Insurance

Insurance is a protection packet except that unlike a real gangster they take your money and give you nothing tangible in return. At least a old school mobster would maintain some form of local 'governance'.

It sells something that, much of the time, has no tangible value until the worst day of your life. Then you discover the loopholes and realize that you were paying into something that had no value.

That’s how the insurance industry works.

In that sense, it isn’t all that different from plenty of other industries that sell belief rather than real value.

Take diamonds. A century of marketing turned compressed carbon into the universal symbol of love. “A diamond is forever.” “Diamonds are a girl’s best friend.” Those weren’t laws of nature—they were advertising campaigns backed by one of the most successful marketing efforts in history.

Now the industry insists that natural diamonds are fundamentally different from laboratory-grown ones. It’s a nice story that they all want us to believe, but there’s no way it can be true. Manufacturing can introduce little flaws into diamonds to make them just as imperfect as the “natural” ones.

A piece of compressed carbon is a piece of compressed carbon, and that is it. It doesn’t matter where it came from. Whether it was a conflict diamond that little kids killed each other over or it was produced in a lab, I think I’d rather have the latter from an ethical perspective.

That’s how perceived value works. Enough people believe the story, and value is created. But it also works the other way. When people stop believing in the tooth fairy, the story doesn’t have so much value anymore.

That’s what’s going to happen to diamonds. At some point, the market will collapse.

Insurance is built on exactly the same principle. You’re not really selling certainty—you can’t. You’re selling confidence. You’re selling a promise. You’re selling a story that people hope they’ll never have to test.

Cybersecurity is uninsurable. It’s a problem of scale. The industry is dependent on monocultures, creating a systematic risk that those monocultures will be compromised all at once.

Take OpenSSL. It’s a huge vulnerability because everybody uses the same implementation everywhere. It has overwhelming market share, and it’s incorporated into devices that do not have any sort of upgrade mechanism.

When failures happen, they’ll happen at a systematic global level, which will be completely uninsurable—a black swan event. A few of those, and the insurance industry will lose its appetite for insuring anything to do with cybersecurity. It’s essentially uninsurable.

Instead, people are going to have to rely on actual engineering excellence to protect against cyber risk.

And that’s why I’m here.

Because unlike a story, I have something that measurably reduces risk. Instead of selling people reassurance after something goes wrong, I can make it substantially less likely to go wrong in the first place.

That’s a very different business.