Why is cyber insurance for OT environments more challenging than IT insurance?

OT cyber insurance lacks the historical data and predictive models that underwriters rely on for other lines of insurance. The OT ecosystem is fragmented with proprietary technologies, and unlike IT risks that primarily affect data, OT risks can cause physical harm, bodily injury, and system failures. Additionally, history is not a good predictor of future OT cyber risk, making traditional actuarial approaches insufficient.

How does real-time telemetry improve OT cyber insurance underwriting?

Real-time telemetry from platforms like Claroty integrated with Safe Security provides inside-out visibility into actual security controls, vulnerabilities, and misconfigurations in OT environments. This allows underwriters to differentiate good risks from bad risks based on implemented controls rather than relying on outside-in scans that provide incorrect, irrelevant, or insufficient information. It also enables continuous risk assessment rather than point-in-time snapshots.

Should companies view cyber insurance as a security control?

No. Insurance should be viewed as a financial resilience control for risk transfer, not an operational security control. CISOs should first understand their risk exposure, then decide whether to invest in mitigation or transfer residual risk through insurance. Insurance will never cover reputational damage or non-quantitative impacts, which can be more significant than financial losses, especially in OT environments where physical safety is at stake.

Cyber Insurance Challenges for OT & CPS Environments

Name: Cyber Insurance Challenges for OT & CPS Environments
Uploaded: 2026-04-02T20:40:44-04:00
Duration: 29 min 31 s
Description: TL;DR Cyber insurance for OT environments faces a critical data gap — underwriters lack the historical actuarial data they rely on for IT, home, or auto insurance, making risk assessment challenging in fragmented OT ecosystems. OT systems present highe...

Claroty

04/02/2026

0 (0%)

Report Like Favorite

TL;DR

Cyber insurance for OT environments faces a critical data gap — underwriters lack the historical actuarial data they rely on for IT, home, or auto insurance, making risk assessment challenging in fragmented OT ecosystems.
OT systems present higher-stakes risks than IT because they're directly connected to physical safety and can cause bodily injury, system failures, and business interruption with impacts beyond financial loss.
Safe Security partners with Claroty to provide real-time telemetry from OT environments, enabling inside-out underwriting that reveals actual security controls rather than relying on insufficient outside-in scans.
The traditional insurance questionnaire model (250+ questions, point-in-time assessment) is becoming outdated — the future requires AI-driven automation and continuous risk monitoring to match the pace of evolving threats.
Insurance should be treated as a financial resilience control for residual risk transfer after mitigation investments, not as an operational control or excuse to avoid security improvements.

The Data Gap in OT Cyber Insurance

Pankaj Goyal, COO of Safe Security, explains how cyber insurance for operational technology environments faces fundamental challenges that don't exist in traditional IT insurance. Unlike home or auto insurance where underwriters have decades of actuarial data, OT cyber insurance lacks historical precedent and predictive models. The fragmented nature of OT ecosystems — with proprietary technologies from vendors like Siemens and Rockwell — creates visibility gaps that traditional outside-in security assessments cannot address. Safe Security's platform integrates with Claroty to provide real-time telemetry from OT environments, enabling underwriters to move from point-in-time questionnaires to continuous risk assessment. This inside-out approach allows brokers like Marsh to help customers improve their insurability before coverage discussions begin, while carriers like Chubb and Mosaic Insurance can differentiate good risks from bad risks based on actual control implementations rather than external scans.

Physical Impact and Expanding Attack Surface

The conversation highlights a critical distinction between IT and OT security: OT systems are directly connected to physical safety and can cause bodily injury or system failures that impact human life. Goyal notes that the OT attack surface is expanding not just through owned assets but through third-party suppliers and medical device vendors in healthcare environments. The proximity of OT to physical operations makes these systems attractive targets for attackers with motivations beyond financial gain. Insurance companies are developing OT supplemental questionnaires to understand these risks, but Goyal argues that manual, point-in-time assessments are insufficient when attackers operate continuously. The partnership between Safe Security and Claroty aims to provide the real-time visibility that both security teams and insurance underwriters need to understand vulnerabilities, misconfigurations, and the potential for lateral movement between IT and OT environments.

Automation and the Future of Risk Assessment

Looking forward, Goyal envisions a fundamental shift in how organizations approach OT security and insurance. He advocates for AI-driven automation of insurance questionnaires to free security teams from manual labor and redirect effort toward real-time gap remediation. The goal is to eliminate the artificial boundary between IT and OT, treating technology as a continuous spectrum rather than separate domains. Safe Security is developing agentic AI capabilities for autonomous third-party risk management, similar to how self-driving cars operate. Goyal expects that within two years, there will be significantly more transparency around OT risk, more proactive remediation by CIO and CISO teams, and insurance companies will have evolved from basic supplemental questionnaires to sophisticated real-time risk assessment models. The key message: insurance should be viewed as a financial resilience control for residual risk transfer, not as a substitute for operational security investments.

Chapters

0:00 - Introduction and Safe Security Overview
3:22 - Insurance Data Problem and Ecosystem
6:36 - Inside-Out vs Outside-In Underwriting
8:12 - OT Environment Challenges
12:05 - OT Fragmentation and Clarity Integration
14:30 - Third-Party Risk and Supply Chain
17:47 - OT Supplemental Questionnaires
21:38 - OT Resilience and Business Continuity
24:51 - CISO Advice on Insurance Strategy
27:05 - Future of OT Cyber Insurance

Key Quotes

4:05 "Cyber insurance compared to other principles or lines of insurance is relatively new. So the data is limited and it is frustrating. It has been frustrating over the last four to five years where the insurance industry has basically, in many ways, it is driving blind, like they want more data."
9:21 "OT is much closer to the human life compared to IT. IT is closer to the digital life, the data, but OT can cause, and we have unfortunately seen many examples where OT can cause bodily injuries in a couple of cases, even human deaths, system failure, and so on."
16:24 "The AI has to be in the lead, and the human has to be in the loop, versus the actual actioning based on real-time validation, real-time telemetry from the environment, that's where we should focus 90% of our efforts on."
24:08 "The damages on the reputation side, the non-quantitative damages can be more impactful than the financial damages, which can be potentially covered by insurance. So insurance companies are never going to cover your reputational damage."
27:20 "In cyber, almost none of this is true. So there's not a lot of history, there's not a lot of common data, and the history of the past may not be a good indicator of the future."

Categories:

» Data Protection

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

05/12/2026

11:30 PM

05/12/2026

Implementing Effective Strategies for Active Directory Security and Data Protection

https://www.truthinit.com/index.php/channel/1888/implementing-effective-strategies-for-active-directory-security-and-data-protection/
05/13/2026

01:00 AM

05/13/2026

Transforming the Black Box: Reveal Hidden Threats and AI Risks through Data Lineage

https://www.truthinit.com/index.php/channel/1890/transforming-the-black-box-reveal-hidden-threats-and-ai-risks-through-data-lineage/
05/13/2026

05:00 AM

05/13/2026

Transforming the Black Box: Revealing AI Risks and Hidden Threats through Data Lineage

https://www.truthinit.com/index.php/channel/1894/transforming-the-black-box-revealing-ai-risks-and-hidden-threats-through-data-lineage/
05/19/2026

01:00 PM

05/19/2026

Establishing a Robust AI Governance Framework for GenAI Throughout Deployment Phases

https://www.truthinit.com/index.php/channel/1936/establishing-a-robust-ai-governance-framework-for-genai-throughout-deployment-phases/
05/20/2026

08:00 AM

05/20/2026

Establishing a Robust AI Governance Framework for GenAI Throughout Its Lifecycle

https://www.truthinit.com/index.php/channel/1937/establishing-a-robust-ai-governance-framework-for-genai-throughout-its-lifecycle/
05/20/2026

10:00 PM

05/20/2026

Establishing a Robust AI Governance Framework for GenAI Throughout Its Lifecycle

https://www.truthinit.com/index.php/channel/1953/establishing-a-robust-ai-governance-framework-for-genai-throughout-its-lifecycle/
05/21/2026

11:00 AM

05/21/2026

The Autonomous Era: Orchestrating a Resilient Enterprise

https://www.truthinit.com/index.php/channel/1372/the-autonomous-era-orchestrating-a-resilient-enterprise/
05/27/2026

04:00 AM

05/27/2026

Rivoluziona i rischi dell'AI in opportunità con Netskope AI Security

https://www.truthinit.com/index.php/channel/1925/rivoluziona-i-rischi-dellai-in-opportunità-con-netskope-ai-security/
05/27/2026

10:00 AM

05/27/2026

Harnessing AI: Transitioning from Illusion to Purposeful Mastery

https://www.truthinit.com/index.php/channel/1924/harnessing-ai-transitioning-from-illusion-to-purposeful-mastery/
05/28/2026

01:00 PM

05/28/2026

Harnessing AI for Smaller Teams: Strategies for Secure Implementation

https://www.truthinit.com/index.php/channel/1951/harnessing-ai-for-smaller-teams-strategies-for-secure-implementation/
06/02/2026

01:00 PM

06/02/2026

Spring of Satori: Delving into Recent Findings and the 2026 Threat Landscape

https://www.truthinit.com/index.php/channel/1930/spring-of-satori-delving-into-recent-findings-and-the-2026-threat-landscape/
06/04/2026

02:00 AM

06/04/2026

Mastering the Unseen: Managing Shadow AI and Agentic MCP Traffic

https://www.truthinit.com/index.php/channel/1948/mastering-the-unseen-managing-shadow-ai-and-agentic-mcp-traffic/
06/16/2026

07:00 AM

06/16/2026

Transforming Data Risk into Actionable Priorities: Essential Fixes First

https://www.truthinit.com/index.php/channel/1952/transforming-data-risk-into-actionable-priorities-essential-fixes-first/