Suggestions
Rotem Iram
Founder and CEO @ At-Bay
Professional Background
Rotem Iram is the visionary Founder and CEO of KeepRisk AtBay, a pioneering insurance company dedicated to safeguarding businesses against digital risks. Under Rotem's leadership, KeepRisk AtBay aims to navigate the complexities of cybersecurity and provide peace of mind to organizations by identifying critical security measures that keep their operations safe and resilient.
Before founding KeepRisk AtBay, Rotem amassed extensive experience in the fields of cybersecurity, consulting, and engineering. He was previously the Founder and CEO of at-bay, where he focused on developing innovative solutions in the insurance market, specifically catered towards emerging digital threats. His passion for protecting businesses from cyber vulnerabilities drove the growth and success of at-bay, establishing it as a trusted name in the industry.
Education and Achievements
Rotem holds an MBA from Harvard Business School, which is known for cultivating innovative leaders with a thorough understanding of business dynamics and strategic management. This prestigious education has empowered him with the skills necessary to steer successful ventures and make informed decisions in the fast-evolving landscape of cybersecurity and digital risk management.
Prior to attaining his MBA, Rotem earned a Bachelor of Science in Computer Engineering from The Hebrew University of Jerusalem. His academic background in engineering has provided him with a robust technical foundation, enabling him to comprehend the intricate systems that underpin cybersecurity and digital infrastructures. This blend of business acumen and technical expertise has been instrumental in his career progression and the molding of his entrepreneurial spirit.
Adding to his impressive resume, Rotem has held several key positions at renowned organizations. As the Chief Operating Officer at K2 Intelligence's Cyber Security Practice, he was responsible for overseeing operations and strategies that prioritize cybersecurity solutions for businesses, thereby ensuring a proactive response to evolving digital threats.
Before that, Rotem served as a Consultant at McKinsey & Company, where he harnessed his analytical skills to advise organizations on various strategic matters, particularly within the tech and cybersecurity sectors. His time at McKinsey allowed him to develop a keen understanding of industry best practices and operational efficacy, further enriching his capacity to tackle challenges faced by businesses in the digital landscape.
Early in his career, Rotem demonstrated his technical prowess as a Software Engineer at RAD Data Communication, where he developed critical software solutions that bridged communication technology and cybersecurity. His foundational experiences in software engineering play a significant role in his current approach to managing digital risk as an insurance provider.
Military Experience
Adding further depth to his diverse background, Rotem served as a Captain and Group Leader at Israeli Military Intelligence, specifically in Unit 8200, which is known for its intelligence gathering and cybersecurity operations. This prestigious unit has honed his leadership skills and strategic thinking, fostering a strong appreciation for the importance of safeguarding sensitive information and digital assets.
Achievements
Throughout his career, Rotem has made significant contributions to the fields of cybersecurity and risk management, establishing himself as a thought leader and innovator. His relentless dedication to enhancing security measures and developing comprehensive insurance solutions against digital threats exemplifies his commitment to protecting businesses and their stakeholders.
As he continues to guide KeepRisk AtBay, Rotem Iram remains focused on pioneering initiatives that will reshape the insurance landscape in relation to digital risks, ensuring that organizations can thrive in an increasingly complex digital world.
Highlights
We're in ransom payment limbo - is it worth it?
It's been six weeks since Lockbit's senior operator, Dmitri Khoroshev, was added to the OFAC list by the Department of Treasury, leading all insurance carriers to deny ransom payments to Lockbit affiliates.
Lockbit, responsible for ~20% of ransomware claims in 2023, is now under OFAC, making ransom payments unviable and creating an unpredictable claims process and outcome that undermines the quality of the insurance product.
Early results from Lockbit claims in the last six weeks are mixed, but there hasn’t been a significant spike in severity. With only 47% of our customers paying ransom in 2023, and given that paying criminals never felt right, we must ask – is it worth it?
I interpret the legality of ransom payments not as a moral stance, but rather an admission of failure by the government, signaling, "We're not stopping these guys unless they target high-profile victims, so instead feel free to pay criminals to reduce your damages". I may be wrong here but either way I am not holding my breath waiting for the government to provide clarity on this issue.
Should the insurance industry take the lead here? make the product more predictable, and also do the right thing. Cyber insurance is an inspiring line to me because carriers do so much to help our customers reduce their risk. It may be time that we set a moral standard and cut the legs underneath this ransom economy.
What do you think?
Link to Treasury announcement adding Lockbit to OFAC: https://lnkd.in/gPNFBgjK

Data Privacy liability is making a comeback!
The first decade of cyber insurance was all about data privacy liability. I first got introduced to cyber insurance after the big Target breach in October 2013, where more than 40 million credit cards were stolen. But since 2020, ransomware has become the dominant driver of loss, as attackers, enabled by a new innovation in untraceable funds (bitcoin), found it is more profitable to hold companies ransom for their data.
In 2023, we've seen data privacy liability make a big comeback due to two factors:
1/ A significant increase in third party class action lawsuits (Plaintiff Bar and others), going after tracking technology embedded in websites ('Meta Pixel'). Initially limited to the healthcare sector, we're seeing more litigation. I do not support thid kind of 'ambulance chasing' litigation, but it is a new reality our customers are facing.
2/ Ransomware tactics have changed. Companies have responded to RW threats by improving their backups. Less and less companies find that they need to pay the ransom demand and opt to restoring from backups. As such, attackers have adapted and are now both encrypting and exfiltrating senstivie data to create "double leverage" on their victims. Pay us, or we will leak your private data (and your customers' and partners' data along with it). More and more organizations are finding themselves included in the blast radius of a ransomware attack. Their vendor or partner was attacked, the attacker exfiltrated data that included their own data, and now they have a data privacy breach liability they need to manage. We call these 'indirect ransomware' victims and they have blown up in 2023, mostly but not solely due to MoveIT (and that trend continues in 2024).
Read more about this and other findings in our annual InsurSec report. link in the first comment.
