.

Before deciding whether to buy cyber insurance, a business needs one number: what its worst incident would cost. When I spoke with Gregory Eskins, who leads Marsh’s Global Cyber Insurance Center, that was where he said a first-time buyer should start. He doesn’t assume every business should buy it. He starts with how much loss a business could absorb on its own, then asks whether the cost of covering the rest makes sense.

How a business gets to that answer depends on who is making the call. Organizations with a CISO tend to be engaged and aware of the risk, and many are on a journey toward resilience. Organizations without one, whether because they lack the resources or because insurance is a compliance requirement for them, face the same decision with less security expertise in the room.

What moves clients to act is usually an event. Cyber risk, Eskins told me, has always been “intellectually understood, I would say, by most organizations, but it’s not been felt personally.” When a real incident hits the news, clients ask about it and whether they’re covered, and AI is making the risk more real to them. That is a reactive way to make a decision about money and risk.

Two kinds of buyers

Start with organizations that have a CISO. They tend to be the engaged ones, and insurers pull them into the conversation because underwriting is technical. They understand the realities of their organizations best, and many are on a journey toward resilience.

Organizations without one are a different story. Some lack the resources for a CISO. Some buy cyber insurance mainly because they have to. That does not track neatly with size or sophistication, and there is nothing wrong with it. For some smaller organizations, insurance is a compliance tool, and, as Eskins shared, buyers generally still get a good product even without understanding everything in it.

The catch is what happens next. Without someone whose job is to keep the exposure in front of leadership, cyber risk tends to stay abstract until a headline makes it real. AI is part of the reason that is changing. As Eskins puts it, “it’s in the headlines all the time. Fear is a strong motivator.” That fear is pulling more organizations into the conversation. For a company with a CISO, it lands on a process already in motion. For one without, it tends to produce a reaction instead of a plan.

Start with your own number

A cyber insurance decision is two questions in sequence. How much loss can the business absorb? And what would it cost to hand off the rest? Plenty of buyers jump to the second one and start comparing quotes, which lets a renewal date or a questionnaire set the limit instead of the company’s own exposure.

The first question needs a worst case and a figure, and the figure matters because the range is wide. Eskins frames it as whether the loss is “a 5 million dollar risk or is that a 50 or $500 million risk?” Good security shrinks that number but never erases it. Some residual risk stays with the business, and that remainder is what the decision is about.

From there it comes down to tolerance. If the business can carry the remainder comfortably, declining coverage is a defensible call. If it can’t, the policy is worth pricing, and the comparison that counts is what covering the remainder costs against what leaving it uncovered could cost. That is why insurance is optional and the number is not. In Eskins’ words, “the question is not should you buy insurance for that, but what is your risk tolerance.”

Pricing the rest is the easier half. The next step is to find out whether coverage exists for that remainder and what it would cost “relative to the risk that you would be otherwise accepting.” In many cases, Eskins says, transferring that risk is “incredibly capital efficient.” Whether it is for your business comes down to quotes and policy language, so compare quotes and read the exclusions before deciding.

AI raises the cost of weak basics

AI has not created a whole new category of cyber risk. It has made weak fundamentals more expensive. Eskins is direct about it: “The foundations and fundamentals of strong cybersecurity still matter. In fact, they’re more important than ever.” Attackers now have tools that work at speed and scale, and a company with weak basics is at a serious disadvantage against them.

The worry is running ahead of the data. So far Marsh has not seen a dramatic increase in events overall, though attack speed and scale are expected to rise, and the firm is working with clients to help them get ahead of it.

What a security team should be ready to explain follows from that. A company deploying AI agents to automate workflows needs a clear account of identity and access, meaning what each agent can reach and why, with permissioning and segmentation behind it. That is incredibly important. Keeping that account current is the working core of AI governance: which agents are running, what each can touch, and who answers for it. Faster patching helps, but it can’t be the whole answer.

AI also cuts the other way. It amplifies familiar risks, and it mitigates them too. The question for a security team is whether it is using AI itself, for reconnaissance and threat hunting, to move at greater speed and scale.

Strong security earns something steadier than a discount. Market conditions, mainly supply and demand, move price more than any single company’s controls can, but good cybersecurity and governance help a business “smooth out some of those ebbs and flows of volatility.”

What CISOs can do differently

The most useful step is also the cheapest: ask. “Do not be afraid to ask your underwriter questions,” Eskins says, about the policy itself and about the market. People on the other side are generally generous with the information they want to provide.

That openness reflects how the relationship has changed. Insurance used to be seen as a drain on the security budget, or, wrongly, as an indictment of the security program. Now, Eskins says, “it’s far more of a game of cooperation and collaboration.”

It also runs both ways. Marsh wants to hear what frustrates CISOs about claims or how a policy needs to evolve, and works on ways of dealing with it. Raising it, instead of absorbing it until the next renewal, is the other half of engagement.

The steps themselves are short: quantify the worst case, decide how much of it the business can carry, and ask the people who price the risk what it would take to cover the rest. None of it needs new spend or new tooling. In an organization without a CISO, the same steps fall to whoever owns the insurance decision.

Asking well takes fluency, and fluency is not evenly spread. Eskins told me CISOs have been great partners, asking lots of questions and wanting to learn. He also acknowledged that clients can find it harder to get educated on this, with products still evolving and a lot to digest, and he called helping them part of Marsh’s job. In my view, that points to a gap. Where a CISO is in the seat, that learning is usually underway. Where one is not, the person signing the policy may never have been taught how underwriters think or what moves a price. At bottom it is a communication gap: security teams and underwriters often describe the same risk in different terms. Training built around cyber insurance is starting to appear to bridge it, aimed at exactly that reader.

Decide before the headline does

Cyber risk will keep making the news, and each incident will keep sending clients to their brokers to ask whether they are covered. Organizations that wait for that moment decide under pressure. Organizations that have already priced their worst day, and asked an underwriter what covering the rest would cost, decide on their own terms.

Cyber insurance may be optional. Knowing what you can afford to lose is not.

Kareena Bavisi, Chief of Staff | EC-Council

Kareena Bavisi is a contributor to CISO MAG covering cybersecurity and AI, writing on how emerging technology is reshaping risk, governance, and the way enterprises defend themselves. Her work draws on conversations with security leaders, insurers, and technologists across the industry to surface the trends shaping the field. She is also Chief of Staff to the CEO and Founder at EC-Council, a global leader in cybersecurity certification and education.

The post Cyber Insurance Is No Longer Optional: In the Age of AI-Driven Threats, Can Your Business Afford the Risk of Being Unprotected? appeared first on CISO MAG | Cyber Security Magazine.

By Kareena Bavisi, Chief of Staff to CEO at EC-Council

I set out to understand why companies still don’t think they’re adequately covered. What I found looks like a pattern the insurance industry has lived through once already: multi-factor authentication went from a nice-to-have to a near-universal underwriting expectation in a matter of years, and insurers that got burned by its absence started pricing around it, denying claims over it, walking away from risks that didn’t have it. AI governance is tracing the same path, earlier, but faster. It isn’t a formal requirement anywhere in the cyber insurance market yet. But the data in this piece says it’s headed there, and the companies that treat it as optional for too long are going to find that out the same way the MFA holdouts did.

Here’s a number that should worry any CISO building an AI governance program right now: 74% of professionals who evaluate, deploy, secure, or govern AI at their organizations believe they could pass an AI compliance audit today. Only 27% describe their governance program as fully mature. That’s according to Schellman’s State of AI Governance Report 2026, a survey of 525 U.S.-based practitioners, and it’s close to an exact echo of a number I’d already been sitting with: in Munich Re’s 2026 Global Cyber Risk and Insurance Survey, 89% of C-level respondents say they don’t consider their company adequately protected against cyberattacks, up from 81% in 2021, 83% in 2022, and 87% in 2024. Two different surveys, two different questions, the same shape: confidence and reality keep drifting apart, and whatever’s being done about it isn’t closing the gap.

Bob Parisi, Head of Cyber Solutions for North America at Munich Re, has spent nearly three decades underwriting cyber risk. I asked him why. His answer wasn’t about a missing product. It was about two groups of people who don’t speak the same language.

A literacy problem, not a product problem

“Dealing with financial risk transfer is not something a CISO deals with every day,” he told me. The reverse is just as true: underwriters are pricing a technical risk they don’t observe directly, working from what a company represents about itself once a year, usually through a broker-scheduled call. “ We typically engage with them once a year when they fill out the application,” he said. Where that changes, he told me, is in companies where the CISO, CFO, and chief privacy officer are already talking to each other internally, those are the ones that end up buying coverage closer to their real exposure.

His own company’s data backs that up. Asked what’s holding back better cyber defense, Munich Re’s survey found the top two answers were both about people, not tools: “low security awareness among employees” (40%) and a lack of skilled personnel (31%), both ahead of budget. The disconnect Parisi described anecdotally is the top-ranked problem in his own company’s data.

That disconnect is what got me thinking about how to close it, and it’s why companies like the Cyber Insurance Academy exist. The talent gap behind it is well documented: insurers report more than 400,000 open positions across lines of coverage, cyber underwriting pay runs well above a typical broker’s, and the shortage persists anyway, because, as Gallagher’s Joey Sylvester has put it, “there are a very limited number of individuals specializing in this class of business” who can keep up with both the insurance market and the cybersecurity industry at once. That’s the same disconnect Munich Re’s own survey flagged as the top two defense challenges: low security awareness and a shortage of skilled people, not budget. Closing it takes skilled people who’ve actually sat through the training, courses like the CCIS, built to give security and insurance professionals enough of each other’s language that the once-a-year application conversation reflects real exposure, instead of two sides talking past each other.

What MFA can tell us about where AI governance is headed

This is where I think the Schellman number matters more than it looks on its own. AI governance right now sits roughly where multi-factor authentication sat two or three years ago, something insurers were starting to care about, but not yet something they’d decline a policy over. That’s changed fast. Brokers who place cyber coverage say MFA has gone from a minor underwriting factor to close to a hard requirement in the span of about two years. Insurers that once quoted risks without MFA, sometimes with a small premium loading, have largely stopped offering that option. Integrity’s Colin Fox says only a handful of insurers will still write a policy without it, describing it as “quite a rarity these days” in comments to Insurance Business UK.

AI, in Parisi’s words, is “first and foremost” in what Munich Re is watching right now. “It takes up a lot of the oxygen in the room in any discussion around cyber risk,” he told me. That’s not a formal policy change, but pricing is where MFA’s history is instructive. The pattern with MFA wasn’t that insurers added a new exclusion, it was that a control quietly moved from a nice-to-have to a baseline expectation, and companies that couldn’t demonstrate it found their options narrowing. Endpoint detection and response looks to be following the same track; brokers describe it as already close to mandatory for companies seeking higher coverage limits.

AI governance looks like it’s on the same curve, just earlier. 71% of C-level respondents in Munich Re’s survey now call AI significantly relevant to their business, up from 62% two years ago, overtaking cloud computing as the most-flagged technology. That’s the kind of inflection point MFA passed through before it hardened into a requirement.

What underwriters are actually scoring

No single AI tool moves the needle on its own. Deploying a specific product doesn’t earn a company a flat discount on premium. What underwriters are actually pricing, Parisi explained, is maturity, whether a company can show it’s using AI deliberately rather than just enthusiastically, and he pointed to three signals in particular.

• Overexuberance. A security team that has rushed to deploy AI everywhere without building the process to manage it first.
• Denial. A company that insists it isn’t using AI at all. Parisi’s read is that it’s there whether leadership acknowledges it or not.
• Disciplined adoption. A company that treats AI as genuinely new, testing it deliberately and rolling it into production only once it’s confident the rollout strengthens the organization rather than exposing it.

“Knowledge is power,” he told me. “Anything that helps a company better understand its risk, and articulate how it’s managing and mitigating that risk, will be viewed very positively by our underwriters.” That kind of structured, documented governance work, something a company can actually point to, is exactly what reads as a green flag to him. AI governance, in particular, is shaping up as its own discipline, distinct from general security literacy, and the organizations building that competency deliberately, rather than picking it up as they go, are the ones standing out.

That same logic, structured proof of risk maturity that underwriters can actually price, is my own case for why EC-Council’s CRAGE certification and its underlying Adopt, Defend and Govern (ADG) framework exist. ADG, developed with input from 23 advisory members across the industry, and CRAGE under it train practitioners to produce exactly the kind of documented risk articulation that reads as a green flag to an underwriter, translating AI governance maturity into terms a cyber insurer can price.

Schellman’s own numbers back this up from a different angle: companies with mature AI governance programs have AI agents running in production at more than three times the rate of companies with developing programs, 78% versus 22%. The gap isn’t just about compliance paperwork. Mature governance correlates with companies that are actually further along in deploying the technology with confidence.

The bottom line

Parisi’s advice from the underwriting side was simple: stop treating the insurer conversation as a compliance form, and start treating it like a board conversation. “Think of the cyber insurers as if you were talking to your board of directors, because that’s really the perspective we’re looking at this from,” he told me. “We don’t want to know which edition of the software you’re using. We want to know you have the right processes and protocols for making sure that software is updated and deployed, and an understanding of what the potential financial loss is if it goes wrong.”

Put the two patterns side by side, and AI governance is not going to stay optional. MFA went from a footnote to a wall in about two years once insurers decided it was a real predictor of loss, and the Schellman numbers suggest the market is already sorting companies into those who can prove maturity and those who can’t. The 89% of executives who don’t feel protected today have a narrowing window to close that gap before it closes on them, and closing it looks a lot like what this piece has been circling the whole way through: literacy on one side of the table, documented maturity on the other.

Kareena Bavisi, Chief of Staff | EC-Council

Kareena Bavisi is a contributor to CISO MAG covering cybersecurity and AI, writing on how emerging technology is reshaping risk, governance, and the way enterprises defend themselves. Her work draws on conversations with security leaders, insurers, and technologists across the industry to surface the trends shaping the field. She is also Chief of Staff to the CEO and Founder at EC-Council, a global leader in cybersecurity certification and education.

The post Why AI Governance Is Becoming Cyber Insurance’s Next MFA appeared first on CISO MAG | Cyber Security Magazine.

Heimdal sysadmin Alex Panait spent weeks testing Claude Cowork inside the company. His verdict was blunt. It felt like onboarding a junior employee with no manager, no scoped access, and no clear accountability when something goes wrong. Except this one can delete your SharePoint. That is the uncomfortable reality behind autonomous AI desktop assistants. They […]

The post Your Next Insider Threat May Be an AI Coworker appeared first on Heimdal Security Blog.

There is a certain kind of conversation that doesn’t get written up in a post-mortem, doesn’t generate a ticket, and never makes it into an end-of-quarter report. It happens on the margins—at a conference, in a hallway, or, in this case, at 30,000 feet above sea level. It’s the conversation where two people who are solving the same problem from opposite ends of the table finally sit down next to each other.

The post Same Problem, Different Angles: When Red Team and Blue Team Actually Talk to Each Other appeared first on Black Hills Information Security, Inc..

Hear a tale about the time the BHIS SOC team conducted a 14-hour overnight incident response... from the Wild West Hackin' Fest conference in Deadwood, South Dakota.

The post When the SOC Goes to Deadwood: A Night to Remember  appeared first on Black Hills Information Security, Inc..

Christmas is the time where we allow our imaginations to run wild, it’s the season of goodwill, high spirits and Christmas joy. However, cybercriminals don’t take holidays. We still have to be on our guard, and question what is real and what is not. Common Holiday Scams Fake Online Stores Around this time of year, […]

The post How to Avoid Holiday Shopping Scams (From a Former Cyber Detective) appeared first on Heimdal Security Blog.

What happens when you ditch the tiered ticket queues and replace them with collaboration, agility, and real-time response? In this interview, Hayden Covington takes us behind the scenes of the BHIS Security Operations Center, which is where analysts don’t escalate tickets, they solve them.

The post Inside the BHIS SOC: A Conversation with Hayden Covington  appeared first on Black Hills Information Security, Inc..

I’ve worked in cybersecurity long enough to see that our biggest challenge isn’t a technical one, it’s motivational. We can build the strongest firewalls, design the smartest detection systems, and run endless awareness campaigns, but none of it matters if people don’t want to care. That’s the uncomfortable truth; cyber security has a motivation problem. […]

The post Cybersecurity Has a Motivation Problem appeared first on Heimdal Security Blog.