CFC Underwriting phishing simulation aims to cut cyber breaches

Lloyd’s MGA CFC Underwriting has developed a phishing simulation tool with cyber security and training specialist Cyber Risk Aware. The tool has been customised for CFC Underwriting’s insurance needs and it will be offered as an additional extra to its policies.

The simulation comprises of multiple email templates to make sure that the user being assessed does not become aware that they are tests.

By being exposed to forms of phishing in a simulated environment, staff can then apply the knowledge they have gained to the real world and will be less likely to open dangerous emails.

“The number of reported phishing cases has been increasing and we’re seeing many people being tricked into clicking on malicious links and transferring funds,” explained CFC Underwriting head of incident response Anthony Hess.

Hess continued, “This prompted us to look at a risk management solution that would address the issue and Cyber Risk Aware’s phishing simulation platform emerged as a great tool for this.”

The pro-active approach is somewhat unusual for cyber insurance products, claims Cyber Risk Aware Cyber Risk Aware co-founder Stephen Burke, with most offering help after the event of a breach.

However, where SME’s do not have the resources to employ an IT team, this kind of training can be particularly valuable.

Burke said: “Historically, cyber insurance products have focused on post-breach activities, whereas this is something designed to help clients avoid the incident happening in the first place.

“CFC Underwriting should be applauded for the thoughtfulness and innovation it is bringing to its product, and we’re delighted to have worked with them to deliver it. Customised functionality and flexibility is a key tenet of our approach to market, allowing us to add that extra value to our customers.”

CFC Underwriting outperformed its peers in the Insurance Times Cyber Product report 2017.  In September it released dark web cyber insurance tool CFC BreachAlert for its policyholders to monitor data breaches.