Cancer is the leading cause of death among life insurance policyholders. In recent years, we have seen an explosion of groundbreaking advances in cancer research that are changing the way that cancers are defined, prevented, diagnosed, and treated. These advances are expected to drive significant improvements in cancer mortality, even beyond what we have seen in the past few decades. 

The profound and swift evolution of cancer knowledge will have far-reaching implications for various facets of life and living benefits insurance products, underscoring the need for insurers to remain vigilant and adapt to this shifting landscape.

Improving Cancer Outcomes is one of the five critical topics featured in Munich Re’s 2025 Life Science Report, a wide-ranging thought leadership project intended to help life insurers better understand and navigate prevalent emerging medical trends and risks.

Key Insights:

• Prevention efforts will leverage the power of AI to integrate and analyze vast amounts of biometric, genetic, and imaging data and improve cancer risk prediction. Insurers will need to monitor this to anticipate potential anti-selection behavior.
• Diagnostic advances will also be fueled by the power of AI and the acceleration of earlier cancer detection by molecular/genetic analysis of bodily fluids (‘liquid biopsy’). Potential changes in how cancers are classified will require the modification of insurance product definitions.
• Therapies will continue to progress into more and more personalized treatment, further enhanced by tumor genetic analysis with targeted drug development and immunotherapies, such as personalized cancer vaccines. Much of this, however, will come at a high financial price, which could significantly impact health insurance costs and limit access in some markets.

Visit our Life Science Report page for more information and to access additional chapters as they are published, including AI in Healthcare (available now), Prevention (February 18), Obesity (March 4), and Climate Change (March 18). 

What does it take today to stand out in today's crowded property and casualty insurance landscape? The property and casualty (P&C) insurance landscape is always changing, and rarely do you find a time such as now where changes are happening more rapidly than ever. Recent industry data suggests that global insurance premiums are expected to continue to increase over the next five years. This trend is driven by increasingly severe weather events, economic uncertainty and inflation, creating pressures that brokers must navigate, with clients looking for brokers not only to secure policies but also to provide consultative support in managing risk.

With these dynamics in play, brokers have an opportunity to stand out by taking on a more modern, strategic advisory role — offering solutions that extend beyond traditional carriers. 

Let's look at the challenges P&C brokers encounter, the broad solutions available and how they can meet client needs by building long-term, resilient partnerships.

Managing Volatile Premiums in Hard Markets

In hard markets, clients often face significant premium increases and limited capacity, making it challenging to maintain affordable coverage. In fact, in 2023, the average commercial property insurance premium rose by over 20%, and some sectors — like real estate and manufacturing — saw even sharper spikes. Rising premiums coupled with restricted options can strain clients' budgets, requiring brokers to find alternative ways to stabilize costs. Chasing rates, increasing deductibles and reducing total insured value should not be the only options.

One solution is structured and customized insurance programs, which can help level out premiums over time and smooth the impact of market cycles. Brokers might also suggest exploring alternative risk retention strategies that allow clients to focus on specific, essential coverages tailored to their unique needs. These targeted approaches allow clients to stabilize costs without sacrificing coverage, fostering trust and demonstrating the broker's commitment to client needs and reducing attrition.

See also: Does the P&C Insurance Cycle No Longer Exist?

Meeting Demand for Specialized or Hard-to-Find Coverage

With emerging risks and niche markets on the rise, brokers are increasingly tasked with finding customized coverage solutions. According to a recent survey, 70% of executives report that they need more specialized insurance to address the unique risks of their industry, particularly in areas like cybersecurity, construction and health care.

To meet this growing need, brokers can help clients implement self-insured retention (SIR) programs, where businesses set aside funds for certain types of predictable losses while insuring more catastrophic risks in the traditional market. For industries facing complex or niche risks, bundling multiple specialized coverages into one policy can simplify protection while addressing specific exposures. These solutions allow clients to manage unique risks, helping brokers address specialized demands and enhance client satisfaction.

Improving Client Control Over Claims Management

Claims management can significantly affect the client experience, and a lack of transparency or delayed handling can cause friction. A report from Accenture highlights that dissatisfaction with claims handling can drive policyholders to switch providers, with around 74% of dissatisfied customers indicating they either changed providers or are considering it. For brokers, guiding clients toward more transparent and efficient claims management is essential in maintaining strong relationships.

Brokers can advocate for using third-party administrators (TPAs) that offer more tailored, efficient claims management services. TPAs give clients greater visibility and control over the claims process, creating a more proactive and aligned experience. Furthermore, brokers can encourage clients to implement safety and risk management programs, which can reduce claims frequency and improve outcomes. By helping clients take control of their claims, brokers position themselves as essential advocates in achieving smoother claims handling and better client experiences.

Enhancing Client Risk Management Practices

Effective risk management is not only a strategic priority for clients — it directly affects their insurance costs, claims experience and overall profitability. For example, industries with significant physical risks, like construction and manufacturing, can see substantial benefits from implementing comprehensive safety programs. According to the U.S. Bureau of Labor Statistics, businesses with strong safety programs can significantly reduce workplace injuries, which leads to fewer workers' compensation and liability claims. Over time, this can improve clients' claims histories and lead to more favorable premium rates.

By guiding clients to adopt robust risk management strategies, such as safety training and real-time monitoring technology, brokers help stabilize clients' insurance costs, making them less vulnerable to market fluctuations and claims-driven premium hikes.

Innovative Risk Financing Options: Adding Captive Insurance to the Toolkit

For clients who face unique or complex risks, alternative risk financing options such as captive insurance can offer significant advantages. While not suitable for every client, captives allow businesses to retain and manage risk more effectively, with benefits such as greater premium stability and customized coverage. According to industry data, nearly every Fortune 500 company now uses captive insurance for some portion of their risk management program, with captive formations growing among small and midsize businesses, underscoring its value in stabilizing volatile premiums and addressing niche risks.

A captive can be particularly beneficial for businesses with frequent, high-volume claims or those seeking customized coverage outside traditional markets. For example, a construction firm dealing with regular but predictable liability claims might use a captive to manage these costs more efficiently, while still maintaining traditional coverage for catastrophic events. Brokers who offer captives as one of several advanced risk financing strategies provide clients with greater control and flexibility.

See also: P&C Trends Point to Transformative 2025

Building a Strategic, Long-Term Partnership with Clients

Success in the evolving insurance landscape requires brokers to go beyond one-off policy placements and build enduring relationships with clients. By acting as strategic advisers, brokers can help clients not only manage immediate risks but also achieve long-term stability. Clients who view their brokers as invested partners are more likely to remain engaged and receptive to future recommendations.

In this regard, captives are one of many solutions brokers can suggest as part of a comprehensive, client-centered approach. By emphasizing risk management practices, transparent claims handling and strategic solutions tailored to individual needs, brokers foster trust and loyalty — key components of lasting partnerships.

Future-Proofing With a Diverse Set of Solutions

The challenges and opportunities in the P&C industry continue to grow, and brokers who build a versatile, innovative toolkit will be best positioned to meet evolving client needs. From structured programs and TPAs to specialized coverages and captives, today's brokers have a wide array of strategies at their disposal. By focusing on education, strategic advising and client-specific solutions, brokers can build resilient relationships, creating value and positioning themselves as trusted advisers for the long term.

In a market where client demands and risks are constantly shifting, brokers who prioritize a consultative approach and embrace diverse, customized solutions will be the ones who lead — helping their clients navigate the future of risk with confidence.

Capitalizing on a data-driven future is fundamental to reclaiming insurance's rightful place as the backbone of societal resilience and progress.

The future of insurance hinges on relationships. These relationships extend between people, their possessions, health, future, present, companies, families and ability to thrive in the face of losses.

It's a complex web that insurers must navigate. It extends beyond customers to include ecosystems - comprising both in-house innovations and integrated partner solutions - their staff, and adaptive business models and pricing that all interact simultaneously. At the core of this relational network lies data, the foundation upon which insurers must build sustainable, adaptive enterprises.

For example, if insurers hope to adopt AI as a foundational tool for delivering smarter, more adaptive customer experiences, the business and supporting technology model will need to change substantially. Harnessing multi-agent AI and applying it responsibly and securely across operations requires a robust data model. One that centers data on the customer and the dynamic world they inhabit, processes it in a fluid, near real-time manner and then integrates the resulting insights into personalized customer experiences.

Consider this scenario: You're involved in a car accident and press your car's "help" button. Instantly, emergency services and roadside assistance are alerted and dispatched to your location. Your family receives an automated text, reassuring them that you're safe, while your car begins interacting with a network of connected systems. The car initiates your insurance claim, retrieving policy details, assessing damage via integrated sensors and pre-filling forms for you.

As the process unfolds, you receive real-time notifications: repair options tailored to your location, transparent updates on claim progress and reminders about next steps. The system anticipates your needs, suggesting rental car services or alternative transport arrangements, ensuring your journey is minimally disrupted.

This is the power of data orchestration -- an intelligent and connected data ecosystem working together to transform stressful moments into smooth, supportive experiences.

However, disconnected, policy-centric insurers will continue to struggle to participate in this data-driven world. The question is, what does the insurance sector need to do to harness the value of data orchestration and apply it to transform customer experiences for the better?

In short, a fundamental rethinking of how insurance is built.

Insurers must shift from being policy-centric to customer-centric, ensuring their systems can adapt dynamically through the seamless flow of data. Whether that's enabling smooth integrations or rapidly shaping personalized experiences through low-code user interface (UI) capability tools, adaptability must be at the core of their design.

This adaptivity is reinforced by being born into the cloud as opposed to adapted to be hosted by it. This creates significant core resiliency and transferability between cloud platforms.

Such a foundation gives insurers the potential to operate like e-commerce style businesses, offering innovative products that address whole insurance needs. This approach also empowers them to overcome challenges in selling, servicing and partnering across a diverse technological ecosystem.

This is about creating a true adaptive future. One where data is no longer abstracted, stored, analyzed and then painstakingly reintegrated through layers of legacy systems and policy-based architecture. A future where insights don't have to be manually engineered back into the customer experience only to be hard-coded and rendered inflexible over time.

For those in multiple partnerships, the challenges are even greater -- constantly reconfiguring how data interacts with new services or ecosystems.

Principally, businesses need to intelligently orchestrate customers and build relationships and products and services into those relationships -- doing so in ever-widening ecosystems.

Data-driven futures are about treating data as a perishable asset, constantly mining it for insight and acting on it. AI will do much of the analysis and even much of the customer orchestration over the coming years, but even this lower level of use for AI is difficult if you're not built right. This is potentially at the heart of the legacy issue and why it is only now arriving at its crunch point.

Operating more efficiently, keeping up with regulation and competing on price has worked for insurers, but at this stage even doing those things competitively will require a significant shift in enterprise design.

It's time for a change, and intelligently orchestrating data is fundamental to all of it.

The insurance landscape is evolving at an unprecedented rate, driven by a convergence of technological advancements and shifting customer expectations. Recent research from IDC and Workday found that more insurers are investing in cloud technology, data analytics and artificial intelligence as they advance toward core modernization. Leaders in this fast-moving industry must understand the challenges and opportunities that lie ahead. AI is poised to reshape the industry as we know it today.

Here are three predictions for how technology will affect the insurance landscape and the steps to drive success in the age of AI.

Beyond the Hype: Building AI-Ready Data Pipelines

The transformative potential of AI in insurance is undeniable. However, the reality is that many insurers are grappling with fragmented, outdated data landscapes. While the promise of AI-driven insights is alluring, there's a critical truth to face: Without a robust and agile data pipeline, the dream of AI will remain just that – a dream.

The IDC and Workday research confirms this challenge, revealing that "improved data quantity and quality" is a top priority for 33% of insurance executives. This isn't only about collecting more data; it's about ensuring that data is accurate, accessible and actionable.

Leaders must look beyond the AI hype and prioritize the development of AI-ready data pipelines. This means investing in data integration tools, implementing data governance frameworks and fostering a data-driven culture within organizations. By addressing data quality issues head-on, insurers can unlock the true potential of AI for informed decision-making and strategic advantage.

From Segmentation to Hyper-Personalization

Across industries, AI is leading the hyper-personalization movement, and insurance is no exception. The days of one-size-fits-all insurance products are gone. Today's customers demand personalized experiences tailored to their unique needs and preferences, and AI is the key to delivering this level of customization.

The research also found that insurers are exploring AI for "policy customization and generation." This goes beyond simple segmentation; it's about leveraging AI to analyze individual risk profiles, predict customer behavior and offer dynamic pricing and coverage options.

Imagine empowering agents with AI-driven tools that provide real-time insights into customer needs, enabling them to offer personalized recommendations and build stronger relationships. This shift toward hyper-personalization won't just improve customer relationships – it will be a key differentiator in an increasingly competitive market.

We’re already seeing strides when it comes to companies using AI to hyper-personalize the benefits experience for employees. With Workday Wellness, for example, insurers and benefits providers can use AI to gain deeper insights into benefits and wellness data – e.g. participation, usage, claims and more – to better understand which offerings employers’ employees want and are using so they can adapt their benefits to better meet employees’ needs. 

The Rise of the AI-Powered ERP

Leaders have long viewed enterprise resource planning (ERP) systems as table stakes for insurance organizations, but their role is on the cusp of a transformation – thanks to AI. ERP systems will evolve into dynamic hubs for AI-driven automation and intelligence across all core insurance functions.

The research reveals a growing trend toward AI integration in finance, with 31% of insurers making it a top priority. From automating financial processes and improving forecasting accuracy to enhancing reporting capabilities, AI within ERP systems is set to redefine how insurers manage their finances. Meanwhile, 26% of insurers are focusing on AI in human capital management, paving the way for AI-powered tools within ERP systems to optimize talent management.

By embedding AI capabilities within ERP systems, insurers are unlocking a more connected, agile organization with streamlined operations, enhanced productivity and a holistic view of their business. This will enable them to make data-driven decisions, identify opportunities and respond to market changes with agility.

Leading the AI Transformation

The journey toward an AI-powered future requires strong leadership and a clear strategic vision. It's all too easy to get caught up in the AI noise, but with steadfast leadership and an action plan for the future, organizations will be poised to lead through the AI revolution and position themselves for success in the future of insurance.

Out Front Ideas with Kimberly and Mark kicks off yearly with our popular 20 Issues to Watch webinar. While there are certainly more than 20 issues to discuss, we focused on the high-impact matters relating to risk management and employee benefits that need more attention. These are essential issues for every risk manager, HR manager, and insurance professional to monitor in 2025.

1. Climate Change

For risk managers and insurance carriers, climate change is not a political discussion. Weather risks are intensifying and becoming increasingly unpredictable. Hurricane Helene destroyed major interstates in western North Carolina and eastern Tennessee, where flood damage was unexpected. The Los Angeles wildfires have devastated the second-largest metropolitan area in the U.S., forcing over 200,000 people to evacuate. Additionally, California regulations have restricted carriers from using catastrophe modeling instead of historical losses to appropriately adjust premiums, creating an unsustainable business model. Over the last two years, this has resulted in cancellations or non-renewals in wildfire-prone areas.

2. Mental Health and Well-Being

Expanded mental healthcare facilities, digital health solutions, and practitioners offering online services are opening access for more patients. Interventional psychiatry is also using advanced treatments, like brain stimulation, new medications, and enhanced psychotherapy, to manage difficult-to-treat mental health conditions. From an employer perspective, leaders must be upskilled to understand the impact of disabilities and neurodiversity on their employees. Understanding how these differences affect their performance and interactions can lead to better opportunities for retaining great employees.

3. Aging Infrastructure

According to the American Road & Transportation Builders Association, around 36% of U.S. bridges need repair or replacement. Many water systems are also aging, with some areas, like Jackson, Mississippi, experiencing water crises that leave their residents without safe drinking water for weeks. The U.S. electrical grid, built in the 1960s and '70s, has 70% of its transmission lines that are over 25 years old.  Many of these have led to wildfires, which could worsen over time. 

4. Employee Benefit Landscape

According to Deloitte, employer-sponsored health insurance plans cover roughly 154 million people in the U.S., and costs have escalated for the third year in a row. Employers continue to seek affordable plans to encourage well-care and prevention. Additional benefits like accident and injury coverage, pet insurance, paid leave, reproductive health, and more continue to be popular offerings that are important to the workforce. Unsurprisingly, GLP-1 drug coverage is now being offered by one in three employers. The highly effective weight loss drug could become more widely available, with the potential to increase health equity.

5. Election Impact

Government regulations could be upended, as the Trump administration has promised to reduce their impact. Last year’s overturned Chevron deference ruling could potentially affect the Medicare set-aside (MSA) industry, with its compliance rules based on a limited section of statutory language. Additionally, risk managers should continue to closely monitor domestic risks, such as the most recent terrorist attack, on Jan. 1, as well as rising geopolitical risks that could affect war risk exclusions.

6. European Union (EU) Regulations Affecting U.S. Companies 

The EU’s Corporate Sustainability Reporting Directive (CSRD) aims to standardize sustainability information so companies can create comparable and reliable details for stakeholders. This environmental, social, and governance (ESG) regulation applies to EU and non-EU companies, including public and private organizations. Implementation is staggered through 2029, with the first report submissions due in 2025. There are 3,000 U.S. companies either exporting or doing business in the EU that must report, which is expected to grow to 10,000 U.S. companies at full implementation and include 50,000 companies globally. Additionally, U.S. companies need to understand compliance with the AI Act, which uses a risk-based assessment to create more ethical AI, and the General Data Protection Regulation (GDPR), which defines personal data usage.

7. Insurance Marketplace

Brokers and risk managers may be experiencing rate fatigue, but insurance carriers face increased jury awards, property losses, and vehicle and property repairs. Until combined ratios return to profitable levels, rates will likely continue increasing. Parametric insurance, which insures a policyholder against a specific event by paying a set amount if the triggering event occurs, is becoming more popular for harder-to-insure properties. With no appraisals or valuation disputes, they are quick to settle. Finally, per- and polyfluoroalkyl substances (PFAS) claims are set to reach $80 billion in litigation costs, according to The Insurer TV. Reinsurers are beginning to exclude these claims, and these exclusions may eventually reach the primary coverage layer.

See also: Insurance Industry Embraces Tech, Trust in 2025

8. Evolving Technology and AI

From improving safety and loss control programs to forecasting financial trends related to accidents and claims development, risk managers are using AI to establish new protocols for their organizations. Their improved ability to understand real-time risks in the business helps operational and executive leaders. Payers are rapidly evolving claims processing, as this tech supports claims teams’ productivity gains, improving operational consistency and quality performance. Other applications include claims triage, medical record and claims summarizations, reserve planning, fraud detection, and even virtual assistance for claims and clinical professionals.

9. Cyber

According to LexisNexis Risk Solutions, AI-assisted fraud schemes could cost over $1 trillion in the next year. Increased cyberattacks on U.S. government agencies, private organizations, and infrastructure have led to significant losses, with many calling for a federal government backstop to protect from even larger attacks. With an average global cost of around $4.9 million, cyber incidents remain a focus for risk managers and organizations alike. 

10. Diversity, Equity, and Inclusion (DEI) Perspectives

With some U.S. companies discontinuing DEI programming, groups should define their position. Inclusivity can be driven without a corporate stance, but employees want to feel respected and valued by their peers and leaders, which requires more transparent dialogue. Active job candidates will still search for DEI initiatives on company sites and social media to understand group policies and know they will be supported.

11. Labor Shortage Impact on Claims

Retail, restaurant, hospitality, and construction industries are still struggling to find workers. Employers are also trying to produce the same results with fewer employees, driving fatigue and overexertion among their workforces. Risk managers should monitor accident trends to note any correlation with staffing challenges. Employers should seek solutions for automating tasks, reducing strenuous activities, and monitoring unsafe practices.

12. Healthcare Landscape

Regulatory changes under the Trump administration could lead to more oversight of the Food and Drug Administration (FDA), with the Department of Health and Human Services (HHS) focused on vaccine safety, pharmacy benefits managers, and drug approvals. Transformative technology continues to drive patient-centered care with expanded telehealth, virtual health assistants, and advanced care. Lastly, healthcare staffing and burnout are continuing to drive workforce challenges. This year, nursing is expected to reach a 10% to 20% shortage of staffing necessary for direct patient care.

13. Exclusive Remedy in Workers’ Compensation

Most states have strict exceptions to workers’ compensation's exclusive remedy, which requires proving gross negligence or intentional acts. However, recent litigation in a couple of states has circumvented these restrictions. In Virginia, lawsuits filed in two workplace shootings alleged the employer was negligent by not taking action to ensure a safe workplace. Last September, the Pennsylvania Supreme Court ruled in Elite Care RX v Premier Comp Solutions, allowing the healthcare providers to file a civil suit for non-payment of bills. Finally, in November, an employee fired for fraud who sued in civil court for defamation was awarded a $34 million judgment. 

14. Optimizing Your Risk Management Program

Risk managers are deploying in-house data analytics and AI modeling to improve safety and loss control and their understanding associated with enterprise risks. They are working diligently to integrate risk management into strategic decision-making across their organizations and partnering closely with their business partners to enable a risk-aware workforce. Evolving risks may require a nuanced approach to risk assessment and mitigation. In the wake of United Healthcare CEO Brian Thompson’s assassination, organizations are rethinking public display and openness about the location of their executives and employees. Boardrooms across the U.S., for the insurance industry or otherwise, are reflecting on this incident to improve their employee safety.

See also: 2025 Insurance Outlook – 3 Major Trends

15. Biometric Privacy Laws

Unauthorized collection or disclosure of biometric information has led to several class action lawsuits, particularly in Illinois, but their statute was amended last year to limit damages on a per-person basis instead of per scan. Still, potential exposures are significant, with biometric privacy laws in Illinois, Texas, Washington, and New York City. Other states and municipalities are also considering similar legislation. Risk managers should monitor this evolving legislation and consult with counsel and other experts to ensure their policies with collections and use of biometric data follow statutes. 

16. Achieving Operational Excellence

With the culmination of workplace technology advancements, newer workforces, increasing retirements, and outdated workflows and processes, now is the time for organizations to rethink how they drive performance. Identifying cross-functional teams to assess strengths, weaknesses, and actionable improvements in a company’s operations, talent, and customer satisfaction may help drive meaningful changes to reach excellence in 2025.

17. Legal System Abuse

In 2023, jury awards over $10 million reached a 15-year high, with 27 cases reaching over $100 million. This trend affects every business and public entity, raising the costs of goods, services, and taxes for every American. Legal system abuse is driven by deceptive attorney advertising, anti-corporate sentiments, and the devaluation of money, but the solutions are systemic. Tort reform on judgment caps could help, but little progress has been made. Additionally, litigation funding needs extensive oversight, particularly as it threatens U.S. national security. Chinese government-backed companies use litigation financing to pursue patent infringement claims against U.S. technology and defense companies, not to prevail in litigation but to access trade secrets through the discovery process.

18. Managing Through Mergers, Acquisitions, and Divestitures

HUB International’s Outlook 2025 report noted that 45% of business leaders surveyed report planning or implementing strategic partnerships, 43% are planning or executing mergers and acquisitions (M&A), and 35% are planning international expansion. Risk managers preparing for these events should ensure their teams adequately understand these projects to identify, analyze, and mitigate potential risks. Consider the following items throughout the process: due diligence and deal intricacies, planning and executing integration, enterprise risk assessment, mapping regulatory compliance, broker partner and insurance reviews, understanding new and long-tail claims, and post-event operation models.

19. Workers’ Compensation Claims Trends

In the last two years, more states have revised fee schedules to catch up with the increasing costs of providing care, which, coupled with a growing shortage of medical providers, is likely to increase medical inflation. Catastrophic claims, while infrequent, are becoming increasingly expensive, with new medical technology and care, longer life expectancies, and higher rates of accident survivability. Different generations in the workforce are also creating specific challenges. Workers aged 75 and older are the fastest-growing group in the workforce, quadrupling since 1964. When injured, this group experiences more severe injuries and recovers more slowly. However, increasing disability durations in the younger workforce are also trending upward. While unclear, there is speculation that there is a greater valuation on work-life balance, so younger employees do not return until they are fully healed. Lastly, the industry should continue to monitor post-traumatic stress disorder (PTSD) presumption claims. Some states are expanding mental-mental claims to the entire workforce, versus the first responders that initially benefited. 

20. Navigating Headwinds

Macro factors, whether economic, political, technological, or environmental, always affect businesses. In today’s environment, it is not the cost of goods, competition, or regulation affecting us the most, but rather the convergence of speed, complexity, and noise. Business decisions are expected to be made quickly, issues are more nuanced than ever, and demands are at every corner, with more stakeholders and communication methods. Getting the right answer is more difficult, but identifying and preparing for approaching risks is evolving organizational risk management.

Listen to the archive of our complete Issues to Watch webinar here. Follow Out Front Ideas with Kimberly and Mark on LinkedIn for more information about coming events and webinars.

Insurance Thought Leadership

How do you see cyber risks evolving?

Vishal Kundi

If we look at how cyber risks have evolved, particularly in the last five years, we have seen threat actors getting better at exploiting vulnerabilities and emerging technologies like IoT and AI to expand the attack surface, making it harder to fully safeguard against breaches.

Looking at our claims data, about 80% of cyber claims are due to human error. Employees or individuals inadvertently open the door to cybercriminals, either by leaving security gaps unattended to or making networks more vulnerable. Our key objective here is to provide customers with alerts when we detect potential risks. The idea is that with the right education and tools, they can address these issues before they can cause a problem.

Another growing threat is the rise of social engineering attacks as more businesses move to online banking. We see increasing instances where hackers trick customers into paying fraudulent invoices by using compromised email accounts or fake communications. This type of threat is harder to address purely with technology because it boils down to awareness. Businesses need to be more vigilant about verifying payment requests and changes in banking details.

Insurance Thought Leadership

I like your "predict, prevent, and insure" model. The more we can predict and prevent cyber events, the less we need to insure, creating a safer world. Can you tell us more about your preventive approach, particularly with your scanning and alert platform?

Vishal Kundi

We’ve developed a robust system that looks for threats and risk signals, which help us identify higher probabilities of a loss. For instance, we can tell if a client’s website isn't properly secured or if their email addresses and passwords have been stolen.

These signals don’t necessarily mean a breach is imminent, but they do increase the chances of a targeted attack. At a deeper level, we monitor "hacker chatter" on dark web forums to see if someone is selling our customers' data. For example, if we spot a post offering Fishman Inc.’s data for sale, we can alert our client’s team through our Hackbusters service to take action and reduce vulnerabilities before an attack occurs. This proactive approach continues to evolve and become more sophisticated.

That said, while we work to secure our customers, hackers are constantly evolving, as well. We also package these predictive and preventive tools into our all-in-one Cyberboxx products, which provide coverage for both individuals and businesses.

Insurance Thought Leadership

How do you see cyber threats evolving further? I’m hearing more about hackers threatening to publicize sensitive information, rather than just encrypting data and demanding ransom for decryption tools.

Vishal Kundi

That’s a very insightful point. Cybercriminals are constantly looking for new ways to extract money, and they’ve realized that the ability to rebuild data no longer holds the same weight. What truly gets a company’s attention now is the threat to its reputation, particularly when it comes to customers. If a hacker can threaten to publicly expose sensitive customer data, that becomes a far more effective tool for extortion.

Another trend is that smaller businesses are becoming more digitally savvy and increasingly dependent on cloud services and third-party applications. However, when these external services experience outages or breaches, they can bring the entire business to a halt. This risk is known as "contingent business interruption." A prime example of this occurred last year in the auto dealership sector, when a widely used point-of-sale software was compromised. The breach affected thousands of dealerships across North America and Europe, highlighting how interconnected and vulnerable businesses can be when they rely on external digital tools.

Insurance Thought Leadership

How should companies approach cybersecurity risks that are beyond their immediate control, especially with third-party vendors and contractors? I’m thinking of incidents like the Target breach, where hackers exploited a vulnerability in a third-party vendor.

Vishal Kundi

Larger enterprises, in particular, are now asking suppliers to disclose their cyber insurance coverage and security measures as part of the procurement process, trying to avoid scenarios like the Target breach, where a third-party vendor’s weak security led to a massive incident. Cyber insurance policies typically include coverage for such losses caused by third party suppliers they are connected to. It covers the loss of income or operations that occurs when a third-party service provider or vendor suffers a cyber event, such as a breach or outage, affecting your business.

Insurance Thought Leadership

When you work with carriers and customers to predict and prevent problems, how does that look in practice?

Vishal Kundi

As a Lloyd’s of London coverholder, we are authorized by a Lloyd’s syndicate (or multiple syndicates) to assess risks, underwrite and issue insurance policies on their behalf, in addition to providing the Predict & Prevent services to our customers. From that lens, customers get the peace of mind of the coverage and the all-in-one prediction and prevention.

A new trend we’re seeing is more insurers looking to provide cyber insurance to their customers. They see the benefits of replicating our Predict & Prevent approach. They don’t have the technology and expertise to put this in place, and we’ve been approached to white-label our solutions for them. This is a huge testament to the effectiveness of the systems we’ve developed.

We’re also seeing major interest from mega brands in banking, financial services, travel and retail. These industries are integrating our cyber protection offerings into their products, helping their customers stay safe online. In India, for instance, we work with the country’s version of Zillow, where users can add our digital protection when making rent payments. We’re also embedded in telecom subscription plans in Canada.

This integration shows that customers expect large brands to offer protection while they transact online. We've developed methodologies to underwrite entire customer groups and provide relevant cyber and digital safety services at scale. This approach is proving highly effective for us.

Insurance Thought Leadership

Embedded insurance is a growing trend, and what you’re describing is a perfect example. People don’t usually think about buying your insurance, but they’re paying a small amount for key protection as part of another transaction, just when they need it.

Vishal Kundi

Exactly. We use embedded insurance as an entry point. As customers become more digitally savvy, they can choose to "buy up" from that initial protection as their needs evolve.

We’re now exploring ways to develop new products for various affinity groups and organizations, such as cyber insurance for business travelers and employee benefits. There are so many ways we can protect people beyond traditional insurance models.

The beauty of digital risk is that it’s no longer about geographic location. Your risk is tied to your digital footprint, which makes it easier for us to work globally. For example, we can work with telecom companies in Canada and India with the same ease.

We’ve also identified opportunities to provide value to customer groups that traditionally struggle to get cyber insurance. For instance, a large Christian faith group approached us wanting to insure their parishes. What they really needed was access to emergency cyber support. So we created a non-indemnified service called Cyberboxx Assist, where parishes can reach out to our Hackbusters team 24/7 in case of a breach.

Insurance Thought Leadership

How do you see cyber risk and coverage unfolding with traditional lines of insurance?

Vishal Kundi

As businesses become more digital, every part of their operations now involves some level of cyber risk. When we insure a company for a cyber policy, we’re looking at two main things: the cost of getting the business data systems back up and running and the cost of third-party lawsuits. There's also the issue of cybercrime, where companies are targeted by fraudsters.

Let’s look at the example of property insurance. Many traditional cyber insurance policies may not automatically cover physical property damage caused by a cyber incident. Take a hospital. What if a cyber breach compromises an MRI machine? What if that breach leads to patient injury or another event? Would that fall under the hospital’s liability insurance, cyber insurance or even their medical practice insurance? We’re starting to see more questions about how to properly categorize these types of risks, and specialist coverages like cyber property damage to start filling in some of those gaps.

In addition, board accountability is becoming a hot topic. Directors and officers are increasingly held responsible for a company’s cyber infrastructure, which raises questions about whether their D&O insurance should cover this risk.

These evolving scenarios show how intertwined cyber risk is with other lines of insurance.

Insurance Thought Leadership

As a baby boomer, I appreciate that you’re focusing on this demographic. What problems are you solving for us?

Vishal Kundi

We define boomers as people between 61 and 79. As they navigate the digital world, they often don’t have the same safety awareness as younger generations that have been around the technology for a longer part of their lives. Cybercriminals are targeting this group, knowing they hold significant wealth and may not be as digitally savvy.

Insurance Thought Leadership

We’re seeing cyber risks rise, yet premiums are often decreasing. Does this track with what you’re seeing?

Vishal Kundi

That’s spot on. As companies improve their ability to manage security risks and losses remain within expected limits, insurers are becoming more confident in offering better terms and pricing. However, over time, as losses begin to exceed premiums, we typically see upward pressure on prices. This cycle—where premiums rise after a period of stability or decline—is a natural part of the insurance market, and it’s one we’re likely to see play out in the cyber insurance space, as well.

Insurance Thought Leadership

Thanks, Vishal.

About Vishal Kundi

As the co-founder and CEO of BOXX, Vishal Kundi aims to help make the world a digital safer place. Prior to BOXX, Vishal held the role of chief sales officer at Arthur J. Gallagher. Vishal brings a global perspective to building a new company, having lived and worked across the world, including in Dublin, London, Hong Kong, Santiago and Toronto. He has played a pivotal role in both mature businesses and insurance startups.

2025 did not start well for weather-related disasters. Early estimates from JPMorgan show that overall economic losses and insured losses from the Los Angeles wildfires could make it the costliest disaster in California's history. 

This is particularly jarring as we come out of 2024, which held the unfortunate distinction of having an above-average number, when compared with the prior four years, of weather or climate disaster events with costs that exceed $1 billion in the U.S. This spotlights a critical crisis: the increasing vulnerability of American households to the financial implications of natural disasters. 

The financial aftershocks of a natural disaster can include lower credit scores and more debt in collections, and over half of people who experienced a weather event in the past year (57%) faced increased household expenses.

Despite these risks, many households have inadequate insurance coverage due to factors including cost and complexity that can lead to confusion around insurance policies. Behavioral science can help insurers support consumers in overcoming these challenges through a greater understanding of consumer decision-making. A recently released Insurance Behavioral Design Guide highlights innovative practices that insurers can consider to support financial stability for individuals and communities as they navigate the financial fallout from natural disasters.

Behavioral Barriers to Coverage

Only 59% of households in the U.S. reported feeling confident that their insurance policies would cover them in an emergency in 2024. This lack of confidence can be due to a number of factors, including being underinsured -- but why do people not choose greater coverage? Behavioral science offers several clues as to what may be holding households back.

First, consumers may experience friction in accessing coverage, especially if they find their options for policies to be too numerous or complex. The mental load of having to sort through confusing options or too much information can throw people off track. This friction can be compounded by status quo bias, making change more difficult.

People's perceptions of their need for insurance are also influenced by the availability heuristic, which describes how the recency of an event (like a natural disaster) influences how likely a person thinks it is to happen again. In some cases, though, people may not take action toward coverage because they want to avoid uncomfortable information altogether -- a phenomenon known as the ostrich effect.

Perceptions of insurance costs can also be an obstacle, and high premiums are a commonly cited factor for policyholders who drop their coverage. This decision can also be influenced by loss aversion—people's preference for avoiding losses over seeking gains makes paying for a policy for which they may never make a claim unappealing. Insurers can drive higher uptake by strategically addressing these behavioral barriers.

See also: 'Predict & Prevent' Can Rescue Insurance

Market Innovations to Drive Engagement

Newer entrants to the insurance market (insurtechs) and the larger incumbent insurers alike have developed innovative strategies that could overcome some of these behavioral barriers, making coverage more accessible and promoting financial resilience.

1. Alternative Premium Models

Adding flexibility to premiums shows promise for reaching more consumers. For example, auto insurtech Hugo developed a pay-as-you-go premium model that allows customers to purchase increments of coverage, including policies as small as three days. This can appeal to consumers with variable incomes, giving them greater control over their expenses. Or consider how Ladder, a life insurance provider, offers adjustable coverage: Policyholders have the option to increase or decrease their protection based on life changes, like purchasing a home. These flexible options help consumers to know that their insurance policies can easily evolve with their changing lives and needs.

2. Building Customer Trust

Nearly 30% do not believe they are valued customers, feeling that insurance companies are not interested in serving them. Lemonade's innovative "giveback" program aims to counter this mistrust by aligning its interests with those of its customers. Under this program, it donates unclaimed premiums to causes that its customers choose, promoting loyalty and trust, which are key drivers to ensuring consumers feel confident in their insurance policies.

3. Simplifying Uptake

Finding an insurance policy can be daunting for consumers as they encounter a large volume of choices and friction. Root Insurance has a partnership with Carvana that enables customers to apply for auto insurance while purchasing a used car -- eliminating much of the friction to finding coverage. Similarly, AXA's pilot with Western Union offers life and disability insurance alongside remittances. By embedding insurance with existing services, these partnerships remove some of the complexity of finding coverage.

4. Using Motivating Messaging

Marketing can play a pivotal role in helping people to overcome the ostrich effect and engage with insurance. It may be unsurprising that many individuals without life insurance (nearly one in five) report that they have avoided life insurance because they don't want to think about death. MassMutual developed their "Uncomfortable Truths" campaign to address this discomfort head-on, acknowledging difficult topics with an approachable tone. This type of approach can encourage people to take action to protect themselves and pursue financial resilience.

5. Helping Customers Choose Their Policies

When consumers are uncertain about what coverage they should get, they may avoid the decision altogether and end up uninsured. Insurers can take inspiration from tools that guide consumers by providing key information as they search for plans. For instance, Washington D.C.'s health insurance marketplace, DC Health Link, offers a personalized comparison tool and calculator for users that estimates costs and benefits of different plans. Even simple tools like this can help consumers to identify and enroll in the right coverage for their needs.

See also: Insurers Must Lead Disaster Risk Awareness

Promoting Financial Resilience

Accessible insurance solutions are more critical than ever to supporting consumers' financial resilience. As extreme weather events continue to rise, more consumers will face the financial fallout of natural disasters. Insurers can deliver critical protection by applying behavioral insights to overcome some of the barriers consumers face to accessing adequate coverage. Leveraging behavioral science in the design and delivery of insurance products can not only foster financial stability but also build customer satisfaction and loyalty. Research has shown that customer satisfaction triples when customers see their financial institutions taking action to support their financial health.

Leveraging behavioral insights isn't just beneficial for insurers; it is essential for relevance and growth. From innovating premium models to simplifying the process of finding or enrolling in insurance, companies can narrow the insurance gap and contribute to more resilient communities prepared for the storms ahead.

Adverse selection in commercial insurance is a burden on all stakeholders. It drives higher average premiums and lower availability of insurance for businesses. Underwriters are saddled with time-intensive and manual online research. Without the right sources, they may struggle to bring relevant insights about their policyholders' businesses to light.

With a world of information at their fingertips, how do insurers filter through the noise to source truly useful insights that give them a reliable outlook about a company's risk?

Underwriters may hesitate to adopt new risk assessment tools because they don't want to overprocess their workflows or overburden themselves with more information. However, the most beneficial risk assessment technology doesn't just pump out more information; it focuses on data that fills the gaps and helps insurers make decisions.

Don't Suffer From More Data, Benefit From Fewer Decisions

Insurers need better data to better evaluate risk. But better data does not necessarily mean more data. Some underwriting engines may offer the entirety of the internet on a platter but not pick out the seeds and bones by proofing the outputs. Having acres of bad data can be much worse than having too little data.

Many seasoned underwriters burn a lot of time evaluating businesses because they don't trust the data they can access; outdated online business listings and quick on-site visits only scratch the surface of the true nature of a business, particularly as the nature of companies continues to evolve in complexity. For example, traditional underwriting methods may find it extremely difficult to distinguish between a landscaper that offers tree trimming services and one that doesn't. In contrast, a more modern underwriting approach that flags when a business offers new products or services can keep pace with the shifting currents of commercial risk.

Insurers can also use modern data tools to achieve greater clarity about like businesses through detailed comparisons to better understand their risk differential, harnessing a host of online insights to look through a macro lens at how a business compares with its peers within their category or location. Not every Starbucks location has the same risk propensity, so having this precise and contextual data can inform better decision-making.

Predicting Tomorrow's Risk Means Better Understanding Today's Risk

Underwriters need an accurate, real-time view of diverse data points like business classifications, operations, performance and customer feedback to confidently write policies. The more comprehensive their view of current risk is, the better prepared they are to predict future business risk.

Imagine that a customer leaves a review that a restaurant's floors are slippery. Although that business might not have an open claim yet, that hazard is a strong indicator that an injury claim lies just over the horizon and must be a critical consideration when evaluating its risk. Risk management technology that brings filterable predictive scores and indexes to underwriters' fingertips is essential for future-proofing their policies.

Although accuracy and foresight are critical for underwriting intelligently, the speed of these insights is equally important.

Don't Sacrifice Time for Accuracy

Reliability and speed are the cornerstones of great data, so having a data suite that is cleansed, categorized and standardized for rapid incorporation is essential. If the underwriting technology insurers invest in is clunky or does not integrate with their current workflows, then it may add even more work for underwriters, and adoption will likely falter.

Underwriters who spend too much time evaluating and verifying risk attributes will often miss out on optimal policies and find it more difficult to justify niche markets, aggravating adverse selection.

Combat Adverse Selection With Credible, Curated Data

There is a great deal of pressure on underwriters to efficiently quantify complex risks in less and less time, but that only leaves teams more vulnerable to overlooking significant risks, contributing to their growing adverse selection problem. Rather than shying away from opaque markets or opportunities with historically smaller margins, insurers that harness credible, curated data sets will be better positioned to combat adverse selection and adapt to the continually shifting market conditions.

By harnessing reliable information and embracing automation, underwriters can offload the tedious, time-consuming research tasks and focus more on assembling the complete picture of a business before binding a policy. These advancements allow carriers to get the first pick on the best risks and foster better relationships with their insureds while avoiding unnecessary uncertainty.

Kirsten Mickelson leads the cyber practice group at Gallagher Bassett, which offers claims and risk management expertise to navigate the rapidly expanding cyber market overseeing cyber, technology, privacy, and data security matters, specifically focusing on cyber incident response, data breach response, privacy class actions, and data privacy compliance issues.  Prior to joining Gallagher Bassett, Kirsten was a senior team manager and counsel at Coalition Inc., where she counseled customers in preparing for, and responding to, data breaches in their network infrastructure. She also served as senior claims counsel at Hiscox, where she worked with affected cyber policyholders to respond to hundreds of cyber incidents and third-party claims involving data breaches, cyber extortion, ransomware, DDoS attacks, and business interruption losses. Kirsten has been awarded the Fellow of Information Privacy (FIP) designation by the International Association of Privacy Professionals (IAPP) and is a Certified Information Privacy Manager (CIPM).

Insurance Thought Leadership

The cybersecurity landscape morphs so rapidly. What emerging cybersecurity threats should organizations be prepared for?

Kirsten Mickelson

We're going to see a huge shift in the coming year in terms of the magnitude of existing attack types. Our most typical attacks are business email compromises [BECs], wire fraud where someone misdirects funds to a fraudulent account, and ransomware attacks. These three types of attacks typically lead to data breaches requiring notification of affected individuals and sometimes evolve into class action privacy lawsuits. These attacks will be amplified significantly, leading to bigger paydays for threat actors and more negative press and scrutiny for victims.

The threats are evolving because threat actors have noticed that organizations are increasingly reluctant to pay ransoms during ransomware attacks. We never advise organizations to pay -- no one wants to pay a criminal -- and there's now even more government scrutiny around ransom payments. Organizations are also becoming savvier about properly securing and backing up their data for business continuity, allowing them to restore from backups rather than paying threat actors for decryption tools.

In response, we'll see threat actors shift their tactics. They'll not only encrypt data in ransomware attacks but also exfiltrate data and threaten to publish it if the ransom isn't paid -- creating a double extortion scenario. Some might skip the encryption process entirely and simply steal data, threatening to publish it if a ransom isn't paid. This is more efficient for them because they don't have to provide continuing support during the decryption process.

Another emerging tactic is that threat actors are showing more patience before striking. They're slowly exfiltrating data to avoid triggering EDR [endpoint detection & response] tools and alarm bells that would detect large data transfers. They're getting into systems and observing email traffic, reading communications, identifying key players who approve large wire transfers, and reviewing documents to understand if there are lucrative opportunities like M&A deals that they can exploit for higher ransom demands.

We're also going to see continued exploitation of zero-day vulnerabilities -- bugs in software or tech products that threat actors find before organizations can patch them. This is particularly effective for scaling attacks and extorting more money, especially with so many organizations relying on SaaS [software as a service] products and outsourced tech.

Finally, we'll see an increase in supply chain and vendor attacks. With organizations increasingly connected and reliant on outsourced tech solutions, vendors become lucrative targets. A single point of attack can affect hundreds or thousands of downstream customers. We saw this last year with Change Health and CDK Global, and now with PowerSchool, and threat actors are very aware of how these attacks can leverage higher payouts by having downstream customers pressure the victim to pay, because their businesses rely on that victim's services.

Insurance Thought Leadership

I’m seeing that artificial intelligence both helps with cybersecurity prevention and with enabling threat actors to conduct more sophisticated attacks.

Kirsten Mickelson

Yes, threat actors are using generative AI to create more convincing social engineering text. These are more believable phishing emails that have a tone and style like that of a trusted colleague. Threat actors are also using AI to translate these more credible phishing emails to scale -- in French, German, Chinese, and other languages to increase their attack surface. Before AI, these phishing emails were easy to spot. They had lots of red flags, with grammar errors, low sophistication, and mismatched fonts. Now, AI is removing those easy-to-spot flags, enabling more seamless social engineering.

Over the holidays, we saw a perfect example. A company that uses an HR management system for time tracking received a sophisticated phishing email. The email claimed that an employee's time-off request had been denied and asked them to review the reasoning by clicking a link. It wasn't unusual to get that type of email in their organization. When clicked, the link led to a fake landing page that looked exactly like the real one -- no mismatched fonts, no red flags. Once credentials were entered, the threat actor gained access to the system.

In the ransomware space, we're seeing threat actors using AI to review documents more efficiently. They're using it to quickly locate and identify financials, P&Ls, and cyber insurance policies so they can make credible demands. Before, threat actors had to manually review documents to figure out who the key players were, but AI accelerates this process.

We're also seeing threat actors using AI to automate the process of finding zero-day exploits and vulnerabilities before they can be patched. Some are using AI to write malicious code for ransomware attacks, which is making the ransomware industry more accessible to less technical actors.

Another interesting development is that threat actors are targeting legitimate AI agents themselves. As more organizations implement AI chatbots for customer service, we're seeing injection attacks on these agents. Threat actors are using these compromised agents to get victims to disclose sensitive information, reset passwords, and even transfer money. This poses a huge challenge for insurers, and not just cyber insurers.

Insurance Thought Leadership

When I spoke at a recent INSEAD seminar in San Francisco, a fellow panelist shared a scary story about sophisticated neighbors who were scammed by fraudsters who used a deepfaked voicemail of their son saying he desperately needed bail money. How frequently are you seeing deepfakes being used beyond email-based fraud?

Kirsten Mickelson

We're seeing deepfakes frequently, and I don't expect that trend to slow. For instance, in Zoom calls, threat actors are mimicking photos and images of credible people who appear to be your colleagues, even commandeering their voices. If someone who looks and sounds like my senior executive calls into a meeting and tells me to do something, I'm likely to comply.

We've seen this particularly with wire fraud. There was a significant case in Hong Kong where an organization's financial person received instructions from what appeared to be senior executives -- all deepfaked -- directing them to wire several million dollars to a Hong Kong bank. The employee complied. 

I was recently on a panel with a Secret Service agent who said he and his colleagues had experimented by taking his voice and creating a deepfake saying things like, "Hey Joe, do wire that money" -- and it sounded exactly like him.

We're also seeing threat actors playing panicked voices of customers to victims, often vendors. They'll say something like, "Your customer is telling you to pay this ransom, otherwise they'll make this demand or sue you."

Insurance Thought Leadership

Cyber insurance premiums appear to be declining despite increasing cyber threats. Is this because premiums were initially set too high, or are companies becoming more effective at preventing attacks with help from insurers?

Kirsten Mickelson

From the claims perspective, I can say I've seen a lot of new entrants into the market. Also, particularly on the standalone cyber insurance side, insurers are requiring organizations to implement specific security measures before they'll even underwrite them.

They have to have MFA [multi-factor authentication] not just implemented but enforced at all times, in addition to processes such as dual authentication before wiring funds, before insurers will even consider the risk.

Insurance Thought Leadership

The bad guys collaborate all time, but insurance companies need to be careful about antitrust laws and, of course, don’t want to give up a competitive advantage. How can the industry collaborate better?

Kirsten Mickelson

We're seeing that with CISA [the Cybersecurity and Infrastructure Security Agency], which strongly encourages reporting if you’re exploited in some way. The goal is to enable government to aggregate data to go after these bad actors. We are seeing partnerships developing.

Insurance Thought Leadership

Has there been a shift in the geographic origin of cybersecurity threats? I know Russia has historically been a prominent source of attacks.

Kirsten Mickelson

Definitely. For threat actors to receive payment under U.S. insurance policies (and U.S. law), we have to run it through OFAC [Office of Foreign Assets Control]. Payment cannot be sent to a sanctioned entity on the OFAC list.

Before the conflict in Ukraine, many threat actors were operating out of Russia and Eastern Europe. While Russia as a country wasn't on OFAC, there were organizations and individuals within Russia on the list. However, following the Russian invasion of Ukraine, the U.S. placed all Russian financial institutions on the OFAC list, which triggered a massive shift.

Many large ransomware gangs broke up and reformed in new locations. We're now seeing more attacks originating from the Asia-Pacific region, as well as increased activity from Southeastern Europe.

Insurance Thought Leadership

What else should we be thinking about for 2025 that we haven't discussed?

Kirsten Mickelson

I think there's another important trend regarding new tactics. With the ransomware-as-a-service model, the barrier to entry is going to be much lower. This means we're likely to see the threat actor ecosystem expand, unfortunately.

One way this will manifest is through the rise of initial access brokers. In the ransomware-as-a-service world, everything can be outsourced, even finding access to exploit. Access brokers go out and find entry points, then sell them to their customers -- the threat actors who deploy the actual ransomware attacks. These initial access brokers view themselves as less malicious threat actors, though they're still criminals. Because this role doesn't require as much technical knowledge, I expect we'll see a significant rise in initial access brokers.

Insurance Thought Leadership

This is super informative. Thanks, Kirsten.