Hear from a Cyber Security Evangelist on Top Tips to Keep Your Insurance Agency Safe from Attack

By: Joel Zwicker | August 13, 2021

Joel is Agency Revolution’s Chief Evangelist. He has helped hundreds of independent agencies improve KPIs and achieve growth objectives. He coaches them in their digital transformation by helping them leverage digital marketing, marketing automation and content marketing. In addition to his years at Agency Revolution, Joel has extensive agency experience. For 11 years he was an independent agent and spent the last eight of those years overseeing the marketing efforts for a large insurance agency. In that role he opened multiple branch offices, engaged more mature segments of the agency in both their digital and traditional marketing efforts, and spearheaded the agency's initiative to become one of the most 'liked' Insurance agencies on Facebook.

Insurance agencies possess sensitive customer information that fraudsters would love to get their hands on, and insurance itself is a powerful lure for ransomware attacks.

This makes the insurance industry especially vulnerable and attractive for cyber criminals.

Along with all the human and economic suffering caused by the global pandemic, 2020 was also a record-breaking year for hacker attacks and data breaches. Unfortunately, most insurance agencies, like all other businesses, are painfully unprepared for a cyber breach, which seems odd given how much we love to preach to our clients the need for proper cyber liability coverage.

But with a $3.9 million price tag for the average SMB breach, and hackers striking every 39 seconds, it’s never too soon to implement a solid digital security plan.

What Security Really Means

Security is all about staying one step ahead of the cyber criminals and patching the most obvious holes.

As more transactions move online, insurance agents must be more vigilant when handling client information. The insurance industry tends to be slow to adopt technology, but with increasing threats of cyber attacks, it’s more important than ever to evolve your agency’s protective measures.

Cyber literacy training for everyone who handles records and interacts with clients is critical.

An agency’s most vulnerable entry point for fraud is through human interaction, a factor in almost 90% of all data breaches.

With that said, it is amazing how many agencies I’ve come across in my practice where I see them using third party solutions that require them to email lists and/or reports of data from their management system to the third party vendor.

If you’re an agency owner and taking nothing more from this article than this, this is not safe and you should never straight up email a list or report of client info!

You can set up all the software defense layers, but it only takes one person to mistakenly hand over login credentials in a phishing email, and the hacker has gained access to client information.

Another example of ways employees can grant access is via web-based viruses. Employees will inadvertently download a malicious file and now you have malware creeping through your company’s servers.

Cyber Risks and Your Agency

There are some simple steps you can take now to protect your agency, data and clients.

Implementing multi-factor authentication (MFA) is the gold standard for login security measures. MFA is using more than one method to ensure the identity of a user.

Whenever someone — whether an employee or an external user — logs onto a service or app, or accesses an administrative function, they need to provide corroborating information that matches what’s on file. In addition to a password, multi-factor credentials will add another channel, like sending an SMS to the listed mobile number, asking for additional details established through security questions, or requiring a biometric (fingerprint or face scan).

Because SMS channels can be hacked, experts recommend using an authenticator app for MFA.

Your agency is interacting with customers, carriers and vendors. Who should be accessing what information? All information is potentially valuable to a hacker, but the private details entrusted by clients should be particularly protected and available to only a few with security clearance.

Phishing is another hacker favorite.

They create emails that appear to come from trusted companies or people designed to get the receiver to input their credentials or sensitive information like financial details or social security numbers.

Thwart these incursions by training people to never provide sensitive information through a link in an email or even over the phone.

While phishing attempts are broad, spear phishing is much more targeted and planned. Criminals scour employees’ social and other public platforms, looking for details they can use to create realistic extortion schemes.

Awareness training that emphasizes the danger in revealing too much online is important. Also, remind people to never use work emails for non-work related use or list emails on your website. Spam and phishing protection software will also check and filter emails as they come into your system.

As employees moved to telework platforms thanks to the pandemic, it’s more important than ever that company data is secure. All data should be in the cloud and backed up regularly, including an email management system and employee desktops too, an even more secure option than a VPN.

DNS (domain name system) protection is another level of protection that blacklists known danger sites and filters content.

Using secure DNS servers helps your employees from accidentally going to malicious sites, prevents virus “stowaways” on outgoing mail, and also helps prevents hackers from getting into your domain.

Staying on top of critical patch releases will plug vulnerable areas of your site.

Data Is King

Beyond providing cyber literacy training to your employees and storing your data safely, there are solid technological tools that can defend against sophisticated hacker attacks.

Protecting all of your agency assets — financial, data and reputation — and meeting, or better yet, exceeding any state compliance mandates for security measures is a competitive advantage.

The pandemic pushed millions of people into remote work, online shopping and virtual client relations; accompanying that trend is the rapidly growing threat of cyber crime. Data is the lifeblood of cyber criminals, and every day they probe thousands of businesses to find weak points to find information they can extort.

Don’t let yours be one that succumbs to an attack. &

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.