--:-- Ryan Hanley: In a crude laboratory in the basement of his home. Hello everyone and welcome back to the show. Today we have a tremendous episode for you, a conversation with Pat Costello, co-founder and CEO of EvolveMGA, one of the most comprehensive cyber specialist carriers in our industry. And Pat is doing some really interesting things.
--:-- Ryan Hanley: What I love about EvolveMGA is that they're trying to educate and bring cyber to the agency force. Too many of us are not selling enough cyber. I get it. It's not an easy sell. It's tough to lead with cyber. Oftentimes, our commercial clients are looking at cyber as a luxury. I've said it before, and I'll probably say it a thousand times, but in the very near future, cyber could be a more important coverage than general liability in protecting particularly small business, but really all business.
--:-- Ryan Hanley: I think we're doing our clients a disservice by not pushing cyber harder. What I like about EvolveMGA is that they are working to create a comprehensive program, but also educate agents and educate consumers on why cyber is important. Pat's just a good guy, very dynamic. I enjoyed this conversation, and I think you're going to get a lot out of it. It's conversations like these that really are why I love doing this show, because we're talking a little bit about business, a little bit about insurance, centered around some coverage stuff. It's just all around an episode I think you will love.
--:-- Ryan Hanley: Before we get into our sponsors, I just want to say something that I know every once in a while I reiterate, but I just want you to know, I love you guys for listening to this show. I really do. We are absolutely cranking at Rogue and we have a million things going on and it is getting harder and harder to find time to create these episodes. That all being said, I'm dedicated to continuing to bring you this show because it seems to help. I love your feedback. I hope it does.
--:-- Ryan Hanley: It is such an honor. I feel it as a prerogative—that's the wrong word. Obligation is certainly the wrong word. Maybe I guess I feel it is an obligation to give back to the industry in some way through these conversations, in whatever way they may add value to you. So I hope you continue to enjoy them. I just want you to know that it does not get past me that you're choosing to listen to this show versus other shows, versus other pieces of content that exist. I take the responsibility to help add value to your life very seriously. I just appreciate you for listening.
--:-- Ryan Hanley: With that, I want to give a quick shout out to Podium. Podium is kind of changing the game for how we collect leads here, how we communicate with our customers. The web form to text functionality is incredibly powerful. We're getting almost at like 100% response rate for leads that come through the Podium widget on our site. They have a ton of other options, including payment options and all kinds of different things.
--:-- Ryan Hanley: Podium is one of those tools that I say, whether you choose to use Podium or not, you need to know what it does. It's a tool to just understand its functionality. Maybe today isn't the actual day that you purchase or need the tool, but I think it's a type of functionality that you're going to want to have in your agency at some point. Podium has been a great partner for us. They really have. I'm not always sure what you're going to get out of a partner when you first start working with them. We use Podium every day and they've just been great. I've enjoyed them both as a sponsor of this show, I've enjoyed getting to know the people there, and I've enjoyed using them in my agency. So go to podium.com, reach out to Podium, let them know Hanley sent you, and just get the demo, understand what they're doing. And if you like the tool, use it. I do.
--:-- Ryan Hanley: All right, with that, let's get on to Pat Costello of EvolveMGA. Yo, dude.
--:-- Ryan Hanley: What's up, man? How are you?
--:-- Pat Costello: I'm good.
--:-- Pat Costello: Just trying to get stuff done. Another day in the neighborhood here.
--:-- Ryan Hanley: Are you in upstate New York right now?
--:-- Pat Costello: Yeah, yeah, yeah. The agency is based here. This is where I live. It's actually where I grew up too. I have teammates across the country and the world, which is the new thing for, I think, probably for a company like yours, that's not necessarily unique. But for a lot of brokers and agencies in particular, I tell people like, "Oh, my producer is in Chicago and I have a client success person who's down in Florida and I have a VA in the Philippines." They're like, "Wow, what? Yes, that is totally unique." It's an interesting thing. Finding the right people to operate in that kind of ecosystem is definitely interesting.
--:-- Ryan Hanley: Totally. I will say it was a huge learning experience with COVID happening and learning how to manage a remote culture and make sure people are happy, motivated, performing. All that stuff was a learning experience. I think we're better off for it now that we're kind of coming out of it. We definitely went through some interesting experiences.
--:-- Pat Costello: I'm interested in your take. For me, we were always remote. I think I would love to have a home base someday. We have a coworking space that kind of is our home base, but I would love to have a place where, "Oh, bye honey, I'm going to the office." You know what I mean? That kind of separation. Just have a place where all our mail goes instead of the floor of my basement office. I think that would be nice.
--:-- Pat Costello: At the same time, we haven't had to deal with, "How do we judge performance in a remote work environment?" because we never had an in-person work environment. Those aren't even questions. We have our way of judging performance and talking through things. We use the EOS system—I don't know if you're familiar with Entrepreneurial Operating System. When you have a system for tracking performance and you stick to it, it's not necessarily any more difficult with remote employees. But I do think if you have a standardized in-person culture and go remote, it's probably a huge shock.
--:-- Ryan Hanley: Yeah, I think there are two areas where having people in an office environment is huge. One is sales motivation. If you have a few sales folks, I love having them together in the same room to kind of motivate each other and feel the energy, feel the vibes. We've seen our best sales folks have been in rooms with other sales folks. Those that have been on islands have been a little bit slower. There are anomalies, but if I had my preference, I'd like to have the sales folks on a sales floor.
--:-- Ryan Hanley: For us, underwriting as well. A lot of times it's really advantageous to have underwriters that are kind of chatting about a risk to make sure they're fully understanding, comprehending all the exposures associated. But just general employee happiness, bonding, excitement about the workplace and what we're doing as a team, and connecting with individuals outside of the normal "I need to get this quote done" or "I need to talk to this person about this risk"—it's the whole personal side of things. "How was your day? What's going on? What are you doing for dinner? What are you doing for lunch?" That personal side of things makes it so much more fun, which is kind of the culture that we're trying to cultivate.
--:-- Pat Costello: I agree with that. I would prefer in person. But I struggle with it too. This is nothing against anyone who listens to this who lives in Albany, but this isn't like a bastion of insurance talent here. Not that there aren't incredibly talented people, but this isn't a huge market to begin with. All the colleges are geared more towards engineering. We have RPI, we have Union. Everything has kind of evolved around that. University of Albany is a liberal arts college, but most people who go to University of Albany do not stay here in Albany. They leave. That's a problem that we have.
--:-- Pat Costello: It's difficult to find people who are motivated to come in and work in an insurance agency. Even though most days it's hard for us to even consider ourselves that, it still kind of is what it is. You still have to have the licensing. Locally, it was a huge challenge. It wasn't until I started opening up our search to basically the entire country that we started to find people who really fit our culture, believed in what we were doing. We got to really pick.
--:-- Pat Costello: So I go back and forth on it. There's part of me that's like, "I don't care where you live. If you're working hard, if you believe, you show up to the meetings, you do your work, I love it." The other part of it is, I would love to bump into everyone every day and know what they're up to. I like the people that are on our team, and we just don't get to see each other that much.
--:-- Ryan Hanley: Yeah, totally. With our HQ here in Santa Fe, we've opened it back up and we have around 20 people kind of floating around here. It's been a total change because I was so used to working on my own, no interruptions, no distractions, no people coming to ask me questions. Now I'm back and we're fully up and running and it's buzzing downstairs. It's exciting. It's fun. But I don't have the solitude that I had to just focus on a project. That's a really interesting transition.
--:-- Ryan Hanley: If I had to choose between the two, I would just love to have a full-on office environment going, and then strategic days where I work from home. I love the home office setup that you have, just what I can see from my screen behind you. That's kind of what I've set up at my home office. I spent all of COVID dialing the perfect home office. Now I'm torn between the two. A couple days here and there to work from home, I think, is a good thing.
--:-- Pat Costello: There's definitely part of me that thinks we will eventually get an office at some point, probably in the next 12 months. And there's part of me that's like, this space is so highly functional. I have a video studio, I can do a podcast, I can do videos right here. I have a creative computer, which you can't see. I have a two-screen window set up here for insurance and business-specific stuff. Then I can swivel to my right 90 degrees, and here's my creative computer—my Mac, where I do all the videos, all the podcasts, any of that kind of stuff. If something's going on on this computer, I have another one right here. I'm like, this is so functional. I can be 150% functional here. There's no way if we go to an office that I can have this same setup. It just won't happen.
--:-- Ryan Hanley: It's the command center.
--:-- Pat Costello: Yeah, that's what it is. I've basically said, when we go to an office, I'm not changing anything here. I'm just going to get new stuff for the office. This is staying exactly the way that it is.
--:-- Ryan Hanley: I love it. I have the same mindset.
--:-- Pat Costello: Yeah.
--:-- Ryan Hanley: As much as this is interesting, I didn't bring you on here to shoot the shit about remote versus home office. I'm interested in what you're doing. I'm interested in your backstory. I know you've done a lot of podcasts and people have followed you. Maybe there are some people who haven't heard your story. If you could give us the ten-cent tour on founding Evolve and Evolve in general, I'll do a little intro so they'll know the basics, but I just want to catch people up so we can get to some more fun stuff.
--:-- Pat Costello: Absolutely. If we're talking about my story and the founding of Evolve, I think it goes back to really growing up. My brother and I were fourth generation into the insurance industry. We grew up working for a dad who was a retail agent in Northern California. He owned his own agency. We would go in and work for him literally in high school, just doing administrative tasks. In college, we ended up getting our P&C licenses, doing a little bit of selling. My brother is 18 months younger and he's who co-founded Evolve with me.
--:-- Pat Costello: In college, we also were able to intern at Lloyd's of London for a Lloyd's wholesale broker called Safe Online. That was a really unique experience. For all the agents that are listening, I totally recommend going and checking out Lloyd's of London when you get the chance. It's really kind of the birthplace of insurance. A lot of history there, very traditional environments, very fun environments. We interned there for a summer.
--:-- Pat Costello: Coming out of college, my first job was as an underwriter for ACE in San Francisco in the professional liability department. My brother's first job was working for that same Lloyd's wholesaler that we interned with. We were kind of going down our respective paths. I think both of us were always very entrepreneurial, always very independent. In my personal experience on the carrier side of things, I was working for a huge company and I didn't see a lot of ways where I could control my own destiny. There weren't a ton of role models that I had access to that made me think, "I want to be like that." I was working hard and I didn't see a lot of people noticing what I was doing. The potential to move up and grow and come into my own wasn't necessarily available.
--:-- Pat Costello: So my brother and I started looking at what the next thing we were going to do. He was feeling similar ways in a much smaller organization where he was ready to move on. We started pitching different ideas to mentors. We had a mentor who helped us kind of plan out and recommend the business model that we have today, which is Evolve MGA.
--:-- Pat Costello: Evolve is a cyber insurance specialist. At the moment, all we do is cyber insurance. We are a market for retail insurance brokers. If there is an insurance broker that wants to get a cyber quote, we have one of the most comprehensive cyber policies that currently exists. That's a big statement to say right now, because the cyber market is getting harder and harder. Claims are going up, particularly ransomware.
--:-- Pat Costello: It is getting tougher and tougher for folks to get quality cyber coverage. From a retail broker perspective, one of the biggest issues that we see is understanding the exposures and then also understanding the quality coverage and having those conversations with your clients. We've done everything we can to make it as simple as possible for a broker to show their client that they have tremendous exposure, which they do. It should be explicitly clear at this point. But if there are any issues with that, we're really focused on that education.
--:-- Pat Costello: We show someone in a particular industry why they have tremendous cyber exposure with claims examples. I think our quote proposals are really well laid out to explain the exposure and explain the coverage. I know our team is always there to answer any questions. But Ryan, we've gone so far down the education rabbit hole that our production underwriting team, in a given year, will do over 2,000 educational face-to-face interactions—breaking down exposure, talking about a particular industry and their exposure, breaking down coverage, breaking down the state of the market.
--:-- Pat Costello: On top of that, in November, we're going to be hosting our second Cyber Sales Academy. It's going to be super cool. We have Frank Abagnale from the movie *Catch Me If You Can* coming to speak. A lot of people know him for check fraud, but he also specialized in cybersecurity, wire transfer fraud, social engineering—stuff like that, which is the second most common claim we see behind ransomware. He's going to be there. We're going to be doing an event at the Cowboy Stadium in Dallas, center of the country. We're going to have people come in from both sides. We're planning for about 100 agents. We're about to release that.
--:-- Pat Costello: Education is huge. Comprehensive coverage is huge. And then we're always working on how we can better our service. That's kind of a summary breakdown of how we started and what we're doing today. It's been about six years since we were founded.
--:-- Ryan Hanley: Why do you think that agents still sell cyber like it's a luxury and not like it's a necessity?
--:-- Pat Costello: I think the insurance industry and the way it's set up with renewals breeds an attitude of complacency. Along with that, there's a pretty big age gap in the insurance industry. You have these producers that have built these books over a number of years and they have renewal income that's coming in at a 90% rate or higher. There's not a ton of motivation to learn about a new complex product that isn't a high revenue producing line of business, especially a product that's changing all the time. It's evolving. I just think the motivation isn't always top of mind.
--:-- Pat Costello: But I think the fact that claims are coming in, the market's getting hard, and clients are now asking about this all the time—that's going to be changing. I also will say it's a complex product. When you say "cyber insurance," people can confuse it with techie stuff. They might think about the internet, they might think about computers. But if I were to break cyber insurance down to one sentence: Cyber insurance is coverage for the costs associated with hacking attacks, data breaches, and system failures. Those are the three major triggers that I want people to remember. If you can break it down to one sentence, it makes it a lot easier to communicate to your clients. That's one of the big purposes of Sales Academy. Simplification, I think, is really key to make sure clients truly understand why they need this.
--:-- Ryan Hanley: It's funny. I think a lot of times people still think, "Oh, I don't take credit cards," so they don't need cyber insurance. That was like cyber insurance in 2005. That's not even close to what we're talking about today anymore. The fact that cross-selling cyber insurance—we're still getting started as an agency, so it's not like I can talk in thousands when we talk about volume—but cyber insurance is a huge part of our cross-sell process. We know that a lot of times at the initial point of sale, you're not going to get that cyber purchase.
--:-- Ryan Hanley: Where I think a lot of agents fall down is because at the immediate sale, when you're selling the BOP or the comp or maybe the commercial auto, cyber feels like an additional policy at that time. Oftentimes you get a, "Well, let me think about it," and then they never get back around to it. So we've actually built three touch points into the course of the year post-initial sale if they don't purchase a cyber policy at the point of contact, to retouch on what those are.
--:-- Ryan Hanley: I firmly believe that in the next five to ten years, we could look at something where cyber liability becomes a mandated coverage, much like having workers' comp or personal auto. Only because it is absolutely insane what's happening out there. If agents are unaware of what's happening, just do a simple Google search. It is every single day.
--:-- Ryan Hanley: I had a guy call me—I don't know if I've told this story on the podcast before or not. I had a guy call me because I've done a lot of cyber videos. He said, "Hey man, I hope you can help me. I'm having a really tough time." I said, "What's up?" He said, "I just had a cyber incident put me out of business, and I'm hoping you could help me." I said, "I'm not really sure. This would have been a good call before the claim happened, before the incident." He said he had a cyber policy, and that policy covered tearing down.
--:-- Ryan Hanley: Basically, he had a ransomware attack. Except when they left the system, they just destroyed the system as they were leaving. It wasn't just like, "Oh, you're unlocked." They absolutely obliterated everything on the way out. There were all kinds of hooks and malware things embedded in this—keystroke finders and stuff stuck in the system. They had to get rid of everything. That cost about $600,000, which the carrier that he had actually paid for. So I'm listening to him going, "Okay, this sounds good. He's up and running." Two months later, he's got all his equipment back. He lost some data, but he was able to recoup some of it cleanly.
--:-- Ryan Hanley: He said, "My two biggest clients canceled their contracts on me for breach of contract. There's no way that they could have stayed with me post a cyber claim. If we had had another one, they would have all been fired." Basically, he placed nurses—that was his business. I said, "Send me your policy." I know that there are certain hooks on the end of policies that actually cover you for lost clients or lost business because of reputational hits after a cyber claim. He sent it to me, and sure as shit, it didn't have that.
--:-- Ryan Hanley: I felt bad. I probably lied to him a little because I didn't want to completely crush him. I just said, "Look, man, there are some endorsements. Not every policy has them. Unfortunately, you don't have them. There's not a whole lot you can do because you had this policy for two years and it just didn't have that." That level of detail in cyber policies could have changed that guy's life. If his broker, or wherever he bought it—we didn't get into that, I felt bad, I was going to start crying—if someone had said, "Hey, look, there are endorsements that you can add to the end of this policy which could at least maybe help with some of the financial hit of losing major clients because of reputation post-claim," he just didn't have those things. Now he went out of business.
--:-- Pat Costello: Ryan, I think the example that you brought up is phenomenal because you are touching on a few first-party coverage sections that a lot of carriers or cyber markets do not pick up. The first one you mentioned is system damage and data restoration. Cyber policies, to take a step back, are third-party coverage and first-party coverage. Third-party is typically based around someone making a claim against the insured for losing their information—some sort of liability coverage. First-party coverage is for the costs that the insured is directly responsible for paying out based on someone hacking them.
--:-- Pat Costello: So their system goes down, they need business interruption coverage. They need system damage coverage. If someone does exactly what you mentioned, where they can't use their system anymore, they might need—for example, in the insurance world, if someone hacks one of our agencies—they might need all the client information recreated because that information is deleted or compromised or encrypted. Beyond that, the biggest areas where we see claims are crime, cyber crime. Ransomware, those extortion payments, social engineering. Those are the areas where cyber policies are getting more and more limited.
--:-- Pat Costello: For all the agents out there, if you're offering a cyber policy, you want to make sure you have strong, comprehensive first-party cyber coverage. To throw a couple stats at you: Ransomware attacks during the pandemic increased by 800%.
--:-- Ryan Hanley: It's just insane. It's so much. It's crazy.
--:-- Pat Costello: It's crazy. The scary thing about ransomware attacks is that most people don't report them. Because another thing you mentioned is your insured lost vendor relationships because there's a negative connotation with businesses getting hacked and that being out in the news. A lot of times, that company has done everything they can from a cybersecurity standpoint. There's no cybersecurity that is 100% effective. It's kind of sad to see that there's this huge negative connotation in the public. Obviously, you want to make sure you're as secure as possible, and some people are more responsible than others, but a lot of times there's just no control there.
--:-- Pat Costello: The FBI gets about 4,000 complaints per day about businesses getting hit by ransomware attacks. 4,000. The scary thing is the majority of people don't report them because they don't want to have that negative connotation with their vendors.
--:-- Ryan Hanley: One thing to be clear: This guy was not my insured. He had just called me. He would have had that coverage if he was my insured, but no, he did not. He just called me because he found me on YouTube. But I did have an insured with another claim. This is just another example. I think a lot of agents—and this isn't a knock—this is a coverage that in general is relatively new. Two, as an industry, we don't spend enough time on it. Three, I think the way it was initially taught was so wonky that it was impossible to understand.
--:-- Ryan Hanley: When this first hit about a decade ago, it started to become a coverage that people were talking about. Insurance is boring enough, and then the people who were teaching cyber were almost purposefully making it more boring. It was very tough to get your head around. I think that's changing. I think you guys are a big part of it. You have the podcast, you do a lot of podcasts, you have a lot of content, you can share a lot, you make it fun. It's more inviting, which is a very good thing. But I still feel like a lot of agents just don't understand how this can work.
--:-- Ryan Hanley: I'll give you one example of a claim that we thankfully avoided but was very nearly a claim. We had a wire fraud incident. I have a furniture store that I insure. Someone emailed one of his commercial clients with an invoice that said, "Hey, you owe us $50,000. Can you pay the invoice?" The guy doesn't even look at it, sees who it's from, forwards it on to whoever. That person gets it, pays the invoice. No big deal.
--:-- Ryan Hanley: Two days later, he emails my client and goes, "Hey man, I just got an invoice from you. I didn't really think about it at the time, we paid it, but what was that for? What did we buy?" He's like, "You don't know? We didn't send you an invoice." The closely related email—if you actually look at the thing, it's different. The email looked the same, the signature was very close. It's kind of weird that it's coming from the president, so maybe that should have been a key, but he didn't check it out. He's just going through his day. Forwards the email on, she wires this money.
--:-- Ryan Hanley: Thankfully, they were able to get all $50,000 back. The bank transfer hadn't cleared all the way because it was international. They were able to get the $50,000 back and they didn't end up putting a claim in. There was no loss. He got all the money back. That's great. But that money easily could have gone off into nowhere. If that guy comes back and goes, "Hey man, I need that $50,000," then that's a cyber... I mean, that's social engineering, right? Am I describing a social engineering claim?
--:-- Pat Costello: You're describing it exactly as what it is. Social engineering is the most common claim we see behind a ransomware. We have started to refer to it as wire transfer fraud because the acronym is WTF, right? That's exactly what someone would be thinking when they transfer money out. And that's something that's happened to the biggest companies in the world, the Facebooks, the Apples, it's huge in real estate, huge in law firms right now. But it's ransomware and wire transfer fraud are industry agnostic, right? If you have an email address and a bank account, you can be victim of one of those hacking attacks. So that's why I say, and those are great claims examples to bring up to any client because if you're a legitimate business, you're gonna have an email address and a bank account and you wanna make sure those are protected.
--:-- Pat Costello: So I think that when you bring up or when brokers are looking for examples, I think that's a great place to start. But I also think brokers need to know that a lot of times small to medium-sized businesses assume that they are not gonna be victims of hacking attacks, that the hackers are only targeted at the huge businesses of the world because that's what we see in the news, right? We always see when a major company has a hacking attack occur, but we don't see a lot of times are the small to mid-sized businesses when the truth is those are the low hanging fruit because they usually don't have the cybersecurity in place that they probably should. And they're much more willing to pay a ransom just to get their systems back online. So it's something that I think folks should think about if they initially believe that only big businesses get hacked.
--:-- Ryan Hanley: Yeah, so anyone that's listening, you can steal those two examples because stories sell. But I think we need to find our own. Hopefully we can find them and they're not our clients. We can just read the trade journals, find tons of examples, and just use those examples. I said this before, maybe about a year ago during the pandemic when all the stats were coming out about how hard everyone was getting hit with these. I actually read that there were a couple homeowners insurance companies that were thinking about adding personal cyber liability because these guys are not—I say these guys, I'm assuming they're all disgusting men sitting in basements somewhere. I don't know, that's just a visual I have. Like eating Doritos and regular Coca-Cola, these awful humans. And they're pinging home routers and then using those as proxies to blast out all this malicious content. And that can, if they can track it back to your home router, you can be brought in a lot. There's just all this crazy stuff.
--:-- Ryan Hanley: I put out a couple messages, did a video or something. I just said, cyber, there's a very realistic possibility that in the near future, cyber liability is as or more important than general liability. If I had to think about rogue, cyber is a million times larger exposure than a slip, trip, and fall third-party bodily injury or property damage. That's general liability, right? Is it more likely that someone slips and falls on a property that I'm responsible for, or someone hacks into my system and steals their information or uses my system for ransomware? But we don't think about it that way. We think, "Ah, I own a small agency, so I don't need it. I own a small business." It just couldn't be farther from the truth.
--:-- Pat Costello: Yeah. Well, Ryan, as everything gets more connected to the internet and as people start using technology more, there's more potential for things to get hacked. If something is connected to the internet, it has the potential to be hacked. Everything that we are doing on a day-to-day basis is getting more and more technology driven. So I don't think there is a more crucial coverage for the 21st century than cyber insurance. So I think it's something that really needs to be top of mind. And if there's any agents out there that have any questions on it, we have the luxury of being a specialist where we can go really deep on this. Not only in our coverage, but all the coverage that's floating out there in the market.
--:-- Pat Costello: What's really working from a broker standpoint in terms of making sure this hits, like you mentioned claims examples, we have like 75 industries, all the major industries laid out with their five major exposures and the claims examples associated with that industry. So for example, someone needs claims examples on restaurants or manufacturers or contractors, lawyers. We have claims examples aggregated. The other thing that I really like that helps identify exposure is dark web scanning. Most people don't realize that they have probably over a hundred accounts that their information is in. When you talk about being a member of LinkedIn, of Facebook, of Instagram, of your gym, of your bank account, you have all these credentials. What you don't realize is the majority of these companies have had some sort of data breach at some point. It's likely that your email address and password are associated with that data breach.
--:-- Pat Costello: On the first page of all of our core proposals is an automatic dark web scan that we do for everybody associated with their domain name. It shows you the credentials that are floating out there on the dark web right now that are being bought and sold. If you haven't changed your password, some hacker out there, someone on the dark web could buy your information and try to log into Wells Fargo or whatever it is. The dark web is a scary place. The fact that people aren't actively changing their password, using password managers, practicing quality cyber hygiene, multi-factor authentication—that's just got to be part of the normal day-to-day to make sure you're secure. We have a list of things that folks can do to secure their home office, to make sure they're taking the right cybersecurity steps. In fact, Ryan, we have six free cybersecurity services that we provide to all of our insureds for free if they want access to them for proactive cybersecurity.
--:-- Ryan Hanley: Which password manager do you recommend? Like LastPass or?
--:-- Pat Costello: LastPass is my go-to.
--:-- Ryan Hanley: Yeah. I know. I got to get on the LastPass train. Logging in and out of systems is one of those nightmare things that we all deal with. Carriers are the worst because they make you change your password. Some of them, it's every two days. Some of them, it's never. And you're just like, "Oh my god, I can't have no more iterations and I don't have the brain cycles to remember." And then everyone just goes LastPass. And I'm like, "God, I just got to sign up for it." But so, you had said before that cyber insurance is the only product that you offer at this time. What does that mean?
--:-- Pat Costello: So I think that we've set up a really great network of insurance agents across the U.S. We've gone really deep when it comes to cyber. And I think if we can find another product that is a specialty quality product that our agents would, that would add value to our agents and would add value to their insureds. Like a tech E&O or something like that? Could be tech E&O, could be D&O, could be E&O. I know there's a really big need right now for brokers that are working in the cannabis space because there's very few markets. And there's lots of lines that could be associated with that. So we are actively exploring what could be the next product that would add value. And I think we would only move on it if we felt it was a great product that was comprehensive and that we know our distribution network. Because I think we work with about 2,000 insurance agencies across the U.S., about 2,000 offices. So if it paired well with cyber and it was something that worked within our business model to have our folks be able to communicate and explain and show our brokers why it's relevant, then I think that's something that we would want to bring on.
--:-- Ryan Hanley: One of the things that I think is a huge opportunity is tech E&O. The reason I think it's an opportunity, not necessarily for you guys, but just in general, is because it has a very narrow bandwidth in what's considered tech today. I feel like that bandwidth is, I think the carriers that are writing it are just a little behind in updating what a technology related company is. When you look at some of the exposures that Rogue has, let's take my own business. We have a lot of technology related errors and omissions issues that we could have as we build our own tech and we build our own connections into different systems and what could happen there. Right now it's like, "Do you develop an app? Yes. Okay. Tech E&O." What about websites that develop functionality on those sites that are proprietary to their business? It's not actually an app that they're selling, but it's proprietary tech that is delivering a service inside a web portal or form. How does that work? You really have to search to find someone who will classify that inside of a tech E&O.
--:-- Ryan Hanley: But when you dial into the policy forms, standard E&O isn't covering that. And it's certainly not covered under a BOP. So maybe media liability, but that's a stretch. That's a big stretch to think that media liability is going to cover that. So I feel like there's a big gap in that market. Just because I think it was originally for like app developers. That's really what it is. They're thinking like high functionality technology or technology that's running a manufacturing plant, maybe something that's driving it through a system. But there's a much broader spectrum of tech exposures that are seeping into businesses because today everyone is bolting on their own technology solutions and products. Maybe they're not selling to the market, but they're being used to drive their business, maybe even in conjunction with some off the rack stuff. That technology that you're building and implementing and delivering services through, that's a big gap, I believe, in the current structure of BOP and errors and omissions if you don't have that tech terminology built in. That's probably way more detailed than anyone really cares about. But this is just something that I've seen with some of our clients. I'm like, "How do I cover this feature of their product delivery? They have this, that's pretty standard. This is pretty standard. But what about this piece right here in the middle that connects these two things and does this that they built?"
--:-- Pat Costello: Well, it's the future because there's so many business functions that are reliant on technology. And if you have someone that makes a mistake in creating that, it could be massively costly to that business. So there's no doubt it's an option for the future. And I also would love to just clarify, because people always confuse cyber and tech. The reason why we standalone cyber does not include tech is because there's a double trigger. For example, if I'm a hacker and I'm looking to get into somebody's business, I could potentially exploit an error that a programmer made in putting that software or that program together. Therefore, it could trigger a tech policy, could trigger cyber policy. That's why we don't include tech in our form. And like you said in the beginning, cyber policies in the past a lot of times combined the two. But at this point, we're separating it out because hacking attacks are so real and there's so much going on that combining the exposure of the two on the one policy is too much.
--:-- Ryan Hanley: Yeah, I agree with you. I think they need to be, I think they could be sold as a package, but the forms have to be separated.
--:-- Pat Costello: Yeah.
--:-- Ryan Hanley: Yeah. I think that's the way it has to be. I mean, that's my personal opinion on how it should be sold as separate forms, but packaged together, mostly to make it understandable and easy for brokers and customers and insureds to understand what the hell they're purchasing. If it came as a package but was technically separate forms, I think that would be an incredible way to deliver that. Especially if you had a broader industry or just a broader sense of what tech E&O covered, I think there's a lot of opportunity there. It feels very narrow to me as a coverage.
--:-- Pat Costello: Yeah, totally. And I actually personally live that space a bit because my dad has specialized in insuring tech companies in Silicon Valley. That was his niche as a producer and still is really tech venture capital and private equity. So I've seen him go through that process and it's been a really interesting market because I think tech E&O is much harder to get now than it was five, ten years ago. People pulling out. And I think the underwriting is still being perfected in that space.
--:-- Ryan Hanley: Well, what is tech? You know what I mean? It's such an ethereal thing. There are some very straightforward senses of what that is. And then the gray fringes are very wide. There's a lot of breadth to the fringes of what constitutes tech. When is this just a standard policy and when is it a tech policy? When do you need neither? And what is the real trigger to the exposure? And when do you just need cyber coverage? These are real questions. I think everyone outside of true specialists has them, and even there, I think you get confused by what is a moving target in terms of underwriting guidelines and appetite because no one can figure it out. And it doesn't help that every system is being tested a thousand times a day by hackers. If you want to get the shit scared out of you, launch a brand new website. Don't ever go to it. Just launch it and then watch the traffic. You'll have your bot traffic will be 200, 500 hits within a day or two. And you're like, "It doesn't even exist. There's nothing even there. How are they finding it?" Because these freaking bots are just scanning the web all day long constantly. It's just wild. And people just don't realize this. They have no idea.
--:-- Pat Costello: No, that's a great point. That's a great point for people to know how often hacking attacks are happening. I mean, even in our own industry, Ryan, when you look at the last few months, AXA hacked, CNA, $40 million ransom, Arthur J. Gallagher. You couldn't get a quote from it. We were getting brokers that were coming to us like, "Hey, we usually go to Gallagher or RPS to get our cyber quotes, but they just didn't have access." Honestly, a lot of insurance agencies we work with have experienced hacking attacks themselves. So they serve as great claims examples for clients and how real things are. But it's the new world that we're living in.
--:-- Ryan Hanley: So is there anything coming down the pipe in the cyberspace just in general that people should look out for? Is there any new coverages? Is there any talk in the cyber nerd forums of new things that we need to be prepared for that we need to consider? I mean, most people probably found half the shit that we've said so far to be beyond what they've thought about, and that doesn't make them bad. But is there anything new that we're going to see in the next 12 to 24 months that we should be prepared for from a cyber respect?
--:-- Pat Costello: Well, from a coverage standpoint, one thing I'm excited that we recently introduced into our form is cyber coverage for senior executive officers' personal funds. Because a lot of times we see the CEO or the CFO or the principal or somebody that's high up get targeted specifically by hackers. And a lot of times you'll see these C-level folks, really anybody at a company, doing their personal banking at work, going to wellsfargo.com. You mentioned key logging malware. If someone puts that on your computer, they just get your username and password to your Bank of America bank account. They can transfer funds out. So that's specifically covered within our form.
--:-- Pat Costello: Another crazy thing is in the last year or so there was the first death associated with a cyber attack. It was a German hospital, I believe. They got hit by a ransomware attack. The technology was down so they couldn't admit patients. Something happened, there was an accident or someone needed urgent medical care, they were not able to be admitted to this hospital, and unfortunately they ended up passing away. So that is another form of coverage. Bodily injury coverage associated with hacking attacks is something that we have built into our form recently. And I think when you look at the future, you can talk about more comprehensive bodily injury coverage. You can talk about property damage. When you talk about someone hacking into a Tesla or something like that, that's a really interesting space. But like I said in the beginning, if something's connected to the internet, it can be hacked.
--:-- Pat Costello: When you talk about your thermostat being connected to the internet, when you talk about your smart home, whether it's your smart refrigerator, your smart range, your smart washer dryer, your smart locks, those all could be the initiation of significant financial loss if they're hacked. So there's significant potential for the market to grow. And that's one of the reasons in the beginning why we named the company Evolve, because we knew that not only would the hacking attacks change, but the coverage would change along with it. It's funny. We have enjoyed the name Evolve just because when we go to cyber conferences and cyber events, it's just free marketing because everyone's saying "evolve, evolve, evolve" as things change.
--:-- Ryan Hanley: Yeah, that's wild. You just think about everything that's connected. As it gets more connected, good cybersecurity is always a good first line of defense, but if you don't have a good insurance policy, there's no one showing up after that. I had some guy say to me one time, "I have a cybersecurity firm." I said, "Okay, great. But do they offer you cyber insurance?" He's like, "No, I'll just sue them if something goes wrong." And I'm like, "That is a wild mindset." The policy I quoted him was like $1,400. This wasn't some big, huge policy. The mentality of "I'd rather have nothing because of whatever reason, and I'll just sue my cybersecurity company." I'm like, "One, how do you know you'd win? They're probably doing most things right. Two, what the what? This is the mentality?"
--:-- Pat Costello: Yeah, and if it's a legitimate cybersecurity or IT company, they probably have a contract in place that spells out what happens if there's something that they don't catch. But yeah, that is wild. And the other thing I want to reiterate about cyber policies is they give you access to forensics firms, to PR firms, to folks that literally have ransomware negotiators on their team. The forensics firm associated with our cyber policy, they have ransomware war rooms where they're going to be acting on the insurance behalf. And not only are they going to be figuring out—because it's extremely expensive to have the forensics firms come in, figure out what's in your system, figure out what happened, figure out how to get it back to normal, repair it if need be. Oh wait, you just lost 5,000 people's information. Now we need to bring in a legal firm to figure out what you need to do because you just lost all their data. It's been exposed. And now you need to notify. You need to figure out what regulations you need to comply with. And then, now we've been down for four days. How much revenue have we lost per day? What's the business interruption costs associated with that? And then if there's an extortion itself, do we have to pay that? Do we not?
--:-- Pat Costello: Like we saw in the Colonial Pipeline attack, I believe it was negotiated down from $10 million and they ended up paying $5 million on that ransom. But a lot of times these ransomware hackers literally have call centers. It's a business where they're communicating with the forensics firms. The forensics firms are very used to it. So that's why I'm excited for this sales academy because we're going to have the forensics guys, the ransomware negotiators come in and talk about how this typically works, what you need to be prepared for, and kind of talk about the major things that act as selling points for brokers and that business owners should be aware of.
--:-- Ryan Hanley: It's a pretty wild idea that somewhere there is just someone showing up for work, lunch, walk out the door, "Bye, honey, have a nice day." And you show up to like, hackers. And that's what you do today. "Today I'm going to send out like 10 million emails. Hopefully one of them will hook someone. And then I'm going to start talking to them on the phone and negotiating their ransom." And you come home and, "How's your day?" "Well, I got like $25,000 out of this business in Maine." I mean, that's just crazy. That's like what their day is. And then you throw a big champagne party on the pipeline one or whatever.
--:-- Pat Costello: Yeah, it's wild. And frankly, you don't even have technical expertise. A lot of people have that image of that hacker in the basement eating chips. But you can literally buy ransomware on the dark web. And then you just get a bunch of email addresses and send it out to them. That's how simple it is. So it's not as complex as people might think.
--:-- Ryan Hanley: That actually would be a good SaaS company. You take like 5% of all your ransomware hits and you just sell ransomware as a service. You sell it to hackers, they put the emails through, and you get five to 10% of whatever ransomware they get.
--:-- Pat Costello: Ryan, we've seen that. We've seen that exact thing where they are literally taking commissions from the malware that they are putting out there on the dark web.
--:-- Ryan Hanley: So, everybody's got to make a buck. But it's our job to make sure that buck doesn't come from our clients. Or if it does, we can get it back. So dude, I appreciate you spending this time. I'm a big fan of what you're doing. Where can people learn more about Evolve and two about the conference that you're putting on if they're super interested in cyber and upping their cyber game?
--:-- Pat Costello: Yeah. So to learn more about Evolve, you can go to EvolveMGA.com. And we work with retail brokers across the US. If someone's looking to get a quote or get appointed, if you just go to our website evolvemga.com and click to get a quote, you fill out your insurance information, the agency's information, we can get folks appointed. The other area is going to
[email protected], emailing
[email protected] with anything they would like, any questions that they have. We're happy to act as an educational resource.
--:-- Pat Costello: And then for the upcoming sales academy, I'm super excited about it. It's going to be the first week of November, November 2nd and 3rd. And it's going to be in Dallas. Just a couple highlights. The whole purpose of the conference is any agent that attends should be able to leave that conference being able to explain cyber exposure and quality cyber coverage to any one of their clients in under two minutes. And we're going to have the best of the best in the industry from forensic professionals to Frank Abagnale from Catch Me If You Can to one of the number one cyber producers at Hub to talk about his sales process. And then you're going to have access to all of our underwriting team to ask them questions. And I think at the end, we're going to give our kind of sales playbook for cyber to anyone that attends. So I'm very excited, especially because it's really our first conference coming out of COVID as well. So it's going to be great to see people face to face.
--:-- Ryan Hanley: That's awesome. Where can people get more info on that? Is it on the website as well? Or where do they sign up if they're interested?
--:-- Pat Costello: We are creating a webpage for people to register. It is not up and official yet. So if there are folks that are interested, just emailing
[email protected] saying "I'm interested in attending the Cyber Sales Academy." We're probably going to reserve it to about a hundred seats. I know we have a lot of folks in Texas alone, a lot of folks that attended our last one in Chicago. So the seats will fill up quick, but emailing
[email protected] is the best way for us to make sure people get reserved.
--:-- Ryan Hanley: Awesome, man. Well, hey, I appreciate you. I appreciate you coming on the show and sharing. I've just been following you guys for a while. We're an appointed Evolve MGA. And as we start to have more policies roll in, you guys are in the mix and we look forward to writing more business with you. And hopefully some of the listeners here will get on the train too. Speaking to the agents before we sign off, guys, I've said this a bunch on the show. I wanted to do this episode specifically because cyber is one. It's a great way to add more value to your customers. It's a great way to put money into your bottom line. But you are providing, I mean, this is really what we do is getting out ahead of these things and getting coverage in our clients' hands. And I just, to me, cyber is an absolute no brainer. We have to get this in our clients' hands for commercial clients. So appreciate you, man.
--:-- Pat Costello: Of course, Ryan. Thank you so much for having me on. I love what you're doing and love the energy, love the entrepreneurial spirit. So if there's anything you ever need, anytime.
--:-- Ryan Hanley: Thank you.
