The “cyber language” is the first hurdle that many insurance professionals struggle to tackle. But getting comfortable with key cyber insurance terms, phrases, and acronyms is vitally important for any professional wanting to build professional credibility in  the industry. We recently hosted a panel discussion on What To Expect From Cyber Insurance In 2023. Our panelists discussed some technical terminology in regard to trends for this upcoming year. Check them out in our glossary below.

Adversarial underwriting: using the tendencies of attackers to our advantage to predict risk. There is a logic to risk patterns and how cybercriminals are likely to act. Data scientists can use this understanding to accurately quantify and predict risk. 

BEC: Business email compromise is a type of cybercrime where the scammer uses email to trick someone into sending money or divulging confidential company info. The culprit poses as a trusted figure, then asks for a fake bill to be paid or for sensitive data they can use in another scam. It is a subset of phishing: the fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Check out our short video on how Phishing attacks work:

Continuous underwriting: follows the concept that a business should be continuously assessed throughout a whole policy life cycle. 

EDR: This stands for Endpoint Detection & Response. An endpoint device could be, for example, a mobile phone or laptop. EDR technology ensures that each endpoint on a network is secure and free of malicious activity. EDR technology detects, scrutinizes, and restricts any suspicious activity. EDR uses machine learning algorithms to identify patterns indicating threats or suspicious activity in real time and as they unfold. In this way, it is a more powerful descendent of the traditional “antivirus software”; threats that could potentially go undetected by antivirus technology, is much less likely to get past EDR platforms. Get a recording of our EDR Masterclass, powered by Crowdstike, here.

Inside-out assessments: this is an approach to cyber security which is becoming increasingly popular with cyber insurance professionals. It focuses on reducing enterprise risk. Rather than looking first at the threat landscape which is external to a business, an inside-out assessment first looks at the inherent risks in a business and builds out from there. 

MFA: Multi-factor Authentication (MFA) is an authentication method that requires the user to provide two or more verification factors to gain access to a resource. It is a key component of the zero trust framework, on which a growing number of cyber carriers are placing emphasis in assessing the risks they are prepared to cover.

MFA Fatigue: (also known as MFA Bombing or MFA Spamming) is caused by a type of attack strategy where a hacker will repeatedly make authentication requests to the target victim’s email, phone, or registered devices. The goal is to coerce the victim into confirming their identity via notification, thus authenticating the attacker’s attempt at entering their account or device. 

Proactive cyber security: an approach which focuses on what can be done before an attack, rather than how we can respond to incidents such as hacks and data breaches after they occur (which is known as a “reactive cyber security approach”). It deals with prevention rather than just response. It may involve, for example, penetration testing – this is when a business hires ethical hackers to test their existing security defenses. CCIS Graduate and Community Leader, Mercy Komar, recently wrote a guide to proactive cyber insurance. 

Service Accounts: “non-human” accounts (not specific to an individual human user) and are very tricky to authenticate and track. They are widely used and highly privileged (meaning that they have high levels of access to very important business data). Because of this, if a hacker is able to take advantage of a poorly-supervised service account, they are able to cause widespread damage in a very short space of time. Service accounts caused great concern in the cyber underwriting community in 2022. You can read an in-depth guide, complete with specially-designed graphics, to get a better handle on this technical topic. 

Systemic cyber risk: this refers to a single cyber event that impacts multiple insureds. For example, a successful cyberattack on one part of a digital business system could spread like wildfire to other parts of that business system and to other companies operating on it. We just released a full guide to systemic cyber risk (limited copies available for non-Community Members).

The cyber insurance industry is notoriously volatile, and it is unlikely that 2023 will be any different. We are here to make sure that insurance professionals do not get lost in the swell of the cyber storm and to shine a guiding light on the key trends, technologies, and terminology that shape this dynamic and fast-paced sector. Save this glossary somewhere where you can access it throughout this year – it will definitely come in handy.

We are here to make sure you know your work, inside-out. Sign up for our newsletter here for events and other learning opportunities at the Cyber Insurance Academy.