RSA Conference 2024 | Rotem Iram | At-Bay

Clips
News
More from RSA Conference 2024

Rotem Iram

Founder & CEO

At-Bay

Navigating digital threats: The rise of cyber insurance in protecting SMBs

Cyber insurance trends are defining the industry as cybersecurity rapidly becomes the fastest-growing sector.At-Bay Inc. is a cyber insurance and security company focusing on smaller to midsized businesses, with a platform that has over 5,000 active customers consuming its security product. Meanwhile, 93% of small and medium-sized businesses lack modern security technology, creating a market failure, but as an insurance company, At-Bay can help reduce the cost of security and manage it on behalf of their clients, according to Rotem Iram (pictured), founder and chief executive officer of At-Bay

play_circle_outline Market failure in SMB security, lack of modern security adoption

play_circle_outline InsurSec: Meeting SMB Security Needs with At-Bay's Innovative Cyber Insurance Solutions

play_circle_outline The relationship between insurance and security in reducing risk and cost

play_circle_outline Increase in ransomware claims and changing tactics of attackers

play_circle_outline Impact of ransomware attacks on small and mid-sized businesses

Info

Rotem Iram | At-Bay

Rotem Iram

Founder & CEO At-Bay

search

>> Hi everybody. Welcome back to Moscone West. We're here at the RSA 2024 Conference, theCUBE's continuous live coverage. I'm Dave Vellante. My co-host Shelly Kramer is with me. Rotem Iram is here. He's the founder and CEO of At-Bay. Last year we introduced our community to At-Bay, a security company that is also a cyber insurance firm. Rotem, you may remember we talked about having 50 different parts or manufacturers in your car.

Rotem Iram

>> That's

>> right.And the brake manufacturer takes no responsibility, so you need a full-time mechanic if you remember that conversation.

Rotem Iram

>> That's

>> right.But it was very enjoyable.

Rotem Iram

>> Well, thank you for having me back.

>> You're welcome. And it turns out I said, "Wow, this is really interesting. How do we get involved?" Turns out we're a customer.

Rotem Iram

>> There you

>> go.We did that through our, unbeknownst to me, through our agent. So in this interview, we're going to talk about the emergence of the information security or insurance security category, how it's affecting small business, got the potential to set a standard for product quality, consumption across the entire security stack and what's happening in that small to mid-market. So set it up. First of all, how's the show going for you guys? What's happened? What's changed in the year?

Rotem Iram

>> Yeah. Oh, a lot has changed. This show's always exciting. You get to see a lot of new companies and new ideas. Last year was a transformational year for us as well, really launching our InsurSec platform in a meaningful way. I think we have a more than 5,000 active customers on the platform already consuming our security product and we couldn't be more excited about what we're building. The reality is At-Bay is a cyber insurance and security company focusing on those smaller to mid-sized businesses. And what we see is that those companies are being left behind. Just to give you one example, so we have more than 40,000 companies insured by us. Less than 7% of them have an EDR, which means that 93% of them have a very old antivirus technology, and that's kind of bad news. They're being left behind for a number of reasons. First of all, nobody's even trying to sell them modern security because it is too expensive and it is too complicated to manage. Even if you gift them better security, they wouldn't know how to operate it. And so they have this expertise gap and they have this lack of ability to pay, which means they're left with all technology and that is not fixing itself. So we believe that there's a market failure when it comes to SMB security. There is no real consumption of modern security in that segment. What I think is so exciting about InsurSec is that by being their insurance company, we can see that... Well, first of all, let me say they're all buying insurance already. Even though they're not buying security, more than $4 billion of insurance is being sold to SMBs. They have claims that would've been avoided if they had better security. And so now as the insurance company, we say, "Well, it makes sense for us to help bring down the cost of security because we would lose less money as an insurance company." And so by helping you adopt better controls and not only subsidizing or reducing the cost of the security product itself by actually managing your security on your behalf, the first person we're helping is ourselves because we would lose less money. That combination allows us to unlock enterprise-grade quality products and services at the price points that SMBs can actually afford. But it's not just that. We know who to work with, they're already our partners. They know us, they trust us. I think it's a really incredible opportunity to be that kind of single point of this single platform for everything security in the mid-market.

>> I love that perspective.

Shelly Kramer

>> Yeah, me too.We

>> were talking off camera about the Berkshire Hathaway meeting this weekend, the annual shareholders meeting. Ajit Jain was asked the question about cyber insurance. And look, those guys are incredibly successful, but let's face it, they're not cutting-edge technology investors. They finally get into Apple. Of course, it's most of their holdings, their biggest holding now. They hate crypto. We don't agree on everything, but it doesn't mean they're always right, but obviously they're right in a lot of things. His response, however, was interesting to me, and I'd love to get your thoughts on this. It was basically, "Every time we write a cyber insurance policy, we assume we're going to lose money." And so he was sort of being negative about it. Your philosophy is really innovative in my opinion, because you say, "All right, don't assume it. We're going to create a virtuous cycle where we'll help our customers lower their risk, and essentially that will lower our risk." Is that how you think about it?

Rotem Iram

>> Yeah. I mean, as much as cyber is new and complicated to insurance people, because it is a very technical domain and it is a little bit unpredictable because there are new threats and attacks every day, at the end of the day, on the other side there is a human attacker and they have an incentive, which is mostly to make money. And that makes those attacks relatively predictable. I think in the security industry, we love to champion how complicated all of this is, I think so that people would pay us more for our products. But if you look at actual attacks, most of them are very predictable. For five years in a row, 50% of all ransomware in America came from a single product. A vulnerability to a single product caused 50% of all ransomware in America. And so there are ways to understand how attackers are attacking at scale. And again, insurance is different from security, where in security you need to help protect the customer every single time. Insurance, we only need to get it right most of the time, right?

Shelly Kramer

>> Yeah.

Rotem Iram

>> Part of the product is to pay sometimes. And so we believe that by studying how attackers attack, mimicking what they do and then taking away their opportunities by helping our customers close those gaps, we can make them dramatically less likely to be attacked and we can make money. And we've been making money in insurance for every year since we've been in business.

Shelly Kramer

>> Yeah, that's great.And

>> to your point, it's impossible. At least today in this day and age, maybe with AGI that'll change, but it's impossible to have zero risk.

Rotem Iram

>> Yeah.So

>> that means you're going to have to pay out. So that also means then you have to figure out the balance of your portfolio so you can ultimately make money being an insurer. Now you bring data, you've got to report that's coming. I don't know if it's been released yet. It says ransomware claims have jumped dramatically. Maybe you could share that with us. And the smaller businesses, the small and mid-sized businesses are increasingly targets. We talked about this last year. "Hey, I'm a small business, should I not worry?" And you were like, "No, you should worry." Explain.

Rotem Iram

>> Yeah. So what I love about being a... I've started my career in security and I found myself an insurance guy. What I love about insurance is the very strong feeling that this is the most important company you can build in security right now because we are the ones who pay and again and again and we need to figure out why do we pay, where does damage come from. We get to collect a lot of data about what works and where do businesses fail. And what we've seen this year, and this is a report that's coming probably next week, is that first of all, looking at ransomware, last year, ransomware went down quite considerably. Or in 2022, it went down considerably. I think some people were early to celebrate that we finally got the better of the attackers. It seems like that was a temporary break potentially due to the conflict between Russia and the Ukraine that kind of caused some attack groups to maybe lose focus for a while. We're seeing more ransomware, dramatically more ransomware than we've seen in earlier years. In some ways it's the same story. It's predictable. Attackers are going after remote access, perimeter technology, exploiting vulnerabilities in those technologies in the same ways they've done before. What is new, and I think really interesting, is that the attackers have slightly changed their tactics, but the ripple effects have been meaningful. And so historically, attackers would encrypt your data and hold you ransom, "Pay me so that I would un-encrypt your data so you can use your systems again." More and more companies are getting better with their backup solutions and they don't want to pay. So the attackers are now both encrypting your data and exfiltrating the data. And so they create a double leverage for themselves. "We encrypted your data, you need us to get it back, but we will also release it to everybody including all your customer's data if you don't." And what ends up happening is that now you might be safe and you may not have had a ransomware attack yourself, but if a partner of yours or a vendor of yours have had a ransomware and their data has been exposed, now you have a data privacy breach. So we're seeing what we call a larger blast radius from each and every ransomware now impacting tons and tons of third party connected supply chain vendors in each and every attack. Just to give you a couple of examples from last year, we saw with the Move It vulnerability, we saw a huge spike in both education organizations and in financial services that suddenly found that their data was online because a vendor of theirs got attacked. And that is becoming a bigger part of the risk that the company needs to take a look and understand how to deal with.

Shelly Kramer

>> I think that one of the things about the SMB's focus that is so impactful is that I think a lot of people when they think about security, they think about only really big companies need this. But the reality of it is, threat actors are, you mentioned earlier, highly motivated by money. The more quickly we can figure out how to leverage AI to fuel our attacks and that sort of thing, the more money we can potentially make. And small businesses, I mean their breaches don't net as much revenue, but I think some of the stats are all over the board, but I think one of the things that I saw recently was an average loss of a small business in an attack is about $50,000. I feel like that's probably on the lower end. But the reality of it is when you think about my yoga practice or my chiropractor's office or my kid's school, $50,000 is a significant amount of money. So it's a huge market and it makes a lot of sense to target there.

Rotem Iram

>> Well, first of all, it's easy to forget about small businesses, but that's 70% of GDP in this country. So 70% of employees work for a small business and it's 90% of all businesses in the country. And so there's a lot of value there and a lot of damage. It's a different profile of an attack. The attacker is more opportunistic, it's more automated, it's more predictable in a way, but the damages are greater when in comparison to the size of the organization. So SMBs struggle to recover from an attack. They don't carry as much insurance. Our numbers show it's 280,000 on average for a ransomware attack on a small company. And 280K can very often be the end of a small business. And so-

Shelly Kramer

>> Right. And also, many of them don't survive a significant number of years after a breach. You just can't recover that.

Rotem Iram

>> And from our perspective, the real issue is that you talk to these businesses and they are overwhelmed. They're overwhelmed. They cannot deal with all this themselves. We talked about this last year. We're asking them to do too much. They are buying IT. They're paying for it. That IT has holes in it. Nobody's helping them, nobody's notifying them. They need to now be able to identify, fix it, stay on top, deal with the attackers. It's too much. They lack the expertise. That's where we think that security companies are not stepping in mostly because they can't make the economics work. They just can't afford the cost of acquisition. As the insurance company, we can come in and we can actually solve this. That to me is incredibly exciting because we're not just competing. We're filling a gap that is really meaningful that I think is hitting the underbelly of American businesses. It's

>> a-And that 280K, that's ransomware that you might pay, lost productivity-

Shelly Kramer

>> Business continuity. All

Rotem Iram

>> of that.Yes. Restoration of systems.

>> Lost revenue.

Rotem Iram

>> Legal fees and fines and penalties and-

>> Real dollars.

Rotem Iram

>> Oh yeah, there's a lot of money there.

>> So the basic premise, if I understand it, is you're helping the business improve its security posture.

Rotem Iram

>> That's correct.

>> You'll also recommend actions, processes, tooling as well?

Rotem Iram

>> So when we start is we actually provide you with our own MDR solution. And so we come in, we have a partnership with CrowdStrike, we come in, we upgrade your security to the most modern cutting edge enterprise-grade security. We manage it on your behalf. We have an MDR team that spans the globe 24/7, 365. So every time something alerts on any one of your endpoints is our analysts who are remediating responding to the issue. And then we kind of alert and then we bring in the client when needed. But we do the work for you because we understand this is technical. This is not something that you're set up to deal with yourself. So our SOC takes care of the issues for the customers. We can do it by providing them with the same MDR, we can dramatically reduce the losses on the insurance policy. And that means that we can create savings for you that basically at the end of the day makes this a very easy decision for you. Because up until now, you were paying for insurance, you didn't feel like you could pay for an EDR. Now you're getting the whole thing for basically the same price. It's a huge, huge benefit for the customer.

Shelly Kramer

>> Yeah, that's very attractive.Very

>> few small businesses, probably none, maybe there's a handful, like highly technical businesses, but the very few small and mid-sized businesses are going to be able to have better security than what you could provide through your managed service. Fair premise?

Rotem Iram

>> Absolutely. And again, sitting here in San Francisco, there's a bias. When you ask somebody here what is an SMB, they say a startup.

>> Right. Right.

Rotem Iram

>> But SMBs, what we call east of Reno, the real SMBs are non-technical. Oftentimes legacy organizations with people, entrepreneurs who are passionate about what they do, but not necessarily passionate about cybersecurity. And I don't blame them. It's not something they should be spending their time on.

Shelly Kramer

>> Well, and the reality of it is though, when you're competing for tech talent against the Googles and the AWSs and the IBMs of the world-

Rotem Iram

>> It's impossible....

Shelly Kramer

>> coming to work for my little 200 person SMB, I mean, how do I compete for that kind of talent? You really can't.

Rotem Iram

>> It's very difficult. And I would also say, if you are on a limited budget, you know that the big, big, big enterprise clients, they buy one of everything. But if you're on limited budget, it really is difficult to understand what actually matters and how much should you pay. What I also love about the advantage of an insurance company is because we're the ones losing money, then we can say how much does each and every security control actually help drive down losses, which is why we show that certain technologies in your stack correlate or directly contribute to lower or higher losses. And that, if anything, is to me the best way to figure out, "Okay, what should my stack look like?" And that's why if you take a big, big step back, you look at the role that insurance plays in every domain of risk, insurance is always the standard set. It is always the regulator. Even in this building, there are sprinkler systems here because of the insurance code, not because we're passionate about the brand of the sprinkler's company, right? And to me, that's where I think security, especially in the small businesses, is going to.

Shelly Kramer

>> So how much of a challenge is it educating your buyers about this? Because most of us have been buying insurance for a significant part of our lives, right?

Rotem Iram

>> Yes.

Shelly Kramer

>> Our home, our cars, our whatever, but it's pretty unusual to contract with an insurance company who also has this technology solution that protects me in a different way than my policy does. So how much of a challenge is educating this package deal that you have?

Rotem Iram

>> Yeah, so look, when we started the company seven years ago, cyber insurance purchasing in the US was under a billion dollars. It's 12 billion today. And so it's growing pretty quickly and the expectation that we're only in the first stage of this product really being picked up. And so we've undergone this education journey first that cyber insurance is even a thing that you should be buying. I think that our bundling with security makes sense to our customers because for the larger part, they've heard about these better technologies. They just can't really afford them. They're all buying an old antivirus. They realize that this is an old technology, they don't necessarily want to be paying for it. But when we come in, especially when we can just lower the overall cost in a way that makes it very easy for them to buy, they don't need a ton more.

Shelly Kramer

>> Yeah,

Rotem Iram

>> it sounds like it's a fairly easy sell.Yes, it is.

Shelly Kramer

>> .And

Rotem Iram

>> we're converting at really good numbers, so-

Shelly Kramer

>> That's a wonderful problem to have.

Rotem Iram

>> Yes.

>> Well, I mean, insurance companies ultimately will figure this out because they're smart, they're well capitalized, but they're slow generally.

Rotem Iram

>> Yes.

>> And if you go to an insurance company that is not tech-savvy, that is not cyber-savvy, what are they going to do? They're going to charge you a higher premium to protect their risk. So you come in and say, "Look, we're going to be more economically competitive because we can lower your risk. We can lower our risk. We'll pass some of that on. We'll make a nice profit." Okay, say at the same time, by combining managed services with insurance, I could get a double savings because we've looked at managed services and they can tend to get very expensive. And so now I have a managed service stovepipe. I have an insurance stovepipe. So it just to me is natural that those two worlds are coming together. My question is, where does AI fit because, okay, so eventually, my point is that your competitors, the big insurance companies, will figure it out, but you're more technically savvy. How were you using AI prior to ChatGPT? How has it evolved? How does it give you competitive advantage?

Rotem Iram

>> Yeah, we actually meet AI twice. We meet AI as an organization trying to leverage it to get better, but we also see the attackers using AI. And that is interesting as well. And unfortunately with every new technology, attackers are always faster than defenders to adopt.

Shelly Kramer

>> Oh yeah.

>> Right.

Rotem Iram

>> I can spend two minutes on attackers, I'll talk about the defenders afterwards. The attackers are using AI in two ways. The most benign way is to improve fraud. Fraud is still the number one way of attacking companies. It's tricking you to send money to the wrong bank account. And gen AI has made fraud. We all know that almost by joke, the Nigerian Prince-type scams and how unreliable they are. Gen AI-driven attacks are very reliable. It's not only better text, it's now speech and video and it's getting very, very scary. And remember, attackers go to where it's easiest. And so we've now made it incredibly easy to defraud people, that is about to explode. Later on, we see AI as a potential hacker, finding vulnerabilities. So having an AI help you find vulnerabilities in a new product, that's going to be very scary when that joins in as well. From our perspective, so much of our work, and you've hit the nail on the head, there's a lot of operations involved, we hold the hands of our insurers both when it comes to the insurance side, but also with the managed security side. There's incredible efficiencies to be had by leveraging AIs to drive automation. And Gen AI is a new kind of group of algorithms that is solving some use cases around language mostly, but we've been using automation in AI for the sake of automation in a very meaningful way. The most important KPI in an MDR is your kind of analyst per endpoints. How many endpoints can a single analyst monitor? Can you get beyond the 50,000 endpoints per analyst? And with AI, I think that that type of building a stack, an MDR stack today in 2024 is a lot more attractive than it was five years ago. We see us as having a big advantage by having built this now.

>> So the defenders are closing the gap to the attackers. Would you agree or no?

Rotem Iram

>> I would say that with AI, the gap is going to increase before it closes back again.

>> Initially increases. Does it ultimately decrease or no?

Rotem Iram

>> Well, in the 20 years I've been in this, it does not. Not yet.

>> Does it slingshot or does it just stay?

Rotem Iram

>> I think that what we've seen historically is that attackers are capped by the human operators because there always needs to be a human at the end. And so even if everybody's vulnerable, if you only have 20 hackers, you can only attack 20 companies at a time. And that has historically been the cap. With AI, can that break...

Shelly Kramer

>> It could scale.Changes, yeah.That

>> could scale. But I'm also hopeful. I think that cloud does create this moment of change where environments that are in the cloud are much easier to protect. Most SMBs, 90% of SMBs are still on-prem or hybrid on-prem and cloud. In the cloud, I think defenders stand more of a chance. So the more that we can accelerate the move of customers from on-prem environments to cloud environments, I think the more chances we have.Rotem, awesome talking to you again. We got to go. Thanks so much for coming back to theCUBE. And best of luck.

Rotem Iram

>> Thank you for having me.

Shelly Kramer

>> Absolutely.

>> Pleasure. All right, you're very welcome. Okay, keep it right there. This is Dave Vellante for Shelly Kramer and David Linthicum. We're live at RSAC 2024 in Moscone West. We're at Broadcast Alley. Come see us. We'll be right back right after this break.

Rotem Iram | At-Bay

search

>> Hi everybody. Welcome back to Moscone West. We're here at the RSA 2024 Conference, theCUBE's continuous live coverage. I'm Dave Vellante. My co-host Shelly Kramer is with me. Rotem Iram is here. He's the founder and CEO of At-Bay. Last year we introduced our community to At-Bay, a security company that is also a cyber insurance firm. Rotem, you may remember we talked about having 50 different parts or manufacturers in your car.

Rotem Iram

>> That's

>> right.And the brake manufacturer takes no responsibility, so you need a full-time mechanic if you remember that conversation.

Rotem Iram

>> That's

>> right.But it was very enjoyable.

Rotem Iram

>> Well, thank you for having me back.

>> You're welcome. And it turns out I said, "Wow, this is really interesting. How do we get involved?" Turns out we're a customer.

Rotem Iram

>> There you

>> go.We did that through our, unbeknownst to me, through our agent. So in this interview, we're going to talk about the emergence of the information security or insurance security category, how it's affecting small business, got the potential to set a standard for product quality, consumption across the entire security stack and what's happening in that small to mid-market. So set it up. First of all, how's the show going for you guys? What's happened? What's changed in the year?

Rotem Iram

>> Yeah. Oh, a lot has changed. This show's always exciting. You get to see a lot of new companies and new ideas. Last year was a transformational year for us as well, really launching our InsurSec platform in a meaningful way. I think we have a more than 5,000 active customers on the platform already consuming our security product and we couldn't be more excited about what we're building. The reality is At-Bay is a cyber insurance and security company focusing on those smaller to mid-sized businesses. And what we see is that those companies are being left behind. Just to give you one example, so we have more than 40,000 companies insured by us. Less than 7% of them have an EDR, which means that 93% of them have a very old antivirus technology, and that's kind of bad news. They're being left behind for a number of reasons. First of all, nobody's even trying to sell them modern security because it is too expensive and it is too complicated to manage. Even if you gift them better security, they wouldn't know how to operate it. And so they have this expertise gap and they have this lack of ability to pay, which means they're left with all technology and that is not fixing itself. So we believe that there's a market failure when it comes to SMB security. There is no real consumption of modern security in that segment. What I think is so exciting about InsurSec is that by being their insurance company, we can see that... Well, first of all, let me say they're all buying insurance already. Even though they're not buying security, more than $4 billion of insurance is being sold to SMBs. They have claims that would've been avoided if they had better security. And so now as the insurance company, we say, "Well, it makes sense for us to help bring down the cost of security because we would lose less money as an insurance company." And so by helping you adopt better controls and not only subsidizing or reducing the cost of the security product itself by actually managing your security on your behalf, the first person we're helping is ourselves because we would lose less money. That combination allows us to unlock enterprise-grade quality products and services at the price points that SMBs can actually afford. But it's not just that. We know who to work with, they're already our partners. They know us, they trust us. I think it's a really incredible opportunity to be that kind of single point of this single platform for everything security in the mid-market.

>> I love that perspective.

Shelly Kramer

>> Yeah, me too.We

>> were talking off camera about the Berkshire Hathaway meeting this weekend, the annual shareholders meeting. Ajit Jain was asked the question about cyber insurance. And look, those guys are incredibly successful, but let's face it, they're not cutting-edge technology investors. They finally get into Apple. Of course, it's most of their holdings, their biggest holding now. They hate crypto. We don't agree on everything, but it doesn't mean they're always right, but obviously they're right in a lot of things. His response, however, was interesting to me, and I'd love to get your thoughts on this. It was basically, "Every time we write a cyber insurance policy, we assume we're going to lose money." And so he was sort of being negative about it. Your philosophy is really innovative in my opinion, because you say, "All right, don't assume it. We're going to create a virtuous cycle where we'll help our customers lower their risk, and essentially that will lower our risk." Is that how you think about it?

Rotem Iram

>> Yeah. I mean, as much as cyber is new and complicated to insurance people, because it is a very technical domain and it is a little bit unpredictable because there are new threats and attacks every day, at the end of the day, on the other side there is a human attacker and they have an incentive, which is mostly to make money. And that makes those attacks relatively predictable. I think in the security industry, we love to champion how complicated all of this is, I think so that people would pay us more for our products. But if you look at actual attacks, most of them are very predictable. For five years in a row, 50% of all ransomware in America came from a single product. A vulnerability to a single product caused 50% of all ransomware in America. And so there are ways to understand how attackers are attacking at scale. And again, insurance is different from security, where in security you need to help protect the customer every single time. Insurance, we only need to get it right most of the time, right?

Shelly Kramer

>> Yeah.

Rotem Iram

>> Part of the product is to pay sometimes. And so we believe that by studying how attackers attack, mimicking what they do and then taking away their opportunities by helping our customers close those gaps, we can make them dramatically less likely to be attacked and we can make money. And we've been making money in insurance for every year since we've been in business.

Shelly Kramer

>> Yeah, that's great.And

>> to your point, it's impossible. At least today in this day and age, maybe with AGI that'll change, but it's impossible to have zero risk.

Rotem Iram

>> Yeah.So

>> that means you're going to have to pay out. So that also means then you have to figure out the balance of your portfolio so you can ultimately make money being an insurer. Now you bring data, you've got to report that's coming. I don't know if it's been released yet. It says ransomware claims have jumped dramatically. Maybe you could share that with us. And the smaller businesses, the small and mid-sized businesses are increasingly targets. We talked about this last year. "Hey, I'm a small business, should I not worry?" And you were like, "No, you should worry." Explain.

Rotem Iram

>> Yeah. So what I love about being a... I've started my career in security and I found myself an insurance guy. What I love about insurance is the very strong feeling that this is the most important company you can build in security right now because we are the ones who pay and again and again and we need to figure out why do we pay, where does damage come from. We get to collect a lot of data about what works and where do businesses fail. And what we've seen this year, and this is a report that's coming probably next week, is that first of all, looking at ransomware, last year, ransomware went down quite considerably. Or in 2022, it went down considerably. I think some people were early to celebrate that we finally got the better of the attackers. It seems like that was a temporary break potentially due to the conflict between Russia and the Ukraine that kind of caused some attack groups to maybe lose focus for a while. We're seeing more ransomware, dramatically more ransomware than we've seen in earlier years. In some ways it's the same story. It's predictable. Attackers are going after remote access, perimeter technology, exploiting vulnerabilities in those technologies in the same ways they've done before. What is new, and I think really interesting, is that the attackers have slightly changed their tactics, but the ripple effects have been meaningful. And so historically, attackers would encrypt your data and hold you ransom, "Pay me so that I would un-encrypt your data so you can use your systems again." More and more companies are getting better with their backup solutions and they don't want to pay. So the attackers are now both encrypting your data and exfiltrating the data. And so they create a double leverage for themselves. "We encrypted your data, you need us to get it back, but we will also release it to everybody including all your customer's data if you don't." And what ends up happening is that now you might be safe and you may not have had a ransomware attack yourself, but if a partner of yours or a vendor of yours have had a ransomware and their data has been exposed, now you have a data privacy breach. So we're seeing what we call a larger blast radius from each and every ransomware now impacting tons and tons of third party connected supply chain vendors in each and every attack. Just to give you a couple of examples from last year, we saw with the Move It vulnerability, we saw a huge spike in both education organizations and in financial services that suddenly found that their data was online because a vendor of theirs got attacked. And that is becoming a bigger part of the risk that the company needs to take a look and understand how to deal with.

Shelly Kramer

>> I think that one of the things about the SMB's focus that is so impactful is that I think a lot of people when they think about security, they think about only really big companies need this. But the reality of it is, threat actors are, you mentioned earlier, highly motivated by money. The more quickly we can figure out how to leverage AI to fuel our attacks and that sort of thing, the more money we can potentially make. And small businesses, I mean their breaches don't net as much revenue, but I think some of the stats are all over the board, but I think one of the things that I saw recently was an average loss of a small business in an attack is about $50,000. I feel like that's probably on the lower end. But the reality of it is when you think about my yoga practice or my chiropractor's office or my kid's school, $50,000 is a significant amount of money. So it's a huge market and it makes a lot of sense to target there.

Rotem Iram

>> Well, first of all, it's easy to forget about small businesses, but that's 70% of GDP in this country. So 70% of employees work for a small business and it's 90% of all businesses in the country. And so there's a lot of value there and a lot of damage. It's a different profile of an attack. The attacker is more opportunistic, it's more automated, it's more predictable in a way, but the damages are greater when in comparison to the size of the organization. So SMBs struggle to recover from an attack. They don't carry as much insurance. Our numbers show it's 280,000 on average for a ransomware attack on a small company. And 280K can very often be the end of a small business. And so-

Shelly Kramer

>> Right. And also, many of them don't survive a significant number of years after a breach. You just can't recover that.

Rotem Iram

>> And from our perspective, the real issue is that you talk to these businesses and they are overwhelmed. They're overwhelmed. They cannot deal with all this themselves. We talked about this last year. We're asking them to do too much. They are buying IT. They're paying for it. That IT has holes in it. Nobody's helping them, nobody's notifying them. They need to now be able to identify, fix it, stay on top, deal with the attackers. It's too much. They lack the expertise. That's where we think that security companies are not stepping in mostly because they can't make the economics work. They just can't afford the cost of acquisition. As the insurance company, we can come in and we can actually solve this. That to me is incredibly exciting because we're not just competing. We're filling a gap that is really meaningful that I think is hitting the underbelly of American businesses. It's

>> a-And that 280K, that's ransomware that you might pay, lost productivity-

Shelly Kramer

>> Business continuity. All

Rotem Iram

>> of that.Yes. Restoration of systems.

>> Lost revenue.

Rotem Iram

>> Legal fees and fines and penalties and-

>> Real dollars.

Rotem Iram

>> Oh yeah, there's a lot of money there.

>> So the basic premise, if I understand it, is you're helping the business improve its security posture.

Rotem Iram

>> That's correct.

>> You'll also recommend actions, processes, tooling as well?

Rotem Iram

>> So when we start is we actually provide you with our own MDR solution. And so we come in, we have a partnership with CrowdStrike, we come in, we upgrade your security to the most modern cutting edge enterprise-grade security. We manage it on your behalf. We have an MDR team that spans the globe 24/7, 365. So every time something alerts on any one of your endpoints is our analysts who are remediating responding to the issue. And then we kind of alert and then we bring in the client when needed. But we do the work for you because we understand this is technical. This is not something that you're set up to deal with yourself. So our SOC takes care of the issues for the customers. We can do it by providing them with the same MDR, we can dramatically reduce the losses on the insurance policy. And that means that we can create savings for you that basically at the end of the day makes this a very easy decision for you. Because up until now, you were paying for insurance, you didn't feel like you could pay for an EDR. Now you're getting the whole thing for basically the same price. It's a huge, huge benefit for the customer.

Shelly Kramer

>> Yeah, that's very attractive.Very

>> few small businesses, probably none, maybe there's a handful, like highly technical businesses, but the very few small and mid-sized businesses are going to be able to have better security than what you could provide through your managed service. Fair premise?

Rotem Iram

>> Absolutely. And again, sitting here in San Francisco, there's a bias. When you ask somebody here what is an SMB, they say a startup.

>> Right. Right.

Rotem Iram

>> But SMBs, what we call east of Reno, the real SMBs are non-technical. Oftentimes legacy organizations with people, entrepreneurs who are passionate about what they do, but not necessarily passionate about cybersecurity. And I don't blame them. It's not something they should be spending their time on.

Shelly Kramer

>> Well, and the reality of it is though, when you're competing for tech talent against the Googles and the AWSs and the IBMs of the world-

Rotem Iram

>> It's impossible....

Shelly Kramer

>> coming to work for my little 200 person SMB, I mean, how do I compete for that kind of talent? You really can't.

Rotem Iram

>> It's very difficult. And I would also say, if you are on a limited budget, you know that the big, big, big enterprise clients, they buy one of everything. But if you're on limited budget, it really is difficult to understand what actually matters and how much should you pay. What I also love about the advantage of an insurance company is because we're the ones losing money, then we can say how much does each and every security control actually help drive down losses, which is why we show that certain technologies in your stack correlate or directly contribute to lower or higher losses. And that, if anything, is to me the best way to figure out, "Okay, what should my stack look like?" And that's why if you take a big, big step back, you look at the role that insurance plays in every domain of risk, insurance is always the standard set. It is always the regulator. Even in this building, there are sprinkler systems here because of the insurance code, not because we're passionate about the brand of the sprinkler's company, right? And to me, that's where I think security, especially in the small businesses, is going to.

Shelly Kramer

>> So how much of a challenge is it educating your buyers about this? Because most of us have been buying insurance for a significant part of our lives, right?

Rotem Iram

>> Yes.

Shelly Kramer

>> Our home, our cars, our whatever, but it's pretty unusual to contract with an insurance company who also has this technology solution that protects me in a different way than my policy does. So how much of a challenge is educating this package deal that you have?

Rotem Iram

>> Yeah, so look, when we started the company seven years ago, cyber insurance purchasing in the US was under a billion dollars. It's 12 billion today. And so it's growing pretty quickly and the expectation that we're only in the first stage of this product really being picked up. And so we've undergone this education journey first that cyber insurance is even a thing that you should be buying. I think that our bundling with security makes sense to our customers because for the larger part, they've heard about these better technologies. They just can't really afford them. They're all buying an old antivirus. They realize that this is an old technology, they don't necessarily want to be paying for it. But when we come in, especially when we can just lower the overall cost in a way that makes it very easy for them to buy, they don't need a ton more.

Shelly Kramer

>> Yeah,

Rotem Iram

>> it sounds like it's a fairly easy sell.Yes, it is.

Shelly Kramer

>> .And

Rotem Iram

>> we're converting at really good numbers, so-

Shelly Kramer

>> That's a wonderful problem to have.

Rotem Iram

>> Yes.

>> Well, I mean, insurance companies ultimately will figure this out because they're smart, they're well capitalized, but they're slow generally.

Rotem Iram

>> Yes.

>> And if you go to an insurance company that is not tech-savvy, that is not cyber-savvy, what are they going to do? They're going to charge you a higher premium to protect their risk. So you come in and say, "Look, we're going to be more economically competitive because we can lower your risk. We can lower our risk. We'll pass some of that on. We'll make a nice profit." Okay, say at the same time, by combining managed services with insurance, I could get a double savings because we've looked at managed services and they can tend to get very expensive. And so now I have a managed service stovepipe. I have an insurance stovepipe. So it just to me is natural that those two worlds are coming together. My question is, where does AI fit because, okay, so eventually, my point is that your competitors, the big insurance companies, will figure it out, but you're more technically savvy. How were you using AI prior to ChatGPT? How has it evolved? How does it give you competitive advantage?

Rotem Iram

>> Yeah, we actually meet AI twice. We meet AI as an organization trying to leverage it to get better, but we also see the attackers using AI. And that is interesting as well. And unfortunately with every new technology, attackers are always faster than defenders to adopt.

Shelly Kramer

>> Oh yeah.

>> Right.

Rotem Iram

>> I can spend two minutes on attackers, I'll talk about the defenders afterwards. The attackers are using AI in two ways. The most benign way is to improve fraud. Fraud is still the number one way of attacking companies. It's tricking you to send money to the wrong bank account. And gen AI has made fraud. We all know that almost by joke, the Nigerian Prince-type scams and how unreliable they are. Gen AI-driven attacks are very reliable. It's not only better text, it's now speech and video and it's getting very, very scary. And remember, attackers go to where it's easiest. And so we've now made it incredibly easy to defraud people, that is about to explode. Later on, we see AI as a potential hacker, finding vulnerabilities. So having an AI help you find vulnerabilities in a new product, that's going to be very scary when that joins in as well. From our perspective, so much of our work, and you've hit the nail on the head, there's a lot of operations involved, we hold the hands of our insurers both when it comes to the insurance side, but also with the managed security side. There's incredible efficiencies to be had by leveraging AIs to drive automation. And Gen AI is a new kind of group of algorithms that is solving some use cases around language mostly, but we've been using automation in AI for the sake of automation in a very meaningful way. The most important KPI in an MDR is your kind of analyst per endpoints. How many endpoints can a single analyst monitor? Can you get beyond the 50,000 endpoints per analyst? And with AI, I think that that type of building a stack, an MDR stack today in 2024 is a lot more attractive than it was five years ago. We see us as having a big advantage by having built this now.

>> So the defenders are closing the gap to the attackers. Would you agree or no?

Rotem Iram

>> I would say that with AI, the gap is going to increase before it closes back again.

>> Initially increases. Does it ultimately decrease or no?

Rotem Iram

>> Well, in the 20 years I've been in this, it does not. Not yet.

>> Does it slingshot or does it just stay?

Rotem Iram

>> I think that what we've seen historically is that attackers are capped by the human operators because there always needs to be a human at the end. And so even if everybody's vulnerable, if you only have 20 hackers, you can only attack 20 companies at a time. And that has historically been the cap. With AI, can that break...

Shelly Kramer

>> It could scale.Changes, yeah.That

>> could scale. But I'm also hopeful. I think that cloud does create this moment of change where environments that are in the cloud are much easier to protect. Most SMBs, 90% of SMBs are still on-prem or hybrid on-prem and cloud. In the cloud, I think defenders stand more of a chance. So the more that we can accelerate the move of customers from on-prem environments to cloud environments, I think the more chances we have.Rotem, awesome talking to you again. We got to go. Thanks so much for coming back to theCUBE. And best of luck.

Rotem Iram

>> Thank you for having me.

Shelly Kramer

>> Absolutely.

>> Pleasure. All right, you're very welcome. Okay, keep it right there. This is Dave Vellante for Shelly Kramer and David Linthicum. We're live at RSAC 2024 in Moscone West. We're at Broadcast Alley. Come see us. We'll be right back right after this break.