Prevent the Breach, Not Just Pay for It

Avi Bartov is CEO and co-founder of GamaSec, which provides pre-breach services helping commercial lines brokers and carriers manage cyber risk and educate their policyholders. He served as an officer in the Israeli army and then spent more than two decades in cybersecurity, consulting across Europe and Israel, before moving about five years earlier from consulting to building his own software-as-a-service product.

About Avi Bartov

Avi Bartov is co-founder and CEO of GamaSec, a cybersecurity company whose “virtual hacker” technology is integrated into cyber insurance policies to reduce and prevent exposure for policyholders and insurers.

Cyber Security 101

Avi laid out the logic of an attack: you need a weakness, a hacker to exploit it, and access to it. If a security company can detect and close the weakness before a hacker reaches it, there is no attack. The main attacks today are ransomware and phishing, plus things like SQL injection and cross-site scripting found on a company’s website. He said more than 52 percent of cyber attacks on small businesses go through the company website.

The effects fall into three groups: reputational damage (no business wants to be on the front page for being hacked), encrypted data held for ransom, and a smaller share, about 10 percent in his estimate, driven by espionage or activism, sometimes government-backed. He said roughly 80 to 85 percent of hackers act for money, often as criminal organizations that employ hackers, and 15 to 20 percent for activism or political reasons. More than 64 percent of attacks, he said, target small and medium-sized businesses, not because they are famous but because they lack IT security departments, personnel and budget.

Why Cyber Insurers Need a Pre-Breach Layer

Avi traced the history: until about five years earlier, cyber insurance was aimed at large organizations, and insurers then moved down to SMBs but found their products and data inadequate. Cyber risk changes quickly and is hard to forecast, so insurers need a way not to predict the risk but to prevent and minimize it. It also gives them a competitive advantage by adding a service next to the policy; today most services are post-breach (lawyers, forensics), and GamaSec is the pre-breach counterpart.

He named partners: carriers and brokers in the UK and Europe, Zurich in Canada (working with the broker BFL), a French broker, Lombard Insurance in South Africa and Tata AIG in India. Zurich in Canada, he said, gives a 10 percent discount on the premium in recognition of the value of the solution in reducing its risk. Gilad linked this to leak detectors in property insurance, where carriers also act to prevent losses they would otherwise pay in full.

Education and Reports That People Can Read

Because ransomware and phishing are hard for small businesses to block with tools, GamaSec added a training and awareness service into the package, with regular video training and quizzes for employees of policyholders, offered as part of the insurance cover at no charge to the customer. Gilad agreed that most vulnerabilities come from human error, and that people tend to click through training.

On reports, Avi said his 20 years of consulting taught him there are two readers, management and IT, so each report is split in two. The executive summary is two visual pages explaining the risks, their consequences and what to do. The second part gives technical detail on each vulnerability: where it was found, the consequences and the recommendation.

Intelligence for Underwriters

For insurers, GamaSec adds portfolio-level data: how many customers in each industry have high or medium vulnerability, who closes vulnerabilities quickly, who ignores them, and who completes training. Because cyber insurers don’t have decades of data, this gives the underwriting department more information to classify risk and set premium.

Advice: Two Novels

Avi recommended two books. One is Dan Brown’s Origin, which he found amusingly similar to the pandemic, about a virus created to reduce the world’s population. The other is a German-language spy novel about a British and German agent in World War II that includes recipes, which he described as espionage combined with a cooking book. Avi can be reached by email at the company, GamaSec.

Key Takeaways

• GamaSec offers a pre-breach “virtual hacker” that finds and helps close weaknesses before attackers exploit them, integrated into cyber policies.
• According to Avi, more than half of SMB attacks go through the company website, and most attacks target small businesses, which lack budgets and IT staff.
• Zurich in Canada gives a 10 percent premium discount for policyholders using the service, a sign that carriers value prevention.
• Anti-phishing and ransomware training for employees is part of the package, because most weaknesses come from human error.
• Reports are written for two audiences: a two-page visual summary for management and technical detail for IT.
• Portfolio-level vulnerability and remediation data helps underwriters price and classify cyber risk.