Startup Cowbell Cyber Inc. is applying machine learning to the small but growing market for cybersecurity insurance.

It’s doing so with the announcement today of a continuous underwriting platform that it claims brings new levels of precision to risk assessment to enable more insurers to write policies with greater confidence.

The company is targeting small and midsized business, which currently are the predominant buyers of cyber insurance policies. Its approach amasses data from numerous external sources such as threat databases and dark web catalogs and combines it with information provided by the insured companies through security aggregators, which are third parties that capture customers’ log data to detect anomalies.

The product initially supports Amazon Web Services Inc. Security Hub and Microsoft Corp.’s Security Score, with support for Splunk Inc. log analytics in the works. The company has secured $3.3 million in seed funding from a variety of insurance, cybersecurity and AI-focused venture sources.

Cyber insurance is a relatively new form of coverage that has struggled to go mainstream because of a combination of inconsistent policies and lack of clear definitions. The market more than doubled from 2015, to $2 billion in 2018, according to a recent A.M. Best Co. Inc. report. However, growth slowed to 12.6% last year from 30% the previous year. Nevertheless, Allied Market Research expects the market to reach $14 billion globally in 2022.

Data dearth

One of the barriers to broader acceptance is the difficulty of assessing risk in a constantly changing field, said Jack Kudale, founder and chief executive of Cowbell. There’s also a dearth of data because of a lack of history about breaches and associated costs compared with more traditional categories like natural disasters and traffic accidents. Calculating payments is another impediment because cyber insurance claims may include such new factors as the cost of notifying affected parties, lost business from downtime and remedial expenses such as paying for credit monitoring services.

Cyber insurance is also frequently embedded in other policies with exclusions that can block claim payments. Business interruption claims take an average of 18 months to settle, Cowbell said.

“Cyber insurance is typically underwritten only once a year because underwriters don’t have enough data to calculate risk,” Kudale said. Applicants may have to answer up to 200 questions to be considered for coverage, he added.

Cowbell uses a combination of “inside-out” and “outside-in” data gathering techniques to assess risk. The inside-out approach analyzes data from security aggregators to analyze an individual organization’s configurations, vulnerabilities and compliance status. The outside-in approach taps into a multitude of external sources about overall cybersecurity trends.

“We’ve built a ratings factor that goes to a much more granular level for each insurable threat, including fines, notification expenses and business income,” Kudale said. “This is directly mapped to risk exposures.”

The resulting Cowbell Factor score enables protection to be customized and policies matched to customers’ needs as they evolve, the company said. Coverage is specifically designed for cyber risk exposure and not entwined with other policy types.

The company isn’t an insurer but a monoline cyber insurance provider, meaning that it specializes in a specific kind of insurable risk. It plans initially to make its cyber insurance policy available in California early next year via a retail broker distribution channel for businesses of up to $250 million in revenue. It expects to roll out to 15 states in all next year.

Image: Pixabay