Cyber Insurance News & Information Podcast
Sep 29, 2026 · 1 hr 5 min · 15 segments
A defense supplier was compliant on paper from January to May. In June, it moved its servers from France to Germany and opened more than 17,000 ports. Nobody had to tell the auditors. Andrew Horkan…
So you, going back to 15 and your experience as a quite young employee at a company, full-time employee at that, you discovered something about the way companies actually see security that sort of informs how you sort of navigate the reality we face now.
See, so this is one of the... exactly mirrors what I see today is people see security as a cost center so especially a good 12 13 years ago cyber was no one was really interested in it it was a it's not going to happen to us there weren't many cases of it happening and it was a noise to have and effectively they saw it as a cost and they valued they valued like the speed and efficiency of the tool.
And I was building effectively to make more sales, and that's what they care about.
They care, well, if we get attacked, are we insured? And can we make a claim? Or alternatively, can we win more business? So in the UK, there's something called the Cybersecurity Resilience Bill, and we've seen lots of small businesses that now care about being compliant purely so they can either stay in big tenders or win tenders.
They aren't really interested in being secure effectively, and that's still the same kind of vibes we were getting 10, 20 years ago.
People say they're concerned, but it tends to be a lost leader for a certain reason.
So we see a lot of larger organizations here locally that are IT providers or managed service providers that have cyber as a lost leader so they can use it for marketing and sales, which is a shame because people should want to be secure.
So if I'm understanding you correctly, the idea of cybersecurity is an afterthought to the fundamentals or what's viewed as the fundamentals of the business's profit center, right? Not only is it a cost, but it's also a secondary concern.
And that creates, in your opinion, significant vulnerability for companies, right? Yeah.
So whenever I've seen other pieces with cybersecurity experts, they're talking about, yeah, companies really care about their cyber and it just feels like marketing.
When you speak to any of the smaller or medium companies, so you've got like your small logistics companies that have one or two vans, effectively they're thinking about their next pager.
And especially in the West Midlands, we see a lot of manufacturers who work on just-in-time principles.
So effectively, if those policies and procedures aren't put in place from day one, five years, two years, three years, two months, whatever down the line, they can't actually afford to go and make these changes and policy changes that they need to.
And I very rarely meet someone who is... pro-cyber unless they've already been breached so anyone that I've ever met who is pro-cyber who isn't a cyber security expert tends to be someone who has either previously been breached or they've been a part of a community that has been breached or an organization that's been breached in the past very rarely do you see companies talk of it as a priority it's always where's the next book or we've got to survive this next month especially in today's economy as well
Yeah, I mean, I think we just did a report this week about security concerns are great, but budgets are flat.
And that is almost certainly a representation of the economy is more than the demand or need or threat that's out there.
So you, going back to 15 and your experience as a quite young employee at a company, full-time employee at that, you discovered something about the way companies actually see security that sort of informs how you sort of navigate the reality we face now.
See, so this is one of the... exactly mirrors what I see today is people see security as a cost center so especially a good 12 13 years ago cyber was no one was really interested in it it was a it's not going to happen to us there weren't many cases of it happening and it was a noise to have and effectively they saw it as a cost and they valued they valued like the speed and efficiency of the tool.
And I was building effectively to make more sales, and that's what they care about.
They care, well, if we get attacked, are we insured? And can we make a claim? Or alternatively, can we win more business? So in the UK, there's something called the Cybersecurity Resilience Bill, and we've seen lots of small businesses that now care about being compliant purely so they can either stay in big tenders or win tenders.
They aren't really interested in being secure effectively, and that's still the same kind of vibes we were getting 10, 20 years ago.
People say they're concerned, but it tends to be a lost leader for a certain reason.
So we see a lot of larger organizations here locally that are IT providers or managed service providers that have cyber as a lost leader so they can use it for marketing and sales, which is a shame because people should want to be secure.
So if I'm understanding you correctly, the idea of cybersecurity is an afterthought to the fundamentals or what's viewed as the fundamentals of the business's profit center, right? Not only is it a cost, but it's also a secondary concern.
And that creates, in your opinion, significant vulnerability for companies, right? Yeah.
So whenever I've seen other pieces with cybersecurity experts, they're talking about, yeah, companies really care about their cyber and it just feels like marketing.
When you speak to any of the smaller or medium companies, so you've got like your small logistics companies that have one or two vans, effectively they're thinking about their next pager.
And especially in the West Midlands, we see a lot of manufacturers who work on just-in-time principles.
So effectively, if those policies and procedures aren't put in place from day one, five years, two years, three years, two months, whatever down the line, they can't actually afford to go and make these changes and policy changes that they need to.
And I very rarely meet someone who is... pro-cyber unless they've already been breached so anyone that I've ever met who is pro-cyber who isn't a cyber security expert tends to be someone who has either previously been breached or they've been a part of a community that has been breached or an organization that's been breached in the past very rarely do you see companies talk of it as a priority it's always where's the next book or we've got to survive this next month especially in today's economy as well
Yeah, I mean, I think we just did a report this week about security concerns are great, but budgets are flat.
And that is almost certainly a representation of the economy is more than the demand or need or threat that's out there.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.