Written by: Charles Weaver, CEO of MSPAlliance
Insurance companies are in the business of understanding risk, so the title of this article may seem contradictory. Still, I believe there is a discussion to be had on insurance, cybersecurity, and managed service providers.
Early Years of MSP Insurance
MSPs went through a long period of having primarily errors & omissions insurance products. E&O policies mostly cover the MSP when it comes to mistakes (I.e., the negligence of the MSP) when delivering their services. During the value-added reseller conversion to MSPs of the early to mid-2000s, insurance companies mostly viewed tech companies as providing consulting and project work related to computers and infrastructure equipment. The insurance profession considered this work to be primarily performed onsite. While this assumption was, for the most part correct, it did not allow the insurance companies to see the massive and global transition from onsite “computer work” to remote managed services taking place during this period.
Liability arising from such “onsite” work was limited (for the most part) to physical injury or damage to hardware, software, or data. The E&O policies of that era generally went out of their way to exclude incidents which today we classify as “cyber” events, usually involving hackers from far outside the liability zone of the policy. Enter cyber liability insurance.
MSP Cyber Insurance
In late 2007, MSPAlliance began working with the insurance profession to create a purpose-built MSP cyber product designed to cover the typical events MSPs were subjected to as a result of their normal operations. By this time, most of the work in the IT channel involved remote managed services and had little to do with a physical storefront or damage, which would happen in a physical location. Cyber events were on the rise, but nowhere near reaching the levels we see today.
Insurance Companies Do Not Understand MSPs
In the wake of significant global increases in cyber attacks, including specific attacks targeting MSPs, several prominent insurance companies have publicly stated they will be writing less MSP business or leaving the profession entirely. I think this is a mistake. MSPs need insurance as a crucial risk-mitigation tool. Cyber insurance allows MSPs to spread risk in such a way as to encourage end-user organizations to embrace IT outsourcing and gain the cybersecurity protections they so dearly need.
