What We Do
How we do it
Oct 19, 2021
Hackers Infect Employees of Law Firms, Manufacturing Companies, and Financial Services Orgs. with Increasingly Pervasive Infostealer, SolarMarker
SolarMarker Infects 5X More Corporate Victims Using Over a Million Poisoned WordPress Pages Key Takeaways eSentire has observed a fivefold increase in SolarMarker infections. Prior to September, eSentire’s Threat Response Unit (TRU) detected and shut down one infection per week. Beginning in September, TRU averaged the detection and shutdown of five per week. SolarMarker is a…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Oct 12, 2021
eSentire Launches MDR with Microsoft Azure Sentinel Extending Response Capabilities Across Entire Microsoft Security Ecosystem
Waterloo, ON – Oct. 12, 2021 -- eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announced the expansion of its award-winning MDR services with Microsoft Azure Sentinel, as part of its integration with the complete Microsoft 365 Defender and Azure Defender product suites supporting Microsoft SIEM, endpoint, identity, email and cloud security services.…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Oct 07, 2021


Ep. 5: Insurance & Claims

Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

The cyber insurance market is booming, with written premiums expected to reach $20 billion USD by 2025, globally, up from under $5 billion USD in 2016.

A significant driver of this growth is the well-documented success of ransomware attacks, which have evolved from opportunistic and transactional attacks to the threat landscape we see today.

With every new headline, businesses are continuously reminded that cyber insurance has a role to play in managing risk by potentially offsetting the rising costs of ransom and extortion payments, system recovery, investigation, customer notifications and credit protection, public communications services, and other legal expenses.

However, the cyber insurance market is still relatively new, so many providers have limited understanding of how much risk exposure organizations have to cyberattacks. Lacking well understood actuarial data and resulting risk quotients for cyber risks and the ever-changing costs resulting from cyberattacks, underwriters struggle to understand the financial risk associated with a specific policy, and policy fees, coverage and requirements vary greatly.

At the same time, ransomware gangs continue to refine their operations. While the headlines are dominated by attacks against large enterprises and critical infrastructure, there are worrying signs that threat actors are expanding their reach.

Small and medium businesses are the biggest targets

In the latest episode of our Managing Cyber Risk podcast series, Mark Sangster and Hillarie McClure spoke to Catherine Lyle, Head of Claims at Coalition Inc. Insurance, about the latest trends in cyber insurance claims and coverage, why your cyber insurer’s value goes well beyond providing coverage, and practical advice on when and how organizations should engage an insurer in the event of a breach.

According to Mark, one of the most concerning trends is that ransomware gangs are using supply chain attacks to gain access to thousands of small and medium businesses (SMBs). Citing recent examples including Solar Winds and Kaseya—essential tools for many organizations—Mark points out that businesses “can’t eliminate this risk through non-participation”.

Similarly, threat actors may target Managed Service Providers (MSPs) that provide the IT skills and tooling that tens of thousands of SMBs rely on.

Catherine Lyle agreed, “Ransomware is the immediate monetization of a crime.”

After all, it allows criminals to immediately profit and drive those proceeds right back into finding and attacking more victims.

In addition to ransomware, Catherine noted that another trend she sees as significant right now is “funds transfer fraud”. Her company works one-on-one with insurers that have experienced a security event.

Through that work, her investigators have noticed that cyberattackers are often spending much more time within the victim’s environment—allowing them to better understand communication patterns and power structures, both of which are leveraged to make social engineering effective.

From Catherine’s perspective, senior leaders within small and medium businesses are beginning to recognize that they need to seriously consider the risk (and the associated costs) of a potentially devastating cyber attack.

Taking advantage of pre-claim services

These same leaders are also recognizing that their cyber insurance provider can provide valuable, proactive assistance and expertise to help prevent attacks, limit their scope and accelerate recovery—in addition to covering damages.

By working with an insurance provider, SMBs can ensure they have a “happy path” to follow in the event of an incident.

Additionally, it’s imperative that organizations think about the ripple effects of a cyber attack before it occurs. It’s often not so much about making the right or wrong decisions, but rather about being prepared, understanding and managing the unavoidable tradeoffs that come with Incident Response (IR).

Mark and Catherine both stress the importance not only of preparing, but of thinking beyond the ones and zeroes—beyond the technology. As Catherine pointed out, if an adversary is successful in deploying a ransomware attack against your company, do you know how your business would react?

Although technology is an important element, you must have a plan set in place to address how to work with law enforcement, handle public relations, notify clients, comply with regulations, decide whether or not to pursue a prosecution, and so on.

Every business can benefit from relying on cyber incident experts, but very few businesses have this expertise in-house. That’s where trusted partners come in: to explain very clearly what to expect, the timelines that exist, etc. on what might well be the worst day of work you’ve ever had.

Our recent report, The Current State of Incident Response Services in 2021, hinted at the influence cyber insurers have in risk management. For example:

Knowing your coverage

As the industry matures, cyber insurance policies are continuing to change: cyber insurers have not only begun to offer more restrictive policy terms and coverage limits, but also increased premiums for midsize and large companies by upwards of 20%.

Our survey revealed a wide range in coverage:

Being prepared

Unfortunately, all signs point to an increasing number of cyber attacks against businesses of all sizes. And as cybercriminals find new and more efficient ways to reach the long tail of small and medium businesses—most of which lack in-house expertise—having strong partners in place for MDR, IR, and insurance will become essential.

After all, cybersecurity is not an IT problem to solve—it's a business risk to manage.

To learn more about cyber insurance, listen to the fifth episode of the Managing Cyber Risk podcast series, Insurance and Claims, below.


eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.