Printers make up about a fifth of the endpoints on a corporate network. Symphion CEO Jim LaRoe says almost none of them are protected.

Printers ship with open ports, built-in servers and default admin passwords. LaRoe says many service technicians reset them to factory settings after a repair, wiping out any hardening. An attacker who controls a printer can use its trusted access to steal company credentials. Penetration testers at Rapid7 and Raxis found default printer credentials still enabled in 121 of 136 assessments.

For the insurance market, LaRoe says he has not seen a cyber application ask about printers. He offers the questions he would ask instead: What's your plan? How do you know it's working? How do you prove it? He also explains why hospitals still depend on printers and what an unprotected fleet can cost. He closes on zero trust and machine identity as certificate lifespans shrink.

Read the article: https://cyberinsurancenews.org/printer-security-symphion-laroe-podcast/

Jim LaRoe on LinkedIn: https://www.linkedin.com/in/jim-laroe-1794182/

Symphion: https://www.symphion.com/

Cyber Insurance News & Information: https://cyberinsurancenews.org

Music licensed through Soundstripe. Code: 7TSAYRUNCBCRWGLI

Marketing data security is a CMO's problem. Graylog CMO Kimber Spradlin returns to explain how cheap plugins, tracking pixels and AI tools add risk, and why every CMO should know their CISO.

Marketing holds a lot of customer data across a lot of systems. Spradlin covers what that data is, how the pieces add up to a profile, and where the risk hides in the martech stack. She explains why the CISO is often the last executive a CMO talks to, what a breach does to a brand, and why marketing should help answer the cyber insurance application.

Her advice for any CMO who doesn't know the CISO: "Find out for sure. That's step one."

Read the article: www.cyberinsurancenews.org

Watch on YouTube: https://youtu.be/eNyKM6mB2G0

Kimber Spradlin on LinkedIn: https://www.linkedin.com/in/kimberspradlin/

Graylog: https://graylog.org/

Music licensed through Soundstripe. Code: QQH8JXADVPZQ13NA

Think like a criminal. Act like an angel. Twenty-six years in cybersecurity led Jonathan Palmer, CEO of CDL Cyber Intelligence, to that motto.

Criminals case a target before they strike. Palmer explains how dark web monitoring shows them doing it, often months before an attack lands. A Marsh McLennan study with Searchlight Cyber found organizations with compromised accounts on the dark web were about 2.5 times as likely to suffer a cyber incident.

Palmer also tells the story of how a cup of tea in a Leeds basement started his career in encryption. He explains why a five-person yoga studio and a global company can fall for the same fraud, and why attackers often go after your suppliers instead of you.

For the insurance market, Palmer argues dark web intelligence can give underwriters a sharper view of risk than a self-certified questionnaire. He also covers what CISOs struggle to tell their boards, why tabletop exercises matter, and why shadow AI is the first thing to audit in 2026.

Read the article: https://cyberinsurancenews.org/dark-web-monitoring-cdl-cyber-palmer-podcast/

Jonathan Palmer on LinkedIn: https://www.linkedin.com/in/jonathan-palmer-1320551/

CDL Cyber Intelligence: https://www.cdlcyber.com/

More on the Marsh McLennan and Searchlight Cyber study: https://cyberinsurancenews.org/dark-web-exposures-impact-on-cyber-insurance-risk-report/

This episode is brought to you in association with CDL Cyber Intelligence.

Cyber Insurance News & Information: https://cyberinsurancenews.org

Music licensed through Soundstripe. Code: 7CEKYW07HOJ6UWLM

A defense supplier was compliant on paper from January to May. In June, it moved its servers from France to Germany and opened more than 17,000 ports. Nobody had to tell the auditors.

Andrew Horkan, CEO of Cyber Tzar, tells Martin Hinton why compliance is a snapshot and security is continuous. He explains what an outside-in scan can see from the public pavement, how Cyber Tzar's 0-to-999 score is built, and why brokers are starting to ask for remediation before they bind.

The conversation also follows the Jaguar Land Rover attack two steps down the supply chain, to a family hauler that lost 390,000 pounds in its first month and never saw government support. And it closes on a plan to score every active domain on the internet at least once a quarter by 2028.

Guest: Andrew Horkan, CEO, Cyber Tzar

https://uk.linkedin.com/in/andrew-horkan

https://cybertzar.com/

This episode is brought to you in association with Cyber Tzar and Source Consulting.

Referenced in this episode:

Martin Hughes, Source Consulting: https://www.linkedin.com/in/martin-hughes-59897a43/

Cyber Essentials (NCSC): https://www.ncsc.gov.uk/cyberessentials/overview

Minor ID theft Podcast: https://youtu.be/cogg7NlmYk8?si=WMZKCxDIFujU5I6Q

Take the Cyber Insurance News 2026 survey. Eight minutes, and respondents get the results first.

https://s.surveyplanet.com/itpr6r59

Music licensed through Soundstripe.

Codes: KVAVCLTJATQTULH7, D5PIVNBS5SNZQ0ON

Claim photos, MRIs, contracts: if nobody can prove a digital record is authentic and unchanged, somebody still pays. DigiCert's Mike Nelson explains how content provenance and the C2PA standard track where a file came from and every change made to it.

Martin Hinton, executive editor of Cyber Insurance News & Information, talks with Mike Nelson, vice president and field chief technology officer at DigiCert, about:

• The Utah courtroom video that raised the question every claims adjuster should be asking
• Why digital files lack the provenance the antiques trade has relied on for centuries
• How C2PA digital signatures and the trust list create a chain of custody
• A parking-lot fender-bender, and how easy AI makes it to fake claim damage
• Why hospital imaging machines in service for 20 years are still a weak point
• Why today's credentials can identify the camera but not the person holding it

Read the article and download the transcript: cyberinsurancenews.org/content-provenance-liability-digicert-podcast

Take the Cyber Insurance News 2026 survey. Respondents get the results first: https://s.surveyplanet.com/itpr6r59

Mike Nelson: linkedin.com/in/mike-nelson-70b408

DigiCert: https://www.digicert.com/
Cyber Insurance News & Information: https://cyberinsurancenews.org

Read: The Video Wasn’t Fake. Nobody Could Prove What Happened to It. That’s a Cyber Insurance Problem. cyberinsurancenews.org/digital-evidence-cyber-insurance-claims/

Music licensed through Soundstripe.

Code: M8NZZEKEBQHWDQCI

Threat actors are using AI chatbots in ransom negotiations. They are not setting the price.

Matthew Butler, Director of Cyber Risk Services at Travelers, tells Martin Hinton that the bots provide availability across every time zone, which compresses the early rounds of communication. What that removes is the hours a victim would otherwise spend standing up incident response, checking whether backups are clean, and working out what was actually taken.

Butler calls it the automation of urgency rather than pricing. The pricing decision, he says, is still very human.

The conversation covers the Q2 2026 Cyber Threat Report in full. Why The Gentlemen, a group absent from the data a year ago, posted 248 victims and now sits second only to Keelan. Why Butler describes the report's Mythos-class risk as a forecast rather than an observation. What session token theft does to multi-factor authentication, and why he calls MFA "definitely not the silver bullet that everyone says it is."

Plus a half-million-dollar house purchase wired to a fraudulent account, and the full recovery that came from filing with the FBI's Internet Crime Complaint Center fast enough to freeze it.

Referenced links in the show notes below.

Guest: Matthew Butler, Director of Cyber Risk Services, Travelers

https://www.linkedin.com/in/matthew-butler-38ba1b35/

https://www.travelers.com/

Take the Cyber Insurance News 2026 survey. Eight minutes, and respondents get the results first.

https://s.surveyplanet.com/itpr6r59

Music licensed through Soundstripe.

Code: MAQ6KOVCX9UOBXCJ

Shelterzoom co-founder and CEO Chao Cheng-Shorland on the first AI-executed ransomware attack, why healthcare keeps absorbing these incidents, and the 45-day cash problem that kills hospitals long after the systems come back.

In this episode:

The JadePuffer incident, where an AI agent hunted credentials, pulled cloud and AI provider API keys, and corrected its own failed login in seconds. Cheng-Shorland's view on how long before this is standard practice among ransomware operators: months, not years.

Why hospitals pay, and why paying often does not get the data back. The 38% mortality increase during downtime. The three tiers of hospital response, from rural systems that cannot fund resilience to major brands fast-tracking it.

And the underwriting question: multi-factor authentication and backups already earn pricing credits. Should demonstrable continuity capability do the same?

JadePuffer: The First Successful LLM-Driven Ransomware -

$10.5 Trillion

German hospital hack -

Irish Children's Hospital

Jaguar/ Land Rover Hack - A $2.5 Billion Whodunit: The Hack That Dented the U.K. Economy

Multi-factor authentication proves a real person logged in. It never proves who owns the credential.

Chris Skipworth, CEO of Passpack, joins Martin Hinton to talk about credential management and cyber insurance. The conversation covers credential sprawl, the offboarding failures behind most small business breaches, and why the insurance industry has an access problem of its own.

Skipworth puts one question to business owners. How long would it take you to identify who owns which credentials? Most cannot answer it.

Also in this episode: what AI changed for attackers, why browser password managers are a bad idea, where MFA stops being useful, and three steps a small business can take this week.

Read the full article: https://cyberinsurancenews.org/credential-management-cyber-insurance-passpack/

CHAPTERS

00:00 Introduction

01:05 How the simple password became complicated

02:12 Security in the 1990s and what got skipped

06:39 What a credential actually means today

09:30 Offboarding and dormant credentials

12:41 The cost problem for small businesses

15:25 Credential sprawl and the question owners cannot answer

20:08 Human and non-human identity

24:20 Why insurance has an access problem

29:59 What AI changed for attackers

37:44 Friction, convenience and security

42:33 Cyber insurance and credential controls

46:27 Passkeys, MFA and what comes next

50:55 Default passwords and browser password managers

55:00 The human side of security

60:26 Three things to do on Monday morning

Music licensed through Soundstripe.Code: 6VZLZBGCKQMDWBMW