Using AI to fight cyber risk

0:02We don't necessarily feel that a human will have to be in the loop on every underwriting or insurance related decision forever. And you're doing things like modelling doomsday scenarios and looking at models on the dark web? Absolutely. I think it's becoming harder to achieve insurance for cyber if you don't get the basic cyber hygiene right. We truly believe that there are always going to be vulnerabilities. If you've not been attacked already, it is a question of when, not if. Whoever you take investment from, ultimately you're looking to get divorced. I'm Richard Harpin, a Yorkshireman who sold my company for£4 billion.

0:41And this is the Business Leader podcast, where we look at the stories and strategies behind modern businesses. I'm passionate about helping British businesses to scale and succeed. I think it's a key to unlocking Britain's economic growth. founders and CEOs of mid-sized companies can be members of the business leader community for coaching peer-to-peer forums and exclusive learning events so please get involved in the meantime please click on the follow button it's just one click it's free and it helps us grow the community with more people on board business leader can have better conversations and inspire the UK's next wave of business leaders

1:26Today, my guest is Jonathan Spry, CEO of Envelope Risk. He's the founder of a business based in Bristol and born of AI. It uses machine learning to revolutionise how the insurance industry thinks about the risk posed by cyber attacks. How did he scale his tech business and what kind of threat does he think cyber attackers pose to British businesses? for those listeners that don't understand underwriting insurance reinsurance could you give us a bit of a dummies guide yes i think we probably all bought insurance in one form or another in our lives insurance is very simply transferring risk from us as individuals or from companies to insurance companies which are better placed to deal with those risks and the underlying principle there is that losses of the few, the losses that you might experience or I might experience, are then borne by the many.

2:21We kind of mutualise that risk. And at Invelope Risk, what we're trying to do is use data and analytics to propel that, to facilitate it, and to provide a bit of infrastructure to allow insurance companies to take risk away from people that really shouldn't be sat on those risks, particularly in our case, cyber risk. And you have operations in Bristol, your main base in London, and Bermuda. Indeed, we do. A real mix. And just tell us a little bit more about how you got into the business. I think the Envelope was set up in 2016 and you're the co-founder and chief exec. That's right. So 10 years old.

3:00We're very happy with that. We've grown considerably, but we don't feel like we're a startup company anymore. The reason for getting into this was I realized there was a need to apply better use of analytics and data to the insurance industry. And my background was in capital management. And I realized there was probably a smarter way to go around capital management and helping insurers grow their cyber books of business and help provide cyber insurance. And I was lucky to meet some individuals from the U.S. who had some very bright ideas about how you use AI, particularly machine learning, which was a far less fashionable subject 10 years ago.

3:34But I think really we were seeing the beginnings of the revolution of AI. And we brought these ideas together and a little bit of serendipity involved. but we were able to set up a company, kind of still a bit of a march on the competition. And 10 years later, everything I think we predicted to be the case has been proven to be true. We've stuck to our core mission. We haven't pivoted our business, our vision and mission for the business is the same as it was. And I think we're really comfortable that we've used data and AI in a really sensible way. And you were an early adopter of AI and cottoned onto it 10 years ago.

4:11just talk a bit more about that yeah i think you know ai is an interesting subject it's actually obviously been around a very very long time what i realized 10 years ago is that the insurance industry was doing very little when it came to using data and digitalizing their businesses so even putting aside ai there was just a lack of real discipline around the use of data and data analytics and i just compared that to the defense and aerospace industry and particularly what i was hearing was happening in the US and then I realized in the UK as well these industries were further progressed in using statistical modeling regression analysis accessing far greater computing power than the insurance industry were and I just didn't see any reason that we couldn't take the best from one industry and apply it to an industry which frankly is dealing with risk has huge amounts of data but wasn't using it properly and we just saw a way to connect a couple of dots which we thought would be would be commercially sensible and I think that's largely been borne out and the proof has been in the pudding and it seems to work.

5:11So you're a leader in the industry. Did you see those bigger insurers now following what you're doing? They are now. And actually part of our business model is to view ourselves as a little bit of an ecosystem play. We like to facilitate, offer, if you like, fundamental infrastructure for insurers. So we bring them some analytics, we bring them risk transfer and reinsurance. But what we're doing more and more is working directly with insurers to help them access sophisticated computing and AI tools, but also to get the best out of their data, to offer them a bit of handholding. And that kind of partnership approach, the solutions approach, is actually going down really well with insurers at the moment.

5:51So they're really beginning to adopt and realise the benefits of embracing these AI techniques. And you talk about augmented underwriting. What does that mean? So augmenting is really taking AI but keeping a human in the loop. We don't necessarily feel that a human will have to be in the loop on every underwriting or insurance related decision forever in the future. So we're actually looking at areas which can be automated. But in most of the sophisticated and complex risk analysis, in the relationship management, in understanding the needs of the insurance companies and their ultimate policyholders, it's still quite important to have humans in the loop.

6:26And that's very much our business model. So it's just an augmentation of AI and kind of human driven decision making. And you're a B2B business. So your clients are other insurers, reinsurers. And how do you go about winning new business? Yeah, so we're lucky in that respect that this is a relatively tight knit community, particularly in London with the Lloyds market, but also the global reinsurance market. It's not a huge number of players. The number of customers is really just the number of insurance companies in the world. We do use brokers, so we're quite a broker-driven business, but we have a number of direct relationships as well.

7:01But you're right to say we're not a B2C brand, and we don't need to spend huge amounts of time engaging in advertising and picking up consumers. What we're really doing is powering and empowering insurance companies to help them service their policyholders, to help them grow their insurance. So we're slightly more behind the scenes in that respect. An opportunity to develop the business internationally? Absolutely. So insurance and insurance are international businesses. International diversification is incredibly important to the success of insurance. So we operate these two underwriting hubs, one in Bermuda, one in London.

7:37But actually, we see huge amounts of business from all over the world in those two hubs. With time, we would expect more business to remain in regional hubs and kind of remain locally. So we will broaden our wings. We travel a lot. We have relationships in every corner of the world. And I think in the future, we'll probably have a few people based overseas, you know, Asia, Pacific, the Middle East and so on, as well as our current existing. And do you measure your sales in terms of the gross written premium rather than revenue? And then how would it split between different activities and geographies?

8:12Yes. So we have a number of metrics that we use and our investors and capital providers focus a lot on capital based metrics. So kind of returns on capital, T-VAR, tail value at risk, a measure of risk and how we do in terms of performing against that measure of risk. But gross written premium is also an important metric. The split of our premium is still highly weighted towards the US. The US has the largest and most well-developed insurance ecosystem and has been the most enthusiastic adopter of cyber insurance. But we're very well internationally diversified. We have a business which is a form of white labelling.

8:51So we empower, under a partnership approach, cyber insurance growth in every corner of the world. We're in most Southeast Asian economies. We're across Africa, the Middle East, LATAM, Central and Eastern Europe. And we do that, again, arm's length, working with local partners. But we're very, very keen on the idea of helping cyber insurance grow, not just in Western Europe and the US, but in all of these developing territories as well. And one of the big things is for medium sized businesses, how do they tackle cybersecurity? What's the level of risk for them? And what advice would you give? Yeah, so we don't get directly involved in cybersecurity, but clearly we are beneficiaries of better cybersecurity.

9:33I think it's becoming harder to achieve insurance for cyber if you don't get the basic cyber hygiene right. And you will have heard this from many different sources, but it's completely true that we need to make sure we're using multi-factor or two-factor authentication, that we're patching any problems. Software will never be perfect, and we truly believe that there are always going to be vulnerabilities. What we need to do is make the best efforts we can to ensure that cyber hygiene is as high as it can be. A little bit of a secret perhaps of the insurance industry is it's really the correlation of risks and the aggregation that cause the problems.

10:12So individual idiosyncratic risks and vulnerabilities on their own don't cause problems for an insurance company. But correlations and trends which impact a number of different companies. that could be single points of failure or widespread vulnerabilities in cyber security or it could just be a threat actor or a threat vector which impacts lots and lots of people. Those are the biggest concerns and that's where we spend most of our time thinking about, if you like, catastrophic cyber events and the aggregation, the portfolio level risks rather than just vulnerabilities at one or two particular companies.

10:47And you're doing things like modelling doomsday scenarios and looking at models on the dark web? Absolutely. So we're actually really benefiting from the use of AI and machine learning and reinforcement learning to generate hundreds of thousands of scenarios well beyond those scenarios that we could hypothesise around as humans. So we're not just looking about one doomsday scenario or a cloud failure or blackout scenario or a particular ransomware gang kind of upping their game and attacking certain victims. What we're looking at is actually scrutinizing data and extracting very remote black swan type scenarios, if you like.

11:28Lots of things going wrong at the same time, both malicious and actually unintentional. And it's sometimes overlooked that non-malicious cyber risk is actually quite prevalent as well. And that can mean just bugs in software. We've seen releases of software which have caused huge problems in the past, supply chain risks and business interruption. We also have the human risk, including human risk as insiders within companies. and whether that's partly malicious or it's just incompetence or really, frankly, just bad training, bad culture, all of these things can contribute to cyber risk. And these are all things our modelling has to consider.

12:09And for a medium-sized business, what would be the top two cyber risks in your view, looking at your underwriting models, that they should be aware of? Yeah, I think that's a really good question. I would say one would be just black swans. So nothing we can hang our hat on, but unknown unknowns. And it would be silly for us to exactly predict what they are. We're trying to be accurate with our modeling across a kind of confidence interval, across the whole portfolio over a period of time. But trying to be too precise on exactly what will go wrong is a fool's paradise. But I think the second area would be ransomware.

12:46It's just not gone away. And I think we've been talking about ransomware for some years now. The frequency is still increasing. Ransomware attacks can actually increasingly involve reattacking people that have already paid ransoms, which is a concerning trend. The average value, I think, of ransomware claims has reduced. And there's some evidence that the insurers themselves are actually assisting with negotiating ransom attacks. And payments have been reducing, but they're still, in aggregate, very large amounts of money. And this risk is just not going away. And if you think about the kind of war situations that we have, geopolitical risk, state actor involvement, these things are all linked to the criminal activity.

13:29And whether it's sort of directional or it's tacit approval, there is clearly a link between geopolitical risk and ransomware activity. And for one of these businesses, they will have some level of cybersecurity insurance written into their policies, will they or not? Not all of them. the percentage of small businesses that have cyber insurance is probably less than you might speculate it might be teens of a percent in some countries it will be less than 10 percent many more larger companies do have cyber insurance and in the instances where we've seen and i won't name anybody but i'm sure your your listeners can guess um large high profile retailers for instance not not all of them have had cyber insurance in place and those that did um i think have looked pretty smart in making sure that they've used that correctly.

14:15Maybe they will buy more of it in the future. But I think the product has proven that it works in terms of responding pretty quickly, providing budget to overcome business interruption, but also the direct claims cost, the breach response costs. We haven't really seen the impact of reputational risk, I think, being absorbed yet. But clearly, bigger companies will be thinking about what a cyber attack will mean to their customers, the law to their customers. And perhaps insurance can help with that in the future as well. And presumably you'd be recommending to every business that they should buy cybersecurity insurance.

14:51I think it's a fairly sensible thing to do. I don't think it is a substitute for cybersecurity, but it shouldn't be viewed as a substitute. The two work really well together. They're highly complementary. I think increasingly companies are expected to have cyber insurance particularly if they are part of a supply chain cyber insurance covers not just first party loss so your own losses but also the potential liability you have and clearly there's a huge amount of focus on third party liability when it comes to data privacy and so on and i think that's going to be an increasing theme for companies to think about and their liability there we've also got risks associated with ai becoming much more prevalent and much more visible and I think with time, insurance of AI-related risks, whether that's a cyber insurance policy or it's a separate AI liability policy or it's embedded in technology liability policies, I think there's going to be growing recognition and growing need to buy insurance against some of those risks.

15:49And will the policy say you should do these proactive things to bring down your potential risk or not? They tend not to be prescriptive, but I think the holy grail of insurance is always to engender some form of behavioural change. So anything that the insurer can do to actually reduce and help the companies and the clients, the policyholders mitigate their risk, I think is helpful. And sometimes there are lengthy questionnaires, sometimes there are representations and warranties sought in terms of cyber hygiene. That's always been a feature of the insurance industry. But I think insurers tend not to be too prescriptive.

16:27This is exactly what you should be doing. There are sort of sound practices, best practices, but it's not always you know if you do these six things you'll be absolutely fine it's probably just more indicative of a good culture of risk management having a CISO for instance that's thinking about this as a sort of full-time part of their role and doing as much as they can whilst realizing it's probably not possible to reduce the risk to zero and that's where of course insurance helps those are all kind of things that we would like to see companies doing. And the probability of having an attack is what sort of percent?

16:59Depends on the type of business you are. It depends on how visible you are. And it depends on whether or not you have vulnerabilities and how well known they are. Pretty much every company has some vulnerability. And if you've not been attacked already, it is a question of when, not if. Many companies are attacked frequently, multiple times in a year, sometimes multiple times within days or weeks. So this is a kind of 100 % risk. Now, whether or not it's a successful attack and whether they come back and how damaging, that is a different question. But in terms of are you exposed? Will you experience this?

17:35Is it happening right now? Whether you know about it or not? Almost certainly. Yes. So in summary, on cyber, the one biggest thing that these founders, CEOs should do would be what? Get your hygiene right. Think about your culture, the people you have, and ensure that risk management is embedded in your thinking. And then talk to your broker or your insurer directly about what is possible with the insurance. Don't view those two things as substitutes, but do invest time. I think it's important that boards of companies, advisors to companies also have some capability and some knowledge of cyber.

18:11This issue is not going away. The world is not going to stop digitalizing. And obviously there is a wave of AI coming to almost every industry, good and bad. and I think invest the time to try and understand this and realise that it's not possible to remove the risk completely but you can mitigate it and insurance is there to pick up the parts of the risk that you can't mitigate. And looking back to setting up your business 10 years ago, did you bootstrap it or did you need to take investment and bring in some cash? Yeah, we did. So we were fortunate that we'd worked with another company that already was developing IP.

18:49They then transferred their IP to Envelop, which became a new company, and they took a shareholding in that. So I was quite lucky that we managed to accelerate the formation of a management team from different backgrounds, both sort of financial services in the UK and technology from the US. Brought those two things together. The minute we set the company up, we then went about raising money. We've had quite a journey. We went through the normal rounds of seed investment and friends and family and family offices. And then a series A, which was led by two VCs that were both very AI driven. And then four and a half years ago, we took a series B, which was much larger, around$130 million.

19:28We've not needed to raise money since then. We are profitable as a business and cash generative, which is a great way of raising money. You're raising money without really having to try too hard to meet new investors. Whether or not we raise more in the future will just depend on the kind of buy versus build narrative. You know, just how many organic and inorganic growth opportunities are in front of us. At the moment, partly because of the heightened attention around both cyber and AI, there's a huge amount of growth potential for us. And we're really doing everything we can to try and realize the benefits of that growth.

20:03Your advice to other entrepreneurs looking to raise some investment? Yeah, and there'll be a number of pieces of advice. I think choosing your investors carefully, as long as you've got the luxury of choice, I think is really important. These are people you'll have to work very closely with. And when VCs and private equity tell you that there may be other benefits to having them invest, take that very seriously. And I found that some investors can be incredibly helpful when it comes to introductions, to advice, sometimes even operationally, it can be important. So I would take that seriously. you also have to realize whoever you take investment from ultimately you're looking to get divorced and you have to think through the timelines their expectations what kind of returns you can deliver and nobody is in bed with anybody from an investment perspective forever and you have to accept that I think investors increasingly really want to see the moat that you can build around your business I think we're really proud of the fact we think we've got a data-driven flywheel at the heart of everything we do.

21:02And that means we've got what we would see as perhaps surprisingly deep moats around the business. And that makes our conversations a little bit easier. And I think if you're thinking through new business plans, try and think about the competitive landscape as it stands now, but also potentially in the future. And how will you protect your position? How can you demonstrate you're using data in a sensible way? More business perhaps brings more data, more data brings more business. I think those kind of flywheel pitches really get traction with investors. And how do you make sure that you stay ahead of your competitors and you continue to have that moat?

21:38Yeah, you have to work very, very hard to do that. And I think the risks with businesses like ours would ever be sort of resting on our laurels. We have built our business on machine learning and then more sophisticated kind of reinforcement learning techniques. But we've begun to adopt many of the generative AI, large language-based models. We've always paid close attention to frontier technologies. Quantum computing is a good example. Actually, the founders of our business originally had been heavily engaging in quantum computing, quantum software, 10 years ago, which was a long time before most people would be accessing that technology.

22:16And even now, there are very few commercial applications, but it is coming and it's much closer than it was before. So I think just staying as close and as proximate to the frontier technology as possible is one way of outrunning the competition. And just being very, very sincere in the belief in supplying infrastructure. So we're really here to facilitate others. And we don't become obsessed with the nature of competition. Some potential competitors, some existing competitors are also clients of ours. we're happy to facilitate that it's kind of a frenemy model of the world you're sort of sharing some learning exactly and i think through that we we remain relevant um and you know not arrogant and i think we're very open to new ways of doing things looking at some incredibly smart startup companies how can we work with them um how can we get capital to them allow them to grow but also grow ourselves that's much more our way of thinking rather than just sort of trying to eliminate every source of competition.

23:13And views on the AI landscape in two or three years time? I think it's difficult to predict two or three months time at the moment in AI. Ultimately, this is here to stay. We think the benefits of AI analytically are incredible. And actually, if people are struggling to find real world uses of AI that are truly benefiting society and the economy, then risk management is a really good place to look. And actually, what's happening in the insurance industry will benefit the consumer. It will lower the price of insurance. It will make insurance more available because we're all going to be better at managing our risks.

23:48And I think I'm very defensive of the use of AI and the benefits of AI within the risk management and insurance world. But clearly AI is bringing risk to society and to the economy. And my hope is that we can use the analytics we have and that will actually better enable us to deal with some of the risks that emanate from ai as well so this is this is clearly a revolution i'm not going to make predictions as to where this takes us and whether certain types of models are now dead ends and you know we need to start thinking through newer techniques it's questions for the future that we can all answer i'm i'm not terrified by the prospects of um artificial general intelligence or general artificial intelligence god models i don't think we're quite there yet um in the meantime rather than worry too much about those kind of existential risks to humanity um it's better to think about some of the more realistic but still catastrophic risks that could come with use of ai and that's really where we're focusing on now it's you know let's get the benefits of this right but let's not be um blind to the costs of ai too and what might those risks look like?

25:00Well, we see models, chatbots generating results, which can sometimes be less than factual. We talk about hallucinations in models and so on. We see AI being used sometimes inappropriately in professional contexts. And sometimes it's not clear if AI has been used or not. Judgment within some of these models, I think, needs to be calibrated and checked quite frequently we're also seeing ai being used in generating attack vectors there are trends in deep fakes which you'll you'll know about which are quite concerning and so i don't i don't think we want to be blind to the risks associated with ai there are clearly risks associated with the the turmoil that this can cause the economy in terms of jobs the job market the future of work And I think the insurance industry can help with almost all of that.

25:57But I do think we need to have our eyes open when it comes to the generational type shift in the way our economy is organised, how capital is allocated and what people get out of work and where the human should be in the loop is a big question at the moment. And we're having to get our heads around a world that's moved very, very quickly in terms of human decision making versus machine decision making. And does any of that create opportunities on product development and increasing the range of services that you're offering, Jonathan? It does. So all of a sudden, we've spent 10 years earning our keep from underwriting.

26:35But now we're being asked to engage more in service delivery, platform delivery. And we're really excited about that. So the fact that we've sort of proven our approach works for ourselves means that many of us, and maybe in the future that will be corporates as well as insurance companies, have come to us and said, well, can you assist us with the use of data, data science and AI? So it's creating a huge number of opportunities for us as a business and those around us too, the industry we're in. Love to hear about leadership and how you've developed your team over the years. Yes, I would look back and I'm sure we would do things very, very differently if we had our time again.

27:13In what way? Well, I mean, we've had our bumps in the road just like anybody else. I think we, I really believe sincerely in people. And I think that, you know, the best thing we have isn't data analytics. It's the people we have around it. And I think investing in people, retaining, recruiting, finding pockets of talent in an industry, which is sometimes a little shallow when it comes to kind of technology talent, that's been very successful for us. And we've been very, very successful in retaining key people for years. I think we've definitely taken a view that having a business model, which is more infrastructure driven, going into new territory, kind of blue ocean strategy and avoiding some of the red ocean type competition, particularly if it involves huge sales costs, kind of B2C models that we're not in.

28:04I think we've made the right decision there and we'll stick to that. But equally, just trying to really understand the role of product management, which has been quite unusual in the insurance industry. So product market fit. Will people adopt what we want? We might have a great better mousetrap, but does somebody really want to engage with that and adopt it? That for us has been a test that I think has helped guide us through kind of the good times and the bad times. And the biggest single thing in terms of retaining your top talent? Well, I think that goes back to the point about leadership.

28:38It's conviction in the narrative that we have, I think, is probably the most important thing. So we had a view of the world. You can view that as our corporate story, the founding myth, and we really believe in it. So when we deliver our narrative, we try and deliver it with real conviction. We really believe in it. We actually bet on ourselves. We take risk alongside our other balance sheet partners. And I think it's that level of authenticity in the leadership approach that we take and in the conviction that means that people want to stick around because they actually believe in it and they believe in what we do.

29:12And did you take a view on recruitment that everybody needs to be called Jonathan? We have quite a few Johns and Jonathans. We're moving on to other names now. We've got a few Izzy's now, which is great. I don't quite know what went behind that, but there was a point where it seemed like all of us were called John or Jonathan. But the good news is we're more diverse than we used to be. We have more than less confusion then. Indeed. Indeed. Right. What does the future look like in terms of the shareholding of the business? You were very successful in attracting SoftBank as an investor. When will they want to exit?

29:46What does the future look like? There's always some uncertainty around that. And every single investor I have, including friends and family, will want to exit at some point. I think we believe in independent ownership for some time, but we're huge, huge believers in strategic partnership. So we already have investment from some insurance companies, reinsurance companies, and I expect us to get more of that in the future. Whether ultimately that means we IPO, we list in London or New York, or we stay in private ownership, private equity maybe replaces some of the existing investors um secondaries and so on that that's all possible um but i think trying to avoid the crystal ball as to what will happen to the cap table we have quite a few investors they have different motivations different expectations i'm sure some of them will grow with us do more stay in some may choose to exit and that's fine um so i think we're sort of pragmatic about that but we we don't see any huge need to relinquish our independence immediately and i'd like to stay independent a little bit longer we desperately need more businesses like yours to um consider listing on the london market don't we what can we do to make actually fortunately i think you know the the question marks around london listings and whether or not london's the right place for a technology company to um to to list and to ipo i think actually with the insurance industry and with cyber those are two areas that are relatively well understood in the UK market.

31:15And obviously, there's a huge amount of US and elsewhere investment into the London market anyway. So I'm not a huge detractor of London when it comes to our potential future. By no means certain that that would be what we would choose to do. But I do sense that there is at least as much attention, relevant equity analysts and so on, that understand the insurance, particularly the specialty insurance and reinsurance sector, which, let's face it, is still very anchored in London on the global stage. And I think cyber is something we're really good at in the UK. And Envelope isn't just cyber, and we won't just be concentrating on cyber in the future, but cyber is a big part of what we do.

31:52It's kind of a shop window for a lot of what we do. So I think those two things together would mean we would certainly not rule out a London approach. But of course, there are attractions of markets elsewhere as well. And your main base is Bristol. great that you're outside of London and did that present any challenges in terms of hiring great people there or no quite quite the opposite we went there deliberately because we we saw a um a talent pool which had defense and aerospace as part of it there's obviously a big defense and aerospace industry to north of Bristol stuff like GCHQ and others not so far away as well and and so on so you've got that pedigree and that legacy you've also got fantastic universities in that area and you've got a young vibrant mobile population so it ticked all of the right boxes for us it was all we moved there to get the talent and and certainly haven't suffered from doing that of course we employ people elsewhere as well underwriting teams tend to be you know in in their traditional homes london and bermuda we also have data scientists and engineers elsewhere in the world in the us elsewhere in the uk as well but bristol's worked fantastically well for us and We're very proud to be home there.

33:04We try and be a bit more visible recently in our local community. In what way? What do you do? Well, we've done a few things. We've sponsored the Bristol Bears women's rugby team. We've engaged more with some of the meetup groups and people like FinTech West and so on. We've engaged more heavily with the universities. Bristol University has some supercomputing power, which is very interesting. more talent flowing into the area um there's a real home for ai and that's to raise your profile as a uh great place to work yeah absolutely partly that but also partly to give back a little bit to to the community that we're we're in and um swap ideas with with others uh you know similar-minded individuals in in the area so yeah we feel very very happy being being home there as well and you what you set up the business with a co-founder is that what you'd recommend does that make it sort of less lonely as an entrepreneur?

34:01Absolutely yeah and I think in in my case I would never have been able to understand how we could use analytics in the way I think I knew what the questions were but some of the answers would would have been incomplete and I think the benefit of a co-founder route and maybe even more than one co-founder if that makes sense is is just to be able to test more of those ideas it doesn't mean you have to dilute the story you don't have to be any less visionary hard working but if you if you choose co-founders that i think are a little bit diverse um but at the same time believe in the same vision and mission then i think that just accelerates your journey rather than relying on a single individual to make all the mistakes themselves and uh you know have to learn from those mistakes learn from other people's mistakes is obviously going to be a quicker and more effective process and other sources of help and advice have you had a business coach or mentor along the way informally um yeah quite a few mentors um i i did an mba around the time of setting up the business and i've kept very close in touch with the with the business school and i do some tutoring with with the business school now um side business school at oxford and that's really beneficial so i talk to founding teams now and i can provide some some coaching and mentoring but equally i get a lot back from that and i'm i'm learning a lot about So a two-way thing.

35:25Yeah, it's very much a two-way street. And equally in the insurance industry, we may not have insurers that have been at the cutting edge of technology before, but with incredibly successful entrepreneurs in the insurance industry right here in the UK and in London. And it's been great to benefit from mentoring around that part of the world as well. And it can be a little bit opaque sometimes in the insurance world. and having guidance as to what works, what doesn't work, how you access capital. That's been really helpful to us as well. What do you think holds entrepreneurs back in seeking a mentor?

36:00Incredible question. I think there is always a reluctance to share any dirty linen. People don't like admitting what they don't know. I think some entrepreneurs are, by their very nature, can be introverted, some far more extroverted. And in my case, I can be quite introverted in many ways. And sometimes having additional scrutiny, having people challenge your ideas can be inconvenient. It can cause you to become anxious. I think I learned with time that I benefit from having challenge. It's really good to listen and not just talk. And I think maybe seeking out the right entrepreneur to act as a mentor or as a coach is something that people find tricky.

36:46We should definitely do more of it. And I think anybody that's benefited from mentoring needs to give back. So keep that kind of virtuous circle of coaching and mentoring. Like you say, it's a two-way street. I think we all learn more from our mistakes and our successes. And I made lots and lots of mistakes. What was one that you made over the last 10 years, Jonathan, that others could learn from? We overestimated how quickly parts of our industry would adopt new techniques. And then the risk was that we would then underestimate that they would then do that. So you tend to overestimate what might happen within five years, but then forget that those things will still happen within 10 years.

37:30And quantum computing might be a good example of that. So the risk was we'd just become frustrated and spend lots of money on technology, but still have all these humans doing the same thing that the humans that the competitors would do. And being precisely wrong, if you like, was never going to be a value adding attribute to our company. Fortunately, we were able to find patients and there were probably, you know, through COVID and so on. I think we actually realized we were able to operate as normal in a very digital and distributed fashion. And that gave us a bit more encouragement. But it did mean that some of that sales cycle growth was slower than we would have liked it to have been.

38:10Would you have then sort of cut back a bit on what you were spending, knowing that it was going to take a bit longer to adopt? We've actually not. Well, no, maybe in other circumstances. But we've been so mean and lean and so disciplined about that. And we've never we've never exposed ourselves to runway problems and kind of running out of cash. we've been a little cautious maybe have we been too cautious i i don't think so i think we got it about right but we never threw huge resources at areas that we didn't think were going to work and we like to wait for a little bit of evidence and then kind of double down and scale up um so i don't think we got that wrong but we we easily could have done it's probably as much by chance as by design um but i think a lot of people learned through the pandemic um what it really meant to be a business that didn't have the luxury of years of legacy and huge cash kind of cushion and we really kind of you know seat of the pants type stuff running a business in that area and we learned so much from it so and finally a couple of bits of advice for medium-sized businesses that are scaling you've been very successful in doing that what would be your tips no silver bullet here but I think understand infrastructure within your industry.

39:27Either you're providing infrastructure or you need to develop a relationship with the kind of complementary assets. Think about what is the supply chain you're in and how can you think through that kind of ecosystem? Like which of the companies need to succeed for you to succeed? How can you benefit from that? I think number two is definitely people and all things people related. Get your hiring philosophy right. Stick with the people that are good even if they challenge you. accommodate some diversity within the group of people you work with and then I think the third area would be product and particularly in our industry the insurance industry product management is just given far too little attention and finding product market fit and really thinking about the adoptability of your product the usability and how you retain your customers not just acquire them that for me has been a bit of a secret source that we've been able to apply to a few things we've done so maybe those three things would be why do you think companies not focused enough on product development i think it might be a uk problem i see more focus on it in the us but it is a particular problem in the insurance industry and i think there's just not been a an obvious role for a product manager within the kind of underwriting world particularly this is true in the specialty insurance and reinsurance market in consumer-led kind of personal lines insurance that may be less true but I just don't think anybody felt that they wanted to take on insurance as if it was a product they've viewed insurance as a process of moving risk and capital but actually at the heart of it is a policy and potentially a claim that might need to be managed if you approach that as a product then you actually have a much better understanding of how to become more efficient and how to increase the the kind of efficacy of that of that product so I'm looking at your industry, insurance, reinsurance, is that an opportunity for more start-ups here in the UK, do you think?

41:22It definitely should be. I think we're one of the very few instances of a reinsurance-focused start-up, and there are obvious reasons for that. Barriers to entry, visibility... Which is the amount of capital you need and knowledge. You need a lot of capital. So you need to be able to find a way to work in partnership. We're clearly not building all of our own balance sheet ourselves, so it's a partnership model um those models work if you get them right but for a for a huge balance sheet to expose themselves to billions and billions of dollars of risk and potential loss that requires huge amounts of trust and what we were able to do is use took a little bit of time but we were able to use technology and data and evidence as well as a bit of skin in the game we've said well you know if you're losing money we're going to lose money first um and that alignment i think has helped win win trust and balance sheets um and the fact that we many of us have worked in this industry before that probably helped too that's not to say that a younger team a team from outside the industry can't make an impact but i think people have to work their way through the dynamics of the insurance industry and think about why it's been slow to be disrupted and it certainly hasn't been disrupted in the way that many many other industries have it it's happening but it It happens at a slightly different pace.

42:39And I would encourage startups to think about the insurance industry. It's a huge industry in the UK. We're very good at it. Huge amounts of money involved. But it really benefits society as well. So it's actually a really good place to use innovation. But you have to be pretty smart about how you apply that. So there you are, an opportunity waiting to happen. Jonathan, thank you so much. Thank you. I've really enjoyed it. You've been listening to me, Richard Harpin, speaking to Jonathan Spry of Envelope Risk for the Business Leader podcast. Please do rate us and subscribe to us and visit our Business Leader website to sign up to our weekly newsletter and find out opportunities for your business.