Modeling Cyber Risk in the Age of AI: A Conversation with CyberCube’s Jon Laux

Farrell: CyberCube does risk modeling for the cyber insurance market. Can you give a really plain-language description of what that means, and what problems you’re solving for your customers?

Laux: I’ll do my best. It’s a niche within a niche. At the highest level, we help the commercial insurance world make sense of technology risk. If you strip off all the mechanics, insurance is basically a risk transfer mechanism: there are things that are too big for me to deal with with my own cash flow or my own balance sheet, so I look to insurance to help share in that risk by pooling my exposure with a whole bunch of others. Cyber insurance in that regard is no different. We work with customers to make sense of technology risk across the value chain, providing data and analytics: identifying risk, quantifying it, mitigating it where we can, as well as transferring it.

A couple of tangible examples. For a broker that works for, say, a Fortune 500 firm, the question they’re helping their customer answer is: should I buy insurance? If so, how much, and why? For somebody in underwriting: for a given account, what contributes to risk? Maybe it’s an airline. How does it stack up with other airlines, and what should I charge for that account? And then what we might call portfolio management. Let’s say that underwriter has done that 10,000 times, and I now have 10,000 accounts that I insure. If I add all that up, how bad could that picture be? What does that mean in terms of financial solvency, how much I need reinsurance, what I have to report to regulators? We serve customers across that whole value chain.

Modeling a Risk With Limited Historical Data

Farrell: The cyber market is one where we don’t have hundreds of years of data the way we do in, say, the natural catastrophe world. It’s much more adversarial, and a lot of the risks are correlated. How do you build a model with less data and these unique characteristics?

Laux: While we haven’t necessarily seen a long and stable track record of history, cybersecurity teams are seeing incidents all the time. So we actually have the advantage that there’s a lot of data. It just doesn’t necessarily look the way the insurance industry is used to consuming it.

A useful analogy: in hurricane modeling, there are three components: exposure, hazard, and vulnerability. Exposure means a whole bunch of property value on the coast in Florida. The hazard is the hurricane and the different paths it can take. And the vulnerability is whether you’ve done things to lower the risk, like the construction of the home or hurricane shutters.

In the digital world, the exposure we anchor on the most is what we might call a single point of failure technology, and we all have plenty of examples: AWS, Anthropic, CrowdStrike. Does company A rely on technology B is a really important question, and it’s pretty observable. That gives us a good foundation to understand how risk is networked. On the hazard side, we have seen things like NotPetya and SolarWinds, and there are techniques like counterfactual analysis: you don’t look just at the event as it played out, but how it might have played out differently. You don’t necessarily need every cyber hurricane to make landfall. And then on the vulnerability side: how are individual organizations defended, or not? That’s a combination of data customers share with us and outside telemetry that we gather.

“You don’t necessarily need every cyber hurricane to make landfall.” — Jon Laux, VP of Analytics, CyberCube

What CrowdStrike Taught the Market

Farrell: CrowdStrike was a couple of years ago now, but it’s an interesting example where the companies that had some of the biggest problems were the most prepared companies. I think you came up with a phrase, the resulting fallacy. What did we learn from CrowdStrike?

Laux: It was one of the first times where we were watching an event play out in real time. One of the things that companies look for from us is loss estimates: the CEO is going to be calling the people in charge saying, how bad could this be for us? Is this an earnings event?

It was an interesting example because a lot of the companies that were affected by CrowdStrike were the ones who were, I’ll say, doing things right. The companies that were affected were affected because of basically a faulty update that CrowdStrike pushed out. But the very fact that companies got that update basically meant they were prepared for the mass ransomware version of this thing. And CrowdStrike ended up not being a particularly big deal. If a thousand-year cyber event is an apocalyptic cyber event, we estimated this was probably a one-in-two or one-in-three type event in terms of how it actually played out.

In terms of lessons learned: should companies gate that a little bit more, and pause before they automatically push things out? Maybe that would have helped a little bit. At the same time, in the world we’re going to, where vulnerabilities might get discovered and exploited at the speed that AI can deploy them, it actually might be a better trade to be in that CrowdStrike event, but avoid the thing where there’s a massive vulnerability that’s suddenly exploited.

Jaguar Land Rover and the Shape of Networked Risk

Farrell: Jaguar Land Rover had their incident last summer. I think it was the largest cyber attack in British history, almost $1.9 billion, and the UK government had to step in. For five weeks it rippled through the whole supply chain. Is the insurance market capable of handling that today?

Laux: The short answer is yes, but the details matter. What JLR shows is that weird, unpredictable things can always happen. And they tend to.

One of the oddities with Jaguar Land Rover was that they were a critical buyer for a lot of the UK economy, not a critical supplier. Historically, people worry about the upstream, not the downstream: my supplier is affected, now I can’t buy the ball bearings to make my widgets. This was sort of the opposite: my buyers stopped buying because they were distracted. So the insurance world is looking at that now. On one hand this is a new thing. On the other hand, that’s always kind of how insurance has navigated. The hurricane models didn’t contemplate storm surge before Katrina. Afterwards, they realized they really should. This is, in a way, how we learn.

The other interesting example with the Jaguar incident is the public sector role. The government stepped in, and that can be a significant role. We saw something similar in the US with Change Healthcare, where United [Healthcare] stepped in and provided bridge financing because companies were at risk of running out of cash. But it’s very hard to rely on that being there when the bad thing happens. So we, and a lot of folks in the industry, have advocated for government reinsurance backstops, similar to what’s done for terrorism risk in the US and the UK. The premise being: if things hit the fan, it’s better to have a plan and a funding mechanism you can point to, rather than having things scramble in a live-ball situation.

The Expanding Pool of Attackers

Farrell: AI changes every step of the attack sequence: how quickly attacks can be made, and who can make them. What does it practically mean when the pool of potential attackers expands so dramatically?

Laux: I don’t mean to be glib, but we’re about to find out. A couple of cautionary things. The first is that potential doesn’t mean actual. When we’re looking at AI capabilities, we’re tracking essentially the high watermark of what’s possible. Just earlier this month, we saw the first end-to-end, completely autonomous attack that AI carried out. That’s worth noting, and actors don’t necessarily follow that far behind. But a tornado watch is not the same thing as a tornado warning. Those things we have to watch.

Nation states generally tend to hold back: find the vulnerabilities, save them for a rainy day. Cyber criminals don’t have that same sense of reservation, but what they don’t like is to be above the radar too much. When Colonial Pipeline happened, the message was sort of: we’re sorry for disrupting the whole US Eastern Seaboard, we’re just honest crooks trying to make a buck. That’s what we’ll probably see more of.

The final point: it’s natural for people to want a point estimate. There’s a saying in actuarial science: all models are wrong, some models are useful. We hope we’re building useful models. And a lot of the way the models are useful isn’t in getting the one number exactly right, but in helping the people using them understand the shape of the volatility around it.

There’s a saying in actuarial science: all models are wrong, some models are useful. We hope we’re building useful models. - Jon Laux, VP of Analytics, CyberCube

Farrell: These AI models are allowing attackers to do things better and faster, but they’ll also allow the defenders to. How does that dynamic play out?

Laux: It’s a cat-and-mouse world, always. New things come out, the attackers exploit them, the defenders respond and catch up. Right now, all the security experts we talk to seem to suggest it points in favor of the attacker. Somebody we used to have on the team, who had penetrated networks for much of his career, said: I only need one door to get in. Whereas if you’re on defense, you have to have every door closed. So I expect there could be a period of disruption for a while. Where I get more nervous is small businesses. Large companies have a big budget to put behind this. If you’re downstream from that and just trying to do your job, that’s something we’re going to have to watch very carefully.

How a Conservative Industry Keeps Pace with AI

Farrell: AI is moving at a speed that I don’t think any of us feel like we can keep pace with, and the insurance world by definition is super conservative. How does the insurance world keep pace?

Laux: In the insurance industry, there was definitely a pre-Mythos environment and a post-Mythos environment. I can remember going to conferences back in February, early March, where the attitude was: we get some questions every now and again, but we’re not that concerned. And I was just on a call with a client this morning where they said, this is a top priority, up at the level of our CEO right now. So the world does respond.

A lot of that conservatism in insurance is structural. It’s 12-month policies, 12-month reinsurance buying cycles, regulatory reporting. It doesn’t mean our customers are wrong, and what we’ve realized is we have to meet the industry where it’s at. What we don’t want to do is build a lot of speculation, and God forbid, hype, into models that our customers trust and have used for years. I’ve used this seesaw analogy quite a bit. On one hand, we need to give our customers a stable, planned rollout of new information, based on data or at least research, not just speculation. On the other hand, we also want to give our customers something we want ourselves, which is a sandbox environment to test things out as they’re unfolding. A new announcement about a new frontier model: what does that mean? Let me stand something up, test it, and evaluate. Our customers fall into a range, and it’s a very interesting time to work with an industry that needs to digest change in increments it can metabolize, but also work with the cutting edge of what’s out there.

Where the Market Goes Next

Farrell: Cyber insurance today is working; it does what it’s designed to do. But the bigger opportunity is ahead. Where does the market need to go next?

Laux: On the whole, AI is going to follow a broadly similar trend to what we’ve seen in cyber insurance. Go back 30 years and cyber insurance wasn’t a thing. It was born out of recognizing that when I’m underwriting a company for slip-and-fall liability, no one is thinking about the network risk. In insurance you have mainstream product lines that every company buys, and then specialty markets, and cyber is a good example. AI, I expect, is going to follow a pretty similar path: it’s not just cyber, it’s products liability, it’s every company starting to act like a technology company when they onboard large language models and, potentially, agents. Some insurers are going to lean in and some are going to lean out. We’re going to learn when claims come in, and the coverage evolves accordingly.

There are also going to be new areas we just haven’t thought of before. Everything that ChatGPT or Claude knows about me could probably paint a very interesting psychological and business profile of Jon Laux. That’s a whole new type of data that’s never existed before. We’re going to have to grapple with that in the coming years.

Farrell: Cyber insurance is annual premiums in the tens of billions, and by most estimates there are many multiples of that in cyber losses every year. Do premiums and losses meet at some point, or is something structural preventing it?

Laux: I don’t think the situation is as dire as it often sounds. The industry is going to grow; there are estimates it roughly doubles in the next couple of years. But the bigger point is that we compare premium against the size of the problem, and what we really should compare is the amount of insured limit. Your home might be a million dollars, but you might pay $2,000 to insure it. The actual amount of insured limit we see globally is on the order of $2 trillion, and I’ve heard most recently that the cybercrime problem, which is hard to estimate, is maybe $10 trillion. So it’s a huge number, but the insurance market is in the same order of magnitude. There’s still a lot of underinsurance among small businesses, particularly outside the US and Western Europe, so clearly there’s more opportunity for that coverage to grow. But it’s not quite as dire a gap as it sounds at first.

Farrell: Last question. If you could change one thing about the industry’s approach to cyber today, what would it be?

Laux: This is structural more than systematic, but it comes back to the notion that cyber is a networked risk. Insurance is largely built on an industrial-age model, a lot of command and control, and that’s necessary given that these are large and complex organizations. But cyber risk and AI are information-age problems, and the siloed model that tends to get created is a very difficult thing to navigate. Build in that muscle to think laterally, and look at the ways these issues can span different parts of the operation.

We saw this in cyber just prior to 2020, with the wave of what we called silent cyber risk: sure, technology can affect the cyber insurance you’re writing, but what about the property, the liability, all these other things? There’s a way to just exclude it and shut it down, which is a natural instinct, but I don’t think that helps insurance’s place in the global economy. I suspect we’re about to hit that wave with AI as well. Data centers, actually, I would highlight as a bright spot right now: a huge amount of property, construction, energy, and contracting work, and the insurance world is rallying around supporting that whole build-out by bringing together lines of insurance that traditionally sit in silos. We have to make sure we’re not settling for the local maximum of “I’ve solved for this little problem” when there’s a much bigger problem the world is grappling with. Let’s make sure that we’re prepared to help them with that.

Jon Laux is VP of Analytics at CyberCube, which provides data and analytics for the cyber insurance market. Mike Farrell is a Managing Director at Spectrum Equity. As of the date of this conversation, CyberCube is a current portfolio company of Spectrum Equity.

To improve readability, this interview has been edited for clarity and conciseness. These edits do not materially alter the meaning of the discussion.