Transcript for "Cyber Liability Recording":
Welcome, everyone, to today's webinar event, cyber liability essentials, protect your business from growing threats. Today's webinar is presented by Paychex and AMTrust Financial. One of the big questions you face as a business owner is whether you'll be ready if and when a cyber attack happens to your business. While traditional insurance may seem like enough, it can leave critical gaps in coverage. So today, what we're going to talk about is whether your business needs cyber liability insurance, what it does and doesn't cover, and what to look for when choosing the right policy so you can prepare and protect your business from the costs of a cyberattack. So first, I want to get into some quick housekeeping info. At the right side of your console, you'll find the docs column. And there'll be a wealth of related resources, including a printable copy of the slide deck. You'll also find links to online articles, website pages, an infographic with some unique details, and downloadable info sheets as well. Now if any point during the presentation you'd like to discuss the unique needs of your business with one of our Paychex experts, there's a button at the upper right of the console says to talk with our team. Just go ahead and click with that to request a free consultation. And then finally, I would like to note that this presentation does not constitute legal advice. It's for informational purposes only. And now I'd like to introduce our speakers for today. First, I have Alana Alaimo. She's a district sales manager with the Paychex Insurance Agency, bringing nearly seven years of experience supporting small businesses. Now she specializes in helping clients find the right insurance solutions to protect their people, their operations, and their long term growth. Known for her client first approach, Alana provides thoughtful guidance and build strong trusted relationships with the businesses that she serves. From AMTrust Financial, we have Evan Morris, vice president and head of cyber wordings, where he focuses on cyber policy wordings and coverage analysis. Now Evan works closely with underwriting, claims, and broker partners to evaluate coverage requests and align policy terms with client needs. Prior to joining AMTrust Financial, Evan was a cyber insurance broker, serving as a subject matter expert and key relationship contact for his clients. So for the next thirty minutes, we're gonna introduce you to cyber liability insurance and give you the information you need to help decide whether it's something your business can use to reduce the potential costs of a cyber attack. We'll also get into the specifics of what it is or what is and what is not covered by cyber liability policy and the things to look for to help you select the right policy for your business needs. So first off, I want to define what cyber liability insurance really is. So Evan, I want to hand this one off to you to take us through what exactly is cyber liability insurance. Yeah. Thanks, Robert. So what is cyber insurance? Cyber insurance or sometimes called cyber liability insurance is a type of insurance that transfers a policyholder's a company's financial liability for cyber incidents. Right? Just like you would buy a property policy for your property or auto for your vehicles, you can buy cyber for your company's cyber, cyber exposures. So what is a cyber incident? What does that look like? First, there could be a security breach. Right? A bad actor breaching into your computer systems, without authorized access and and and causing trouble. While they're in there, they could get a hold of sensitive data and cause a privacy breach or a data breach. They can get your client's data, your business partner's data. Many times when that happens, when a an unauthorized user gets access to that data, there are certain laws and regulations that can be violated or that someone may have an obligation under, whether it's noticing the appropriate parties or or the the government that enacted those laws. Also, if a bad actor has access to your systems, they can cause a disruption to your business. If your systems go down, you may not be able to operate that day or that week or until you can get yourself back up and running. Many people are familiar with the, you know, the the scenario. They've heard of it, seen it on TV where you go into your office and all of the computers have a a red screen in the skull and crossbones because a bad actor has ransomware ed you, and they are saying, you know, you cannot have access to your systems until you pay us a large sum of money. Or, potentially, the most frequent scenario is social engineering. Someone calls you. They call your finance department or whoever's, you know, maybe in charge of shipping goods, and they say, hey. I'm so and so. I'm the CEO. I'm someone that you know. I'm your friend. I need you to do this. And you do that thing, and now you've suffered financial harm. Right? You've sent money to someone that you shouldn't. So a cyber incident can be very broad. It can encompass a lot of different scenarios, and a cyber security policy can contemplate those scenarios. And so, unfortunately, Evan, this is stuff I've seen and and encountered, with business friends of mine and with personal friends. My mom, in fact, just had some weird emails come through, looking for personal information. I told her, do not provide that, please. Alana, maybe you could tell us what you're seeing across the market in terms of cyberattacks. Yeah. Absolutely. So cyber attacks, they're accelerating very quickly. Back in 2019, about sixty four percent of small businesses had experienced an attack. Today, that number is up to ninety four percent. So it is rapidly increasing. So this isn't a fringe risk anymore. It's nearly universal. Every single business is a target, which means the conversation just can't be about prevention at this point. It has to be about preparedness. How you respond, recover, protect, when the business has a financial, or an incident happens. That's really where cyber liability becomes critical. It's a key part of managing what is now an expected risk. I love that phrase, Alana, expected risk. We we have. them at all aspects of the business, and now it occurs here. So, Evan, maybe you can tell us more about what cyber insurance actually covers. Yeah. So something I like to say is, you know, having cyber insurance can be like having some of the top law firms, forensics firms, and other service providers on retainer. Right? A lot of companies don't have these entities on retainer. And if something were to happen, they may now have the resources to take care of it. A cyber insurance policy can give you access to those top third party vendors to help respond when something goes wrong. The law firms, right, they can help you respond to your legal obligations should you have a data breach, and there are laws that are governing that data that you lost. The forensics firms can come in and help you determine what happened, when it happened, how it happened, and what you can do to either prevent it from happening or to, you know, mitigate the the ongoing scenario. A cyber policy can also include the cost to recover that data, whether you need to recreate or, you know, restore data that was lost, if you need to restore systems, if your computer systems have been bricked, so to speak, is the term. Right? Something has happened, and now your systems are no longer functional. Further in that ransomware scenario, right, with the skull and crossbones, it can bring in ransomware experts to help negotiate with that bad actor, and even provide assistance in the payment of a ransom, should that be the route you want to take. And then lastly, with the social engineering example, should you suffer a financial harm because of a covered social engineering claim, it can contemplate the actual funds that you lost as well. Boy, my gosh. There is so many layers of risk there, Evan. Alana, maybe you can tell us why cyber liability coverage matters. Yeah. When we talk about cyber risk, it's definitely easy to think this is something that only happens to large businesses. But the data tells a very different story. Over 40% of cyber attacks are actually targeting small businesses, and nearly one in three experiences an incident every single year. And perhaps the most important, over 80% of these attacks start with something very simple, an email. Not some sophisticated hack, but a single click. So the takeaway here is that no business is too small or too insignificant to be a target. These threats are common. They're frequent and often start with everyday activity. That's why cyber liability coverage is so important. It's not just about preventing these attacks. It's about having financial protection and support in place to respond and recover when an incident does occur. So, Alana, I I imagine, if we were to take a poll on how prepared businesses in the audience might believe they are, I think most would say somewhat prepared. But is it fair to say that even a well resourced business could have gaps? I'm curious, you know, just. what are some of the things you see out there? What are some of the everyday practical ways those cyber risks can show up? Yeah. I mean, we've mentioned it a bunch already too, but, but if you see on the left over here, a point sale breach, something as simple as malware on a payment system can expose customer data, trigger something significant in cost, and this can come from an investigation and legal obligations as well. In the middle, we have a media liability claim. This is one that often surprises people. Even a social media post or marketing campaign can create risk if there's a claim of copyright or content misuse. And on the right, we have business email compromise, one of the most common and costly attacks today. We see this almost every day. We get calls in from clients needing this because they've experienced an attack of this nature. A single convincing email can lead to a real financial loss in minutes. So really the key takeaway is that cyber risk isn't just technical, it impacts operations, finances, reputation. And that's where cyber liability protection plays a critical role, helping cover the financial impact, when these real world scenarios do happen. Thank you. That's that's really helpful, Alana. I'm starting to see there's a lot of layers to this this whole arena. So, Evan, maybe you can explain some of the the very specific needs, for cyber insurance and how it can help out, with all these different things that can happen. Yeah. So as you said, some companies may think that they're prepared for something like this to happen. But on the flip side, some may think that they don't need to be be prepared. Right? They may not think that they need cyber insurance. I'm a I'm I'm a small business. Why would anyone come after me? Right? And while that might seem like a reasonable first assumption, the reality is that security by obscurity doesn't exist in cyber. Bad actors will go after anyone that they can get their hands on of any size in any business sector. And throughout all sizes and sectors and industries, almost all companies, deal in third party data, client data, business vendor data, and what have you. So, another assumption or phrase that we'll hear is that, you know, I'm I I'm not I'm not doing anything with this. I outsource this to somebody else. Right? I use x, y, and z vendor to handle my data, so that's that's on them if something happens. But, you know, you can you can outsource the the function of doing something, but you can't outsource that liability. Even though someone else may be doing something for you, that data is still your responsibility, whether that's, you know, like I said, customer data, PII, personally, personal information, like names, phone numbers, addresses, depending on your industry. It could be medical information, employee information. Beyond just the data and what business they're holding, there's also the resources that we talked about. Not every company can have the top vendors on on retainer in case something happens. There's, you know, for and this is companies of all sizes. You could be, you know, the biggest company in the world and still have budgetary restrictions. Right? You may not be able to allot the funds that you need to certain things. There can be staffing needs. You may have an IT or a cybersecurity department, but maybe, it's it's a smaller department, and they don't have the hands to do everything that you might need. Subject matter experts. Right? Even if you have the people, they may not have the very niche, expertise that you need to respond to an event. An often overlooked aspect too is reputation. You know, you may not have a ton of data to be stolen or for someone to have access to. If your systems go down, it may you know, it it will impact you regardless of who you are, but you're you're focused more on the finances there. Right? But something a lot of people aren't focused on is your reputation. If something happens to you and that gets out into the public, your customers may lose faith in your business. They may not wanna do business with you anymore and go elsewhere. So having a cyber policy to remediate and mitigate those events and get you back online quicker, can really save your reputation as well. So, you know, no matter who you are, there there is that need whether you think or realize there may be or not. And it's always important to, you know, remain vigilant and make sure that you're taking that step to keep you and your your customers and clients protected. And here are a couple examples, that kind of show that. So just because you're a small business and maybe you don't think any anyone will come after you, that doesn't mean that you can't be impacted by a cyber incident. There have been a couple high profile ones just over the last year that even though a specific, you know, company didn't get hit themselves, they were still impacted through a broader attack. Some of the ones on the screen here. Right? There was very recently a an attack against a learning management system that was utilized by a bunch of educational institutions. Many of those educational institutions utilizing this program were impacted, but that program had access to their data, and they used it. So this one attack spread to thousands of insureds. There's another disruption last summer or maybe two summers now where there was a very popular managed security provider, and their programs got hit. And this is a program used by millions of systems. Right? It wasn't agnostic to any business sector or any size. Companies all over the world were utilizing the software that went down, and now they were all impacted. And even, again, over the last year, there was a a dealer, an auto dealer management system that got hit. And so while individual auto dealers weren't the target of the attack, they were all impacted if they were using the system. So even though you may not be the target, that doesn't that doesn't protect you from any potential disruption or loss. Man, there's a lot of risk, a lot of exposure. So so okay. Let's shift from all the things that could happen to what you actually do when it does happen. Because in that moment, the biggest question is now what? What what do I do? So, Alana, what should you do? Yeah. In this case, the most important thing is speed. You don't want to wait, investigate on your own, or second guess whether it's serious enough. The right move is to report it immediately, 247, even if you're not completely sure what you're seeing. That's where cyber insurance really shows its value. You're not handling this alone. You're getting access to experts who can quickly assess the situation, guide next stop stops, and help contain the issue before it unfortunately escalates. The faster you engage, your carrier, the faster you can minimize damage, and control those costs and get back to business because that's what matters. Right? And in a cyber event, that time it can make really all the difference. And so how does it work you may ask? Basically the key takeaway here, small practical steps reduce the risk, pairing that with cyber liability and protection so that if an incident does occur, it doesn't become a business ending event. And it sounds like I'd love that fast call to get access to these experts. I mean, that to me feels like a real valuable component, of this cyber coverage. But, you know, I'm wondering, how do you even how does someone go about getting cyber coverage? It can't be as easy as getting my car insured, can it? It is actually pretty easy. Basically, what we would do is we would get the the paperwork over to the client. When we get the paperwork over, it's actually pretty simple at that point. We sign the service agreement, and then we get this over to our new business team. Once our new business team does process this, the data is loaded and it sent right over to the carrier. The policy is activated. It's effective the first of the following month, and the client will then have access to our paycheck side of the portal as well as the carrier side of the portal as well. So it's a very quick and easy process, very user friendly on the back end. And if they ever need any other servicing or requests for a certificate of that nature, we're good to help. So Yeah. So, Evan Morris, Esq., Right. maybe yep. you. you ahead. I'm sorry. Didn't mean to jump on you there. no. I was gonna say you may be thinking, right, why why AMTrust Financial? You you you you know Paychex. Why is AMTrust Financial here? You know, why why did Paychex choose to partner with them? Well, Paychex and AMTrust Financial have been partners for for many, many years outside of cyber insurance, other lines of business, and we've been partners for a long time. The reason that Paychex chose to come to AMTrust Financial for this cyber product was because of our flexibility, our responsiveness, and our customer service. AMTrust Financial is always willing to work with our broker partners and our insureds. We can have, you know, real people available to assist in the process whenever needed, and we pride ourselves in our responsiveness. And then we're happy to approach an insured's needs in an individual manner. Right? You're not talking to a robot or getting sent to to a an unmonitored email inbox. The links here on the on the screen, the AMTrust Financial cyber $2.50 and 1 mil buttons there, you can click on those to learn more about the individual products. And then if you have any other questions, right, please reach out to your to your Paychex representative. Yeah. That's that's perfect. And and to do that and before I've got some questions, prepared for you both. I do wanna mention if you do want to explore these cyber offerings with a member of our Paychex team, just click that talk with our team button there on the upper right, and they'll get you set up. It really is a customized solution really meant to fit your business. So I I encourage you to talk to an expert, if this sounds actually sounds interesting to me interesting at all to you. So now let's open it up some some questions I had. And the first and I know Evan talked in this about this a little bit, Alana, but, you know, for you, you deal with our small business customers. You you understand that market. Do they really need cyber insurance? Yes. Everybody needs cyber insurance. No matter how big, small the business is, everyone is subject to an attack. I think a story that sticks with me, we have, one of our partners at Paychex. They were explaining that their, sister, she owns a small business, and she unfortunately experienced a cyber attack herself. It nearly took her business out. And that was something then she said, you know, I should have been more prepared in that case and have the cyber insurance, and she did not. Did it prompt her to get the insurance after? Absolutely. But truly, that just goes to show this can affect any business. No no matter the size, you know, especially that small business, it can really affect them. Yeah. It's it's it's tough. And I I could imagine small businesses operate on a much tighter margin and don't have the. room for those kind of surprise hits. Absolutely. I have a question for you. I'm gonna go back to the car insurance analogy. I have two daughters. We had to insure them. We also put them through safe driving classes because we wanted to prevent the accident. We wanted didn't wanna get we didn't wanna have to use it. So so I'm curious if you have any advice to our listeners on what are the things they can do to protect their data, even if they have the cyber insurance product. Yeah. No. That that's a great question. There are a lot of really simple steps in cyber that can go a long way to help prevent an incident from occurring. One is don't give info. Don't give sensitive info over the phone or just someone that you may not know or if you don't know who they are. You always wanna confirm who you're talking to. You may think that you're talking to someone that you know, but it's always good to verify that with known information, whether it's calling them back on you know, calling their their known good phone number that you have or sending them an email to the email and file that you know is a trusted, verifiable email. Maintaining strong passwords. Everyone, I probably hears this every day or every week nowadays is making sure that your passwords are strong, and to use different passwords. Right? Everyone knows the analogy of writing it down on a sticky note, and then it blows away in the wind somewhere. And if you're anything like me, you might get annoyed sometimes at some of the lengthy password requirements that many, many, you know, systems accounts require nowadays. But those requirements are implemented for a reason. You know, just something as simple as extending the password a couple characters or adding in special characters like an exclamation point or what have you, can make it a lot harder for a bad actor to crack your password or to guess your password, into into accounts. Along with with number one, right, and not giving sensitive info to people over the phone or email that you're not sure who they are or if you're not a 100% sure that you're talking to who you think you are, is always confirm where you're sending money. You could get an email that is purporting to be a vendor saying, hey. Please please send, you know, payment for this invoice here. It's it's really easy to to let something like that slip. You always wanna make sure that any bank account or ACH changes are verified with, you know, the correct person, the correct third party. And, yeah, again, use those secondary means to to really be buttoned up with who you're talking to. And four, if you see something, say something. It might be easy to see something, you know, look slightly amiss and just chalk it up as, you know, another Monday, and you just go about your day. But if something looks wrong, something could be wrong, and it's better to be safe than sorry. You know, it takes two seconds to report something to the appropriate party, your IT, your outsource vendor, or whoever. And taking that, those two seconds to report something could save you, from having a very large cyber cyber incident. That's a that's a great point. Two seconds. And sometimes it could even just take two seconds to do something, click a link, do something wrong that's gonna get you into some serious. trouble. So, Alana, I'm curious. This is obviously a complex issue, and there's a lot going on. What are some things that our cyber liability insurance covers, that most businesses aren't aware of or don't realize or aren't thinking about? Yeah. And I I think Evan did touch on this a couple times, but this is something that we actually see almost daily. But we have plenty of payroll specialists connect with us and let us know that, unfortunately, their their client clicked a link via email, thought it was their employee, but it was actually a hacker pretending to be their employee, requesting money, changing a direct deposit, that unfortunately was not their employee, and then they're not covered. And going back to the preparedness, you know, you gotta have the cyber liability in place. You have to have it in place in order to help you against these events that do happen. And it's common. It happens daily. This is something that we see all the time, really, like we said, to any size business. So yeah. That's great. Well, not great. That's that's tough, but it's good that there there. is something available to help us out. So so, Evan, I got one last question because we talked about different size businesses, different kinds of things that can happen, different kinds of liability. How do I know if I have the right coverage, the right amount of coverage? How do we how do you assess that, and how do you put together the right policy for someone? So work with your broker. Right? You you trust the mechanic with your car. You trust your landscaper with your garden. Right? You wanna trust the insurance experts with your insurance. So you always wanna work with your broker. Every company is different, but the insurance experts are the ones who are in the weeds every day, seeing what other companies are buying, seeing what claims they're getting hit with, and seeing how the policies are responding to those events. There are, you know, a lot of metrics or calculators out there that you can use to try and determine how much a company should buy, but those are those don't see the whole picture. Right? They aren't a person. They aren't a business owner. They aren't are a broker working with many, many different businesses. So you should always work with your broker and and, you know, use the experts that you have to make sure that you're buying the correct cyber policy. But at the end of the day, it's better to have a cyber policy than not. That's great. And and and I love that point about working with the expert. It's Everybody's needs are so specialized. That's a really big part of the whole Paychex service model is to just deliver what you need, what's right sized for your business. So for everybody, I want to thank you for joining us today for Cyber Liability Essentials. Evan, Alana, thank you for joining us. It was great learning just all about this topic. And, of course, if you would like to talk to an expert to see what what it would look like for your business, go ahead and click the talk with our team button, and we'll get you a free consultation and investigate this, trust this AMTrust cyber liability insurance option and how it might make sense for you. As a reminder, you can access a printable copy of the presentation deck in the docs column on your console, along with all those other great related sources. We'll also be sending all the registrants with a follow-up email link to the on demand recording within one business day so you can share that out with people who you think might find this useful as well. So thank you again. I really appreciate you taking the time, and I hope you have a great day.