Why October Is the Perfect Time to Talk About Cyber Insurance

October is National Cybersecurity Awareness Month. As someone who has worked in cyber since 2009, I’ve seen the complexity and challenges this brings to individuals and businesses.

The good news? While in 2009 cyber insurance was barely on the radar, in 2016/2017 cyber insurance became a necessary component of risk management. In response to the series of high-profile breaches, and the cost becoming unrealistic for businesses to survive, these risks prompted businesses to look to the insurance industry to meet their needs. Since then, it has made real strides to help businesses stay whole in the face of growing digital risks.

In the 16 years since I began this journey, an entire ecosystem of vendors has emerged. Each promising solutions against risks like phishing, ransomware, or identity theft. They play a crucial role, but so does insurance when those defenses fail. The bad news? Cyber fraud continues to get smarter. As every business owner knows, there’s no single “silver bullet” that keeps your doors open to clients while staying firmly closed to attackers.

This is why insurance matters. Technology can reduce the risk, but when losses slip through, the right coverage helps to ensure your business survives. The key is understanding what makes sense for your unique exposures, and pairing protection with practical risk management.

What the Experts Are Saying About Cyber Risk in 2025

When reviewing sources like CrowdStrike, RSA, Coalition, and At-Bay, here are the Top 5 Cyber Trends business owners need to keep in mind:

1. Ransomware Evolution – Attacks are more targeted and often paired with extortion.
2. Supply Chain Attacks – Breaches through vendors, contractors, or software providers are now a leading cause of loss.
3. Social Engineering Fraud – Impersonation and phishing continue to rise, targeting finance staff and executives directly.
4. Regulatory Pressure – New privacy and reporting requirements mean fines and penalties are more likely after a breach.
5. Insurance + Security Integration – Carriers like Coalition and At-Bay use real-time scanning and monitoring tools to help insureds lower risk—and sometimes even qualify for better premiums.

A Relevant Voice: Brian Krebs on Cyber Insurance

I first met Brian years ago at a book signing and later heard him speak. His insights have helped shape how I view cyber risk.

Brian Krebs is an investigative journalist. He is the man behind KrebsOnSecurity and has long commented on the role of cyber insurance. Two of his insights stand out to me:

“A strong password is good. Multi-factor is better. Education is best.” — Brian Krebs

This captures a truth, that no insurance policy can replace basic internal business procedures. Strong coverage still depends on your business doing the fundamentals: MFA, staff training, and sound controls.

Not to leave anyone out, Krebs has also criticized the way insurers price policies, noting that the industry often misses the most important variables:

“We can’t price Cyber Insurance because the industry isn’t measuring the right variables. Each company is responsible for their own … understanding the infrastructure, your cyber data and intelligence and the quantification of your Cyber Risk.” — Brian Krebs

That warning remains relevant as systemic risks like supply chain breaches grow more common. That’s why having someone who understands the history of Cyber who is helping you come up with your business policies is so important, and why it’s becoming increasingly important to have someone with experience in the industry to help make sure you’re not underinsured. Many businesses carry only $50,000 to $100,000 in coverage for email compromise or funds transfer fraud. Yet the average initial compromise is nearly $200,000 and often much higher. Cyber coverage is no longer optional. Few businesses can absorb $85,000 to $1M in losses out of pocket. That’s why it’s vital for providers and advisors to understand the policy language, limits, and risks before recommending coverage.

What This Means for Your Business

When reviewing these top five risks, here’s what it means for you as a business owner:

• You still need technology: MFA, EDR, backups, and vendor risk management are essential.
• You need education:  employees are the first line of defense against social engineering.
• You need the right level of insurance as a backstop:  because even the best systems fail.

Companies like Coalition have pioneered “Active Cyber Insurance,” combining real-time risk scanning with traditional coverage. This model reflects where the industry is heading: not just paying claims, but actively working to prevent them.

Cyber risk isn’t going away, and neither is the complexity. But you don’t have to figure it out alone. National Cybersecurity Awareness Month is a reminder:

• Revisit your controls.
• Revisit your training.
• Revisit your coverage.

This three-part approach: prevention, education, and insurance is the best way to keep your doors open to your clients and firmly closed to attackers.