How about actively exploited 0-days? Covered or not covered?
Silicon Valley Cybersecurity Insurance Startup Coalition Profile
Published Mar 20, 2019 16:12 PM
Many industry people believe cybersecurity insurance is not worth it, as the voting and debate in our Cybersecurity Insurance For Security Integrators Guide show.
Now, a Silicon Valley startup named Coalition is offering a different approach, combining insurance with cybersecurity software.
The company claims this positions them to provide better, more targeted coverage at a lower premium since their different facets—assessing risk, insuring against risk, and protecting against risk—create a "feedback loop" of examining, insuring, and protecting that makes all phases of the process more informed and cost-effective.
In this note, based on our talks with Coalition and their cyber insurance wholesale broker, INSUREtrust, we examine:
- This combination of insurance and software
- The company's background
- Competitors
- Funding
- Revenue
- Pricing
- Go-to-market strategy
- Types of coverage
- Software platform
- Competitive advantage
- Input from wholesale broker partner
- Outlook
Two ***** ** **********
********* **** **** ******* *** ******** one **** ** *** ******** ****** branching **** *** *****:
** ******* ** ********* *** **** started ******** *****.
********* **** ********* *** ******** ********* their ******* *** *************** ***** *** company's ************* ******** ***** ***** ** lower-risk ********:
**** **’** ****** ** ** ** not **** ** ** ********* *******, but **** ******** *** ********** *** our *****. ** ******* *** ******** the ***** ** ** ****** ****** risk **** ****.
********* **** **** ***** ***** ********:
** *** ** **** ****** ****** premiums ** ****’** ****** *****.
Company **********
*** *********-***** ********* *** **-******* ** 2017 [**** ** ****** *********] ** CEO ****** ***** [**** ** ****** available] *** *** ** *********:
******** */* ** *** ** *** engineering *** **** ******* *** *** remaining */* ** **** ***** *** half ********** *** **********.
** *** ***** ** * ****, the ****** ** **** ** ** Coalition's ********* *******,***** **,******* ***.
**********
*** ******** ** ****************** ***** **** * *********** ** the ***** "*********" *** "**********," *** comes **** *** **** ** ***** technology ** *********, ** **** ** the ********** **** ************ *****:
Others ** *** *****
***** ********* ******** **** ********* *** technological ***** ******************-***.
*******, ********* *************, * ********* ****** ************ ** cyber ********* *** ************ **** ***** insurers ** *** ******, ********* *** one ** *** ***** ** ***** cyber ********* *** ******-***** ************* ***** together ** *** *** **** **:
*****’** * *** ** ******* *** there ****** ** **** ****** ***** right ***. ********* *** *** ** the ***** ** ******* ***** *** threat ********** ********** **-***** *** ****** an *******, ******.
*********** **** ** ** *********'* ****, cyber-specialty ********* ****** *** ********* ********** their *******.
10,000 ******** *******
*** ******* ****** ** **** "** the ***** ** **,***" ****** ******** that ****'** ****.
*******, **** *** **** **** "************ millions ** *********" ** ***** ** more ********** ******* **** *** ***** more ********* ****** ********:
** ******* *********** ** *** ****** Internet ** ** ******* ***** *** use **** *********** ** *** *** underwrite *** **** ** ******** ** companies. **** ** *********** **** ** use **** *** ** * ******* requests * ***** **** **.
********* ** ***********, *******, **** *** carriers ** *** ****** **** ***** own ********** *** ****** ** ** building **** *** *** ********** **** of *** ********, ***** *** ********. They ******* **** ** *** *** might *** ***** ******* ** ***** of ******** ******** ** “************,” *** a ********* ****** ** ******** ******** placed:
*** *** ********* ** ***** *********, their ********** *** ********** ** ********* the ******** ** ***** *** ** are **** ********* **** **** **** will **** **** **** **** ***** to *** ****** ** ***** ***** books ** ********.
*******
** ******** ****, *** **************** $** ******* ****** ** ****** A *******, **** ************ ********* **** ****** [link ** ****** *********] (** ******** Director ********** ****** ****),****** *******, *** ****** [**** ** ****** available] (********* *** **********), ***** ****** ******** [**** ** longer *********], ***** *******.
*******
*** ******* ***** *** ***** **'* 2018 *******, *** **** **** ** gained ******* **** * **** ******* of ******** **** ****** ********* ***** points:
***** ** ****’* **** ** ******* a ******* ** ******* ** *** moment, ** *** ***** **** ** write ********* ** *** *****, **** individual ********** ********** **** * $**,*** limit *** ******** ** *** ** $50, ** ***** *********** **** ** to * $** ******* ***** *** policies **** ***** ** $***,***.”
*******
** **** ********* ** *******, ********* did *** ***** ********* ** *******, but *** **** **** ***** ******** scaled ** ***** ******, ******* **********:
* *** ** ******* ******* ** the **** ** *** *******, **** their ******** ** *** ***** ****'** located. **’* **** **** ********* ** it’s * **** ******* **** ** is *** * ***** ******’* ******.
*** ******* ************ ****, ** ***** on ***** ******** **** *****, * company *** ** ** ***** ** higher **** **** **** ***** ****** higher *****:
*** ********* ******* ** ***** ******* than *** ****** ******* ** ******* we *** ****** ****** (*** ********* price *** ****) **** ******, ****** at ***** *** ******* *** ** more ********* ** ** ******** * risk **** *** **** ** *** market ******.
Go-To-Market ********
********* ****** *** ********* ******** *** apps **** ******* ********* *******, ** seen ** *** ********** **** ***** site *****:
** * ******** **** ***** *** to ********* ******** ******* ***** *******, the ******** ** ******** ** * broker *******, *** ******* ****:
** **** ** ******* *******. ************ we ** **** ********* **** ***** out ** **, *** **’** ***** them ** *** ** *** ****** partners.
Types ** ********
********* **** **** *** * ****** of********* ******** ************ ** ***** ****, ********* ********* for ******* *********, **********, ******* *****, physical ********* *** ******* ********, *** technology *&* ********.
Software ********
*********'* ******** *********** ********* **-***** *** ** ********* of: ********** *******, ********** **********, ***** Manager, ****** *******, **** **********, ********* Response (*********** ******* ***********.)
**** *** *** ****** *********'* ************* tools *** ** ** ****** ****** to ********.
Competitive *********
********* **** ***** *****-******* ******** ** analyzing, ********** *** ******** *** **** aside **** ****** ** *** ********* space:
*** ******* ************ ******* ****** *** say **** ** **** *** ** is ** *** ** ****** ****-******. Others ******** ** **** * ******** perspective. ** ***** ******** ** ****, what ** ***.
** *** ** **** ********* **** take ********* ** *** ******* ************* tools, ********** **** *** ***** ** lower ******** *** ******* ****.
*******, ** ** **** ****** **** many ****** **** ***** **** ***** existing *******, **** **** *****, *** insurance ******** *** ******** ** *** their ********** ******** ************* *****.
Input **** ********* ****** *******
*********** ** * **** ***********, ** cyber-specialized, ********* ****** ** ********* ********. They *** **** *** ****** * wait-and-see ******** ** *** ********* *********:
** ** ********* ***** ******** *** have * ******* ********** ***** ********** companies *** ******* ** *** **** are **** **** ********* *** **** insurers.
*******
* *** **** ** ******* ****** to ** ** ************ ** ********* and ************* ********** *** **** *** if ********* ******* *** ********* *** of ************* ***** ** *** ***** premiums.
*******, ********* **** ********* *** ****** huge ******* ** **** ** ***** to ***** **** *** ** ***** to **** * ******* *** ***************. Where **** **** ** ******* ** so ***, *** ***** ********** *** whether ** *** **** **** **** be **** ** *** ** * statistic ** * ******?
**** *** *** ******* ** ****** to *** ******** ** ******* ** not ********* **** *** **** ** 3rd *******.
Comments (5)
UE
Undisclosed End User #1
Mar 20, 2019Dan Gelinas
Mar 20, 2019Hello UEU1. Thanks for the question. I can check on that and respond back.
Dan Gelinas
Mar 20, 2019This company originally appeared on our radar when we saw a story in Forbes about a hack of a camera installed at an office located in California. Coalition was interviewed about the breach in Forbes. IPVM also spoke with Coalition about the hack and here's what they said:
IPVM: Can you give me some specifics about the hack mentioned in Forbes?
This was Josh and me in a prior life, actually. It was just something that we happened to see. We both worked at a company prior that dealt with the attribution side. This company dealt with the actor attribution and we did some pretty advanced pen testing. It was pen testing on steroids. One of the clients that we had had some shared infrastructure. And I'll be real honest with you, I can’t remember the model of the camera they had. But they had shared infrastructure. It was a joint office with some other companies. They had a web camera and they had a smart lock hooked up to the shared infrastructure as well. Each company would share the joint internet connection on their own managed devices. One office would have a WiFi router hooked up to a switch, and so on and so forth. During the course of the analysis and testing with this company, we were able to identify a PHP-embedded back end in this camera, which I'm guessing ou are probably aware is some of the worse. And we actually managed to find a zero day associated with that, exploit the camera, get remote shell access. We were able to get into the lock from there, as well. So we could do things like unlock the door. And then we managed to figure out 'Oh hey, we're connected to a switch!' and 'Oh hey, there's the company's WiFi router. And you can imagine all the lateral movement we could do to get into machines from there. It’s all about the class of the device. We generally see two classes of cameras systems. Consumer grade and then enterprise. Each class has its own vulnerabilities. From a camera and IoT perspectve, basically, The cheaper they are the easier they are to get into because they don’t patch these, generally. Like your $10 cameras from China. Depending on the conditions, if it's a small business sharing resources, that can get very nasty very quickly due to lateral movementand remote code exection.
The company noted that this was the type of penetration testing they do to ascertain a company's risk before offering coverage.
U
Undisclosed #2
Mar 20, 2019Does Coalition offer their cyber defense tools as a standalone product? (i.e. without their insurance coverage?)
Dan Gelinas
Mar 20, 2019They say that at this time, the cybersecurity tools are only offered to policyholders