Security and Insurance, Sold Together

Sidd Gavirneni is CEO and co-founder of Zeguro, a San Francisco company combining cyber security and cyber insurance for small and mid-sized businesses. Its Cyber Safety solution unites risk assessment, mitigation and insurance. The conversation was recorded on a Friday in the middle of the 2020 election season, which Sidd noted didn’t feel any different from every other day of the pandemic.

About Sidd Gavirneni

Sidd Gavirneni has about 20 years in cyber security, starting as a software engineer, then leaving to get an MBA and working as a product and security consultant for companies like Symantec and McAfee, and later at Polycom. He co-founded Zeguro a little over three years before this recording.

Why Security and Insurance Belong Together

Which comes first, security or insurance? It depends on the customer, Sidd said. By small businesses he means companies with under about $100 million in revenue, whose main focus is revenue, so the drivers for cyber insurance and security are usually regulation or large enterprise customers requiring them to be secure and insured before signing a contract. Customers come in for one and end up with both.

He made a pointed observation about connected insurance: everyone talks about devices in cars feeding driving behavior into premiums, but cyber, which should by definition be the most connected form of insurance, rarely gets mentioned.

What Cyber Insurance Covers

Cyber insurance is about 15 years old, a baby in the insurance world, and most small businesses don’t know what it does. Sidd said it covers almost anything related to a breach: ransomware and extortion (helping recover data or paying a ransom), legal costs for lost data, public relations to repair reputation, lawyers for suits by employees and customers, lost revenue and operating expenses during downtime. An employee tweeting something damaging is more of an errors and omissions issue than cyber. For large enterprises like Sony, Equifax or Target, he noted, there is plenty of cash to absorb a breach on top of insurance, but not so for small businesses: Sidd said 69 percent of SMBs had a breach last year, at an average cost of about $3.6 million, which is why he thinks cyber should be a standard part of any business insurance program.

Brokers and the Education Gap

Most cyber insurance is sold through brokers, and some understand it and some don’t. Sidd noted that even a CTO isn’t a security professional, so you can’t expect a broker with 20 years in insurance to know the ins and outs, and the goal must be to make cyber security and insurance approachable for brokers and their customers. Gilad’s take on the future of agents is that advice is their value: anything simple to underwrite will move online. Sidd agreed and noted that surveys show insureds want insurers to help with risk management, which is also in insurers’ interest, since it lowers claims and loss ratios.

What Zeguro’s Platform Does

Zeguro serves businesses with an online presence or using cloud platforms: B2B startups, healthcare (medical and dental offices and companies serving them), and real estate brokerages with plenty of financial data. Most don’t do anything about cyber security because they don’t know what to do and don’t want to pay $400 an hour for a consultant. Zeguro’s self-service SaaS platform brings the consultant’s role in:

• IT security policies and best-practice recommendations that businesses can customize and maintain, which also form an audit trail for PCI or HIPAA audits.
• Employee training that adapts to each person’s security knowledge, so everyone gets a different training each month and the most critical risks come first, rather than the same cookie-cutter session.
• A pricing link between insurance and security: once customers take actions in the platform, their premiums can fall.

So far, Sidd said, Zeguro has had no claims, which has kept loss ratios at zero. Most customers who come for insurance also use the security platform, which reduces risk.

The Structure: A Program Administrator

Zeguro’s pen and paper is Hartford Steam Boiler (HSB), part of Munich Re. HSB lets Zeguro adjust premiums based on a business’s security profile, and handles claims directly, with the bandwidth and panel to do it. Zeguro acts as the program administrator, handling distribution and the heavy lifting. Sidd said Zeguro was the first cyber insurance startup, launched its insurance product about two years earlier and its security product about a year earlier. It sells directly to customers and shows up first in Google for cyber insurance; it doesn’t sell through agents today.

Why He Left the Enterprise

At his last job, Sidd sat on the information security board of a large public company that suffered a typical phishing attack and a data breach, and dealing with cyber insurance was painful. If a company that size struggled, smaller businesses had no idea what to do. He had wanted to start something for a while, and this was the right problem. He credited the team, including a head of insurance with about 35 years in the industry, for the rapid early traction, and said everyone has been together since day one.

What’s Next

Sidd hinted at press releases and a key partnership to be announced the following week. On whether cyber could follow the MGA-to-carrier path that Hippo took, he said yes, likely: cyber was growing about 27 percent a year, SMB adoption is still low, and awareness, regulatory and contractual requirements are all rising.

Advice: Succession and a Nature Show

Sidd recommended Succession on HBO, which he finds interesting because it’s about business, and a nature show on Apple TV+ about small animals. Beyond that, his pandemic projects are home improvement, with painting the house next, and he leaves the sourdough baking to his team.

Key Takeaways

• Zeguro sells cyber security and cyber insurance together to businesses under about $100 million in revenue, with customers entering through either door.
• Sidd cites 69 percent of SMBs having a breach in a year and an average cost of about $3.6 million.
• The platform brings a security consultant’s role into self-service: customizable policies, audit trails and training tailored to each employee.
• Paper is provided by Hartford Steam Boiler (Munich Re), which handles claims, while Zeguro acts as program administrator and sells direct.
• Zeguro reports no claims to date, and links premiums to the security actions customers take.
• Cyber, Sidd argues, should be the archetype of connected insurance, and he sees it growing about 27 percent a year.