Most insurance providers tend to tailor their cyber insurance policies for large-scale enterprises. Business owners usually must pay large annual premiums upfront for oftentimes confusing coverage options that lack historical data to quantify cybersecurity risks. Most policies do not cover cyber-instigated business interruption which can lead to significant losses in online revenue. If the company files a claim, the investigation can take many months during which the owner must survive financially before receiving a payout on an insurance policy. Lacking the robust reserves of larger companies, small- or medium-sized business owners may face bankruptcy in the aftermath of a cyber event.

What CyberFortress does is offer cyber insurance policies designed for small- and medium-sized companies. Click To Tweet

“Applying analog methods to quantify digital risk just doesn’t work—actuary tables for cyber risk do not exist,” CyberFortress co-founder and CEO Huw Edwards said. “What we’re building is a data-driven model to assess cyber risk for small businesses.”

Cyber coverage carries high risks, so only major carriers such as AIG, Apogee Insurance Group, Chubb, and Zurich offer such policies. These relatively new policies usually exclude coverage of losses from socially engineered attacks like phishing, the theft of intellectual property due to a cyber attack, or the loss of online sales. Despite these caveats, cybersecurity insurance is projected to grow to $20 billion by 2025 and become the fastest-growing sector in insurance.

Focus on Smaller Businesses Leads to a New Kind of Cyber Insurance

Edwards has long recognized the need for smaller business owners to protect themselves from cyber risks.

Edwards and Bret Piatt founded Porthcawl Holdings to buy the data backup and cybersecurity company Jungle Disk from Rackspace in 2016. Piatt became Jungle Disk’s CEO and Edwards its chief financial and strategy officer. Jungle Disk provides small- and medium-sized businesses secure data storage and associated services such as password management from Team Password, the startup Jungle Disk acquired in early 2018.

Read more: Jungle Disk Announces Acquisition of TeamPassword

“When we first bought Jungle Disk it only offered encrypted backup storage,” Edwards said. “We’ve since added cybersecurity, password management, network threat protection, and email archiving. Part of our long-term plan was always to offer financial protection against cyber-related events.”

Edwards at first attempted to become a third-party cyber insurance broker selling an existing carrier’s cyber insurance policy. He discovered cyber policies were complicated, lacked risk-based, data-driven assessments, and entailed a painful claims process—in short, “not small-business friendly,” as Edwards told Startups San Antonio.

The experience drove Edwards to create a new kind of cyber insurance company focused on meeting the specific needs of smaller businesses. In early 2018 Edwards left Jungle Disk to launch the San Antonio-based CyberFortress with four Jungle Disk employees: chief technology officer Michael DeFelice, business development lead Beth Watts, product lead Nate Shames, and operations lead Grant Herbon.

Piatt said CyberFortress is “a solution for real risks in online businesses, closing the major gaps left after they obtain policies required by public policy today.”

How CyberFortress Insurance Works

The emerging cyber insurance industry lacks historical data, so Edwards looked for other data-driven approaches to assess cyber risks. CyberFortress looks holistically at the cyber “hygiene” of a smaller business to uncover potential weaknesses when pricing cyber policies. Once a business owner submits a website address to inquire about insurance, the CyberFortress proprietary model calculates the cyber risk score for the business based on factors such as the email domain and website infrastructure the company uses. Using a deep machine learning algorithm, the model gets “smarter” over time at generating a risk score for applicants interested in cyber insurance.

The first policy CyberFortress will offer insures against business interruption for companies with online revenue. The insurance is broader than what is currently available in the event of a cyber attack, as CyberFortress will also cover business losses due to an interruption in the company’s hosting service or e-commerce payment platform.

Another benefit CyberFortress offers is reassessing the customer’s cyber risk on a continuing basis. When the business owner takes steps to strengthen its cyber defenses, the CyberFortress model detects the change and adjusts the policy price to reflect the reduced risk.

“When we provide a potential customer their risk score for free, we also give them recommendations based on the score every month, regardless of whether they buy our insurance policy or not,” Edwards said.

CyberFortress also plans for a responsive claims process to “get money fast into the hands of the small business owner,” according to Edwards. The intent is to pay claims proactively to businesses in the event of a detected business interruption. The business interruption policy does not cover the costs of the data breach, remediation efforts, or for a cyber investigation, Edwards said. However, should an e-commerce company’s website go down for 12 or more hours, CyberFortress will initiate the claims process for the business and send payments.

“If a small business cannot recover quickly from such an interruption, it’s enough to derail the company,” Edwards said. “CyberFortress can get a cyber claim paid within 24 hours of an incident and continue to pay business owners on a daily basis.”

CyberFortress plans to roll out policies in 2019 on a state by state basis, with Texas as its first base for operations. Plans are to offer small business owners the option to pay policy premiums on a monthly basis, rather than in one lump annual sum.

The company has received a seed round of funding from Porthcawl Holdings, Jungle Disk’s parent company, and has the potential for additional funding in the coming months, according to Edwards. The cyber insurance startup operates out of Geekdom, a San Antonio co-working space. The five-member startup is looking to hire a data scientist and others to fill insurance-related roles in the new company.

Launching a new way of providing cyber insurance will hopefully prompt small business owners to take steps to strengthen cyber defenses for reduced premiums.

“We’re helping to promote good cyber hygiene by building an ongoing relationship with our customers,” Edwards said.

Featured image is of the CyberFortress team. From left: Michael DeFelice, Huw Edwards, Beth Watts, Nate Shames, and Grant Herbon. Not pictured is Halie Koehler. Courtesy photo.