The New Cyber Threat Landscape: How AI Is Changing Risk for Every Small Business

Podcast: Play in new window | Download (Duration: 17:46 — 24.4MB)

Subscribe: RSS

Summary

On this episode of Chattinn Cyber, Marc is chattin’ with Mike Maletsky, Vice President and Practice Leader for Tech, Cyber, and Crime at Hiscox. Mike begins by discussing his career journey into the insurance industry, explaining that he “fell into” insurance after studying finance but stayed because he found the work intellectually engaging and people-focused. He emphasizes that cyber insurance is about much more than selling policies—it’s about understanding complex risks and helping businesses mitigate them. He also introduces Hiscox’s long-standing focus on serving small businesses, a segment that is often overlooked despite its critical role in the U.S. economy.

The conversation then shifts to the cyber threats currently facing small businesses in 2026. Maletsky explains that cyberattacks are no longer isolated incidents affecting only large corporations. According to Hiscox’s Cyber Readiness Report, more than half of small businesses experienced some form of cyberattack within the past year. He discusses how ransomware, phishing campaigns, and cyber extortion continue to evolve, with artificial intelligence dramatically increasing both the sophistication and scale of attacks. Traditional warning signs such as poor grammar and obvious spelling mistakes have largely disappeared, making fraudulent communications increasingly difficult to detect.

Looking ahead, Maletsky explores how AI and emerging technologies will reshape cyber risk over the next decade. In the near term, AI is making phishing emails nearly indistinguishable from legitimate communications. In the medium term, increasingly convincing deepfake audio and video could enable highly sophisticated fraud schemes, including executive impersonation. Longer term, developments such as autonomous AI agents and quantum computing could fundamentally alter internet security by challenging today’s encryption standards. At the same time, he notes that cybersecurity professionals are leveraging many of these same technologies to build stronger defenses, creating an ongoing technological arms race between attackers and defenders.

The discussion also highlights the wide-ranging impact of cyber incidents beyond financial losses. Maletsky explains that a cyberattack can trigger cascading operational disruptions, including business interruption, regulatory notifications, reputational damage, and customer distrust. Perhaps most importantly, he argues that cyber incidents are fundamentally human events rather than purely technical ones. Employees often experience intense stress during an incident, particularly those responsible for responding to attacks or those who inadvertently initiated a breach through a phishing click. Organizations can suffer from burnout, blame, and deteriorating workplace culture long after technical recovery has been completed.

Finally, Maletsky outlines practical steps small businesses can take to improve their cyber resilience. He stresses the importance of ongoing employee awareness training, implementing basic security controls such as multi-factor authentication and reliable backups, and viewing cyber insurance as more than financial protection. Modern cyber insurance increasingly includes preventative services such as phishing simulations, breach coaching, employee education, and risk management resources. He closes by noting that 77% of U.S. small businesses remain underinsured against cyber risk, emphasizing that many companies mistakenly assume cyber insurance is prohibitively expensive when, in reality, coverage is often affordable for even very small organizations.

5 Key Points

AI is making cybercrime significantly more effective, especially through highly convincing phishing emails, ransomware operations, and deepfake impersonation attacks.
Small businesses are increasingly targeted, with 56% experiencing some form of cyberattack in the previous 12 months according to Hiscox research.
The consequences of cyber incidents extend beyond financial losses to include operational disruption, reputational harm, customer notification costs, and employee stress.
Employee education, basic cybersecurity controls, and proactive cyber insurance services are among the most effective defenses for smaller organizations.
Roughly 77% of U.S. small businesses remain underinsured against cyber threats, representing one of the largest gaps in cyber risk management today.

5 Key Quotes

“Cyber is such a unique risk… it’s never one thing.”
“A cyber attack is a human event. It’s not a technical one.”
“The company’s weakest point is that least-trained employee.”
“I don’t need to compete against my competitors. I need to compete against the non-buyers.”
“The good news is the good guys also have this technology.”

About Our Guest

Mike Maletsky is Vice President of Technology E&O/Cyber at Hiscox USA, with more than 18 years of insurance industry experience. He brings a strong technical foundation in underwriting management and professional liability, including cyber insurance, and has deep expertise across both manual and digital distribution channels. Mike has a proven track record of building full-stack new products through digital distribution, with a focus on technology errors and omissions (E&O), excess coverage, and cyber liability. Known for serving as a key bridge in product development workstreams, he effectively connects business and underwriting priorities with technology implementation to drive aligned, successful outcomes. Throughout his career, Mike has demonstrated a commitment to innovation and to delivering forward-looking insurance solutions informed by emerging technologies and industry best practices.

Follow Our Guest

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

July 31, 2024February 3, 2026

Navigating Ransomware and Cybersecurity: Insights from Cryptocurrency Expert John Morrissey

Podcast: Play in new window | Download (Duration: 8:53 — 12.2MB)

Subscribe: RSS

Summary

In this episode of Chattinn Cyber, Mark Schein chats with John Morrissey, Cryptocurrency Operating Compliance Director for Arete, focusing on various aspects of the cryptocurrency industry and the challenges associated with ransomware attacks. John explains how he ended up in his current role, combining his cybersecurity background with his passion for trading and investing. He discusses the volatility of the cryptocurrency market and the impact it has on ransom demands. He also highlights the increasing scrutiny and compliance requirements imposed by organizations like OFAC when it comes to making ransom payments. John emphasizes the importance of taking cybersecurity seriously and investing in the right tools and processes to protect organizations from cyber threats.

John shares his journey of how he becomes the Cryptocurrency Operating Compliance Director for Arete. He mentions that he met Joe Mann, the founder of Arete, while working in the Virginia DC area. John became Arete’s first client when he ran a DFIR (Digital Forensics and Incident Response) services organization. With his background in cybersecurity and his passion for trading and investing, John found a perfect fit in his current role, where he manages crypto relationships and helps clients navigate the complexities of the market.

The conversation then shifts to the concept of crypto puzzles and the volatility of the cryptocurrency market. John explains that crypto is the most volatile asset in the world, and its value can fluctuate significantly in response to market conditions. He gives an example of how Bitcoin’s value dropped from $69,000 to $16,000 during a market crash. John highlights the challenges of working with a new industry that lacks regulation and dealing with assets that are highly volatile. He emphasizes the need to understand how all these factors fit together.

The discussion then turns to ransomware attacks and the changing demands of adversaries. John mentions that during previous market crashes, ransom demands were often made in Bitcoin. However, after the crash, there has been a shift towards demanding cash instead of Bitcoin. He notes that the ransoms are increasing year over year, with some groups demanding even higher amounts. John also mentions the increasing scrutiny and compliance requirements imposed by organizations like OFAC (Office of Foreign Assets Control) when it comes to making ransom payments. He explains the steps Arete takes to ensure compliance, including analyzing threat actor wallets, conducting blockchain analysis, and verifying the absence of sanctions.

Mark asks John how Arete can help in situations involving ransomware attacks. John explains that Arete is a full-service organization specializing in digital forensics and incident response (DFIR). They offer assistance from the moment a hack is discovered, providing a 24/7 phone number and email for immediate response. Arete’s team helps clients through the entire process, from triage to recovery, and even offers guidance on planning and prevention. If necessary, Arete can also assist with the process of making ransom payments.

In conclusion, the conversation between Mark Schein and John covers various aspects of the cryptocurrency industry and the challenges associated with ransomware attacks. John shares his background and how he ended up in his current role. He discusses the volatility of the cryptocurrency market and the impact it has on ransom demands. He also highlights the increasing scrutiny and compliance requirements imposed by organizations like OFAC. John emphasizes the importance of taking cybersecurity seriously and investing in the right tools and processes to protect organizations from cyber threats. Arete’s role in assisting clients with ransomware attacks is also discussed, highlighting their full-service approach and expertise in digital forensics and incident response.

Key Takeaways

Cryptocurrency prices and demand for ransom payments in crypto vs fiat currency fluctuate a lot based on market conditions. When crypto prices crashed, ransom demands shifted to be mostly in cash rather than bitcoin.
Ransom amounts continue to rise steadily, with increases of 20-30% year-over-year being common.
OFAC regulations and government scrutiny are making ransom payments more difficult with requirements to verify the ransomware group is not sanctioned.
Arete offers comprehensive incident response services including forensics, monitoring, planning, and facilitating ransom payments if needed. They have a 24/7 hotline to call for immediate assistance.
It’s important for organizations to take cybersecurity seriously and invest in good tools and processes to avoid becoming victims of ransomware. Arete recommends deploying technology like SentinelOne for prevention and detection.

Key Quotes

1:25 – “So it’s great taking some cybersecurity background and melding it with my market background. I became the crypto operations and compliance director at Arete.”
4:03 – “But after it crashed, we actually saw very few pure bitcoin ransoms, and most of them in cash. So whether it’s the psychology of it or just they wanted some consistency outside of the volatility, but today, 95 or more percent of the ransoms are all in pure cash versus bitcoin.”
5:32 – “So we actually take it upon ourselves to look at really every cyber indicator compromise. You always take a threat actor wallet and throw it on the effect sanction list … But we do a lot of analysis on the blockchain of prior transactions that the threat actor might have done.”
6:47 – “We have an Arete 911 phone number. You can just do a Google search of ‘Arete 911’ and find us. So we have a phone number that’s 24/7, we have an email that’s 24/7. Once we receive your email or call, we will be on the phone with you within half an hour to help script that.”
8:33 – “But there’s a lot of great. Yeah, a lot. But there’s a lot of great process and a lot of great technology out there to help you. But I think just take cyber seriously and, or if not, you know, you’ll find yourself in trouble one day.”

ABOUT OUR GUEST:

John Morrissey is a seasoned Technology Sales and Services leader with a strong focus on Customer Success. With extensive experience in assisting National Defense, Civilian Agencies, and Commercial Enterprises, John specializes in successfully implementing cutting-edge technologies such as Analytics, Big Data, Machine Learning, Cyber Security, Fraud, Risk, eDiscovery, and Investigative technology. Throughout his career, John has demonstrated a remarkable ability to build and grow organizations, delivering high-end consulting and enterprise solutions. He is a results-oriented leader with a proven track record of overcoming complex business challenges and making critical decisions with experience, good judgment, a strong work ethic, and unwavering integrity. With a keen vision, determination, and exceptional skills, John is adept at driving increased revenue and profitability for organizations.

FOLLOW OUR GUEST:

LINKEDIN

ABOUT OUR HOST:

FOLLOW OUR HOST:

WEBSITE | LINKEDIN

June 11, 2024February 3, 2026

Dark Web IQ: Disrupting Cybercrime with Kevin Sherry

Podcast: Play in new window | Download (Duration: 22:28 — 30.9MB)

Subscribe: RSS

Summary

In this episode Marc Schein is chattin’ with Kevin Sherry, the founder of DarkWeb IQ, a pioneering offensive cybercrime prevention firm. Kevin shares his unconventional journey from a hedge fund trader and entrepreneur to a leader in the cyber insurance industry, eventually leading to the inception of DarkWeb IQ. Kevin’s entrepreneurial spirit and proactive approach to spotting opportunities in the evolving insurance landscape laid the foundation for his innovative venture.
Kevin details the origins of DarkWeb IQ, emphasizing his belief in the necessity for a new approach to cybersecurity. In 2020, amid the chaos of the pandemic, the cyber insurance market faced unprecedented challenges due to a surge in ransomware attacks. As market panic ensued, Kevin, leading a team at Everest, realized the need for a radical solution to protect against mounting losses. His sleepless nights and relentless pursuit of answers culminated in the idea of infiltrating and disrupting the cybercriminal supply chain, a concept that formed the core of DarkWeb IQ’s mission.

DarkWeb IQ’s approach diverges from traditional defensive security measures. Instead of merely implementing preventive controls, the firm actively engages with the criminal underground to disrupt cybercrime operations. Kevin recounts how the cybercriminal ecosystem, similar to a supply chain, can be infiltrated and dismantled by targeting its vulnerable links. Despite initial assumptions that such methods were already in use, Kevin was surprised to find significant gaps in the existing threat intelligence efforts, paving the way for DarkWeb IQ’s unique offensive strategy.

Kevin’s firm has intercepted over 800 attacks in two years, employing various methods from direct interventions to collaborations with vendors and government agencies. These interventions range from alerting companies about immediate threats to helping software vendors secure their tools against misuse. Kevin explains how his team’s efforts not only protect individual clients but also contribute to broader societal benefits, such as safeguarding critical infrastructure like hospitals and water treatment facilities.

Reflecting on lessons learned, Kevin highlights the importance of focusing on the basics of cybersecurity. Many attacks exploit simple vulnerabilities, often overlooked despite significant investments in security tools. He advocates for a pragmatic approach where companies prioritize understanding and addressing the most common attack vectors rather than being overwhelmed by compliance checklists. Kevin also stresses the value of proactive vulnerability scanning for insurers, while cautioning against the pitfalls of alert fatigue caused by overemphasis on less critical vulnerabilities.

As the conversation concludes, Kevin expresses his pride in the public-private partnership model that DarkWeb IQ embodies, working closely with law enforcement and the insurance industry to create impactful solutions. He reflects on his journey and the collaborative spirit of their mission, looking forward to continued innovation and progress in the fight against cybercrime.

Key Takeaways

Kevin Sherry started DarkWeb IQ due to his frustration with the rise in ransomware attacks and wanted to find an innovative way to combat cybercrime.
DarkWeb IQ works to infiltrate the cybercriminal ecosystem and supply chain to gain visibility into potential attacks. They intercept attacks and work with law enforcement to build cases against criminals.
DarkWeb IQ has directly intercepted over 800 attacks in their 2 years of existence by infiltrating criminal operations.
Most cyber attacks utilize basic methods, even though security has become very complicated. Focusing on how real-world attacks occur can improve security programs.
Proactive vulnerability scanning by insurers provides value, but alert fatigue is a problem. Focusing alerts on key vulnerabilities that are likely to be exploited is important.

Key Quotes

“By late Q3 of 2020, there was panic in the marketplace and it was noticeable. People were scared.”
“I was angry at the idea that these a**hole ransomware criminals in eastern Europe and Russia were going to potentially undo five years worth of blood, sweat, and tears I put into building this business.”
“What we were proposing was essentially we felt that we had a good legal argument that could allow us to go in on a consistent and scalable way to engage with all sorts of criminals that are in that ecosystem in a way that just wasn’t being done.”
“We’ve had over 800 of those so far in our two year existence.” (Referring to direct attack interceptions)
“Most vulnerabilities don’t matter. 98% of vulnerabilities are literally never going to have a weaponized exploit. They don’t matter. You shouldn’t be patching them. You’re wasting and depleting resources.”

ABOUT OUR GUEST:

Kevin Sherry is a highly accomplished professional with a strong focus on cybersecurity and public-private partnerships. Currently, he leads a prominent public-private partnership aimed at safeguarding U.S.-based companies against imminent ransomware attacks. With a proven track record of success, Kevin has built a market-leading and best-in-class cyber insurance business from the ground up at a top-tier carrier. Additionally, he played a pivotal role in establishing Prime International Trading’s first high-frequency trading team, which generated over $4 million in profit for the firm and laid the foundation for the firm’s success during times of disruption. Kevin’s passion for making a positive impact extends beyond the business world. He co-drafted a blueprint and secured funding for an initiative to break the cycle of poverty for coffee farmers in Flores, Indonesia, in collaboration with Noble Coffee, local political leaders, and NGOs. Today, parts of the plan are being executed, bringing tangible benefits to the community. Kevin holds a Master of Science in Finance from the Simon School of Business, where he was a member of the prestigious Beta Gamma Sigma honor society. With his expertise and dedication, Kevin Sherry continues to make significant contributions in the fields of cybersecurity, finance, and social impact.

FOLLOW OUR GUEST:

WEBSITE | LINKEDIN

ABOUT OUR HOST:

FOLLOW OUR HOST:

WEBSITE | LINKEDIN

October 17, 2023

How to Prevent Ransomware Attacks in 2023 with Jason Rebholiz

Podcast: Play in new window | Download (Duration: 26:03 — 35.8MB)

Subscribe: RSS

2023 is a totally different year from 2022 when it comes to ransom attacks. Based on the activities on the dark web associated with ransom actors, the numbers are going up. Last year, Russia-Ukraine had the numbers go down, but this year, we have a 102 % increase.

In this episode of the Chattinn Cyber podcast, we have the pleasure of hosting Jason Rebholiz. He is the chief information security officer at Convus Insurance and owns a YouTube Channel called Teach Me Cyber. Jason’s passion for data security is peerless, and his knowledge of the industry is something we should all want to hear. His career started at Mandiant, where he tried different things and came to learn his passion was in data security.

Jason and Marc Schein have an in-depth conversation on Ransomware and data security. Jason brings us up to speed with the current ransomware trends in 2023, the groups that are giving data security experts sleepless nights, the effects of AI on data security, and how organizations can keep their data safe.

Would you like to learn more on how to prevent ransomware attacks? Listen to this episode.

Key Talking Points of the Episode:

[02:20] How Jason got into security

[07:31] Jason’s advice to people who want to join the cybersecurity industry

[10:22] Ransomware trends in 2023?

[13:34] Most common ransomware groups

[16:48] How safe is MFA?

[20:04] How can organizations beef up their data security?

[22:01] How is AI impacting data security?

Standout Quotes from the Episode:

“Understanding the type of MFA is going to become critically important in the future.”

“When companies can go in and create this baseline of the security controls, they are going to be more protected against ransomware and other attacks than somebody that does not have that.”

Connect With Jason Rebholiz:

LinkedIn: https://www.linkedin.com/in/jrebholz/

YouTube: https://www.youtube.com/@teachmecyber