Cyber & Technology Errors: Insuring the Intangible
Faraday's read: cyber insurance spent a decade pretending it was property insurance for computers, and ransomware corrected it violently. The load-bearing distinction is between damage you suffer (first-party) and harm you cause others (third-party) — and the market only matured once it stopped treating a breach like a fire and started treating it like a liability event with a security-controls prerequisite. Today no serious carrier writes cyber without inspecting your controls first. Insurance became an auditor. That is the tell that the risk is real and the pricing finally means something.
Knowledge check
Why did cyber insurers move from writing policies on trust to demanding evidence of specific security controls like multi-factor authentication before binding cover?
Show the answer
Because ransomware turned cyber losses from rare and idiosyncratic into frequent and correlated, and carriers discovered they could not price a risk they could not inspect. Requiring controls such as multi-factor authentication, tested backups, and endpoint detection does two things at once: it lowers the probability of a claim, and it lets the underwriter distinguish a good risk from a bad one. Insurance became a de facto security auditor because writing blind was no longer survivable.