Few areas of insurance have changed as quickly as cyber. As Head of Global Cyber Development, Lindsey Maher has watched the conversation shift from privacy and data breaches to ransomware, resilience and now AI. We sat down to hear how the market has evolved and where she thinks cyber goes next.
What first attracted you to the cyber insurance market?
I started my career as an underwriter in Toronto at a specialty lines start-up, where cyber sat within the Tech E&O team. Submissions were so rare that by the time the next one arrived, we’d almost forgotten what we’d done with the last one. There was very little loss data and no established playbook, so we were effectively learning the product as we underwrote it. I loved that. The moment cyber really clicked for me personally was the Sony breach. I was (not-so) secretly going through a gamer phase, so suddenly cyber wasn’t an abstract corporate risk or a headline about somebody else’s problem. It affected a world I actually lived in.
That was when I became convinced cyber was going to become a fundamental risk for every business, not just technology companies. I was attracted to a product we were still inventing and a risk I thought would eventually touch everyone. 15 years later, both are still true. And I’ve never really lost that start-up mentality. When I joined CFC 10 years ago, I was employee 77, building our international cyber underwriting business.
How has the conversation around cyber risk changed since you first started and what are the biggest shifts you’re seeing today?
When I started, cyber was predominantly a privacy product. We talked about PCI fines, breach notification and credit monitoring.
Over time, we saw crime move increasingly online, with social engineering tactics becoming more prominent. Ransomware accelerated that shift. Events like WannaCry and NotPetya in 2017, followed by Colonial Pipeline and Kaseya, turned cyber into a much broader conversation about operational resilience, business interruption and extortion.
The threat itself continues to evolve too. 15 years ago, I spent a lot of time talking about regulatory fines and third-party liability. Today, we're talking about AI and how it can accelerate existing threats, make attacks more scalable and lower barriers to entry.
So the conversation has moved from “Do I really have a cyber risk?” to “What does my cyber risk actually look like, and what am I doing about it?”
Our recent SME cyber research highlights a gap between awareness and preparedness. Why do so many businesses recognize cyber risk yet remain unprepared for the threats they face every day?
For years, the industry assumed the problem was awareness. We thought businesses weren't buying cyber insurance because they didn't believe cyber was a risk. Our research suggests the market has moved on.
Nearly one in two businesses now rank cyber as their biggest business risk, and nearly three in five have experienced a cyber event in the past three years. Yet significant gaps remain in understanding the threats they're exposed to and what cyber insurance does.
The insurance industry must take some responsibility. Too often, cyber has been wrapped in technical language, lengthy applications and unnecessary complexity. Awareness grew, but action didn't always follow.
And that's a huge opportunity for brokers. The conversation can move beyond “you have a cyber risk” towards “here's what that risk looks like for your business, and here's how we can help you manage it”. Businesses don't need another lecture on cyber risk, they need someone to make it relevant, understandable and actionable.
Beyond the insights themselves, what prompted CFC to undertake this SME cyber research and how will it be a useful resource for brokers?
CFC has enormous visibility into cyber risk through our underwriting and claims data, but that only tells us part of the story.
We wanted to understand cyber risk through the eyes of the customer: how SMEs themselves perceive the threat, where they believe they are exposed, how prepared they feel, and what they understand about cyber insurance.
Focusing specifically on businesses with revenues below the equivalent of £25 million, and looking at the findings globally as well as regionally, gives us a perspective that has historically been difficult to capture.
AI is becoming a bigger part of every business. From a cyber perspective, what are the biggest opportunities and challenges organisations should be thinking about right now?
What’s interesting about AI is that rather than creating an entirely new category of cyber risk, it often accelerates existing ones. Threat actors can use AI to make phishing and social engineering more convincing, automate elements of attacks and lower the barrier to entry for less sophisticated criminals.
For businesses, the immediate challenge is governance. They need clear rules around which AI tools employees can use, what information they can share, how outputs are checked and who is accountable when something goes wrong.
At CFC, our position has always been that cyber insurance should respond to cyber events, regardless of whether AI is involved. AI is already embedded in businesses of every size – and can also be used to de-risk businesses of human error exposures – so the insurance industry needs to engage with that reality. Clients need confidence that their insurance will respond, not more reasons to question their cover.
What are your passions outside work?
Running, travel, food and wine, which I appreciate aren’t entirely complementary hobbies. I love combining the first two and ran a half marathon in Iceland a few years ago. Then I generally use the latter two to undo all the good work. Everything in moderation! If I'm not doing that, I'm spending time with my husband and our 3-year-old son, Fin. He's now accepting insurance internships.
Want to dig deeper? Discover what's driving the cyber insurance disconnect and how brokers can help close the gap in our latest SME research.
