Cyber Risk Engineering and Emerging AI Risks with Jay Vinda from Mosaic Insurance

0:00My job is basically sitting there and thinking, right, how would I hack Mosaic? It's state-sponsored, it's well-funded, it's well-organized, and they run a lot like the insurance companies. It's literally a criminal marketplace. There's so many tools out there that say they're AI-powered cyber security or next-generation AI cyber security, and it's just a lot of fluff. I'm most concerned about people doing stupid things. if Mosaic gets taken down because someone clicked to a dodgy thing, that's my fault. On this episode of the InsureTech Geek podcast, we explore cyber risk engineering, the emerging risks surrounding AI, and how cybersecurity intelligence is changing insurance with Jay Venda, Global CISO and Cyber Risk Engineering Lead at Mosaic Insurance, live at ITC 2026.

1:01The InsureTech Geek podcast is all about insurance and how it's being transformed by technology. Join us on a disruptive journey, interviewing the leading voices of the insurance industry from all around the world. So enjoy the ride and geek out. Tara. This week's episode sponsor is revolutionizing the world of workers' compensation claims and policy management. Tara's cutting-edge platform empowers insurers with comprehensive benchmarking tools, robust management systems, and an integrated ancillary services marketplace. Discover how Tara is driving innovation and efficiency in workers' comp at tara.insure.

1:42and we are here with Jay here live in Las Vegas Viva Las Vegas or not so much depending on how you feel about Vegas with uh my good friend from London Jay Vinda the CISO that's Chief Information Security Officer at Mosaic Insurance Jay how are you doing doing all right man doing pretty good still jet loud but uh first time in Vegas yeah first time in Vegas yeah yeah there's there's a lot of fun to be had here uh there's a lot of exhaustion to be had here too though Yeah, but you know keep oxygen pumped into the casino so you don't really feel it. So that's nice That and cigarette smells yeah, I don't have no it's actually quite quite fun.

2:18They are they they let you smoke at the table So you don't anywhere. Yeah, they don't want you leaving They don't want you leaving because they know as soon as you leave and you have that kind of thought you're like Yeah, maybe I should go to bed. Yeah, and they're like maybe you shouldn't stay here stay here kids Whoever you like it you want to go to a show it's right there and then you can come back here after the show Exactly, it's it is a building they you know, we talk a lot about software companies hacking human attention span and forcing people into doom scrolling. But the original attention span hackers, you're here, buddy.

2:50Just go check out a slot machine. Honestly, the dopamine hits from walking through them. It's all dopamine hits. Even down to the tones they use. The frequency, the tones, the volume level. It's really well thought out. Oh, wow. Honestly, that's one way of saying it. I mean, just sitting here and being like, I wonder how much revenue caused through you per minute. I mean, being really well thought out would imply that they had the best interests of their guests at heart. It's a profit-making company, right? Absolutely it is. So this is your first time in Vegas, which means it's your first time at ITC because it's always in Vegas.

3:33You've been in insurance for two years. You've been in cybersecurity for 10. but I want to go back, back in the time, way back in the time. Now, I am a bit of an aficionado for accents. Okay. And so it sounds to me like you grew up in London. I did, yeah. So that's just going to guess. So born and raised in London. You still live in London and work in London. You've never been to Vegas, which means you haven't spent much time in America because you would have come to Vegas if it was a conference. Yeah. But you definitely had a career before insurance. Yeah. And it sounds like you had a career before cyber.

4:13So walk me back to when you were a kid, when you're growing up in England. Yeah. First off, what's your favorite football team? Not a big fan of football. Ah! Cricket? I started enjoying Manchester City was good fun for me, and growing up in Liverpool as well. But the thing that I really get annoyed about with football fans is you're having a great conversation about the current season, and then someone just pulls out shit that happened in 1990. Yeah. Like, honestly, I don't know. That's a British thing, though. Yeah, that's it. But that applies beyond football. You talk about current year politics.

4:49You're like, yeah, but Maggie Thatcher in 1992. Do you remember? Yeah, it's just too much, honestly. I just gave up on it after that. Okay, so do you like cricket? Do you like rugby? Do you like, what do you like? I like rugby. I like football a bit. I like watching Flip Watchers don't keep up to date as much. Got it. That's fine. As other people. But no, like growing up always kind of been, you know, sports is just always around. So what did you want to do when you were growing up? Oh, when I was growing up, I wanted to be a chef. A chef? Yeah. Do you still like to cook? Not as much, no. Delivery is just so, you know, convenient now.

5:22And I think the issue for me was, you know, I love cooking. It's a really good thing for me just to relax and then to switch off or to it. But I get really bored of cooking the same meals all the time. And then just to be eating that the whole time, whereas deliveries, go have you fancy, right? Well, you know, it's been a great hack because I grew up cooking. My mother is an incredible. I grew up in South Louisiana, which is, you know, the France of America. Yeah. Right. We're like the Quebec of the United States. So strong French heritage. My mother's French. Okay. Like not from France, French heritage.

5:54Oh, yeah. So and her mother only her mother spoke French and English and cooked French food at home. My mother kind of did the same thing with me. uh but i can tell you i love cooking claude has been my godsend because it keeps track of you know what i'm eating and i have food log in it and then i just say hey look what should i make tonight yeah and uh and i'll take pictures in my fridge in my pantry and it automatically it automatically inventories what i have and then it gives me ideas that's pretty nice and uh because i really i really love to i really do love to cook and you know it helps if you have someone to cook for because it's more fun to cook for two than for one i see yeah i'm cooking for one i'm I'm just like, well, so I've got this, and then I'm going to have this for lunch and for dinner.

6:32And I'm just like. That means invite some friends over, right? And I generally rotate between fish, pork, chicken, beef. But that's not what this podcast is about. You wanted to be a chef. That didn't happen. You went to Uni for what? Went to Uni for mechanical engineering there. Okay. Four years on that. I really enjoyed that, actually. I kind of didn't really know why I wanted to be kind of growing up post-Uni at the time. So I went with mechanical engineering. Yeah, nice, easy topic. Oh, it was very simple, yeah. What could go wrong, right? Not easy at all. Okay. So I did that for four years, going on some pretty cool projects there.

7:06Went out to Peru for a couple of months, doing volunteering work. So I was building wind turbines for villages that didn't have access to electricity. That's a cool deal. That's pretty cool fun. And the whole time really kind of got instilled into me that I just loved solving problems. Really learned how to tackle a problem head on. Came out of uni, couldn't find a job. So I thought, all right, what do I do? Should I do it with my time? Started applying for, you know, almost everything. And cyber security was one of the things I applied for. And just kind of picked up a grad scheme on it and thought, you know what?

7:38I'll do it for a couple of years. Let's see how it works. And then I'll maybe switch back into engineering. I came in at a really interesting point inside of the game. A real inflection story. September 2016 is when I started. Just around the time the Mirai botnet started screaming out. which was this swarm of IoT-connected devices just DDoS-inplug ex-game denial of service attacks on companies and... And for the uninitiated, a DDoS is a distributed denial of service attack where a bot takes over a whole bunch of different machines and then slams traffic and basically waterboards a server. Yeah, exactly.

8:14And it's like the stuff that you're hearing Anthropic and OpenAI talking about now with the claims of the big AI swarms and web basically thought that uh but then you know 2017 we had big ransomware attacks i wanted to try and not best here hitting um yeah well operation cloud hopper as well where it was he has a chinese nation state backed um espionage criminal group that is spying on itmsbs and then zero day vulnerability just kind of causing half of the chaos like if you remember back in 2017 we all had this this global issue of just i'm using my laptop and it just blew springs of death randomly constantly every single time i use it that was related to vulnerability with meltdown inspector which just led to a lot of war rooms and a lot of panic and chaos trying to trying to figure out how to not make these devices over the screen attached all the time yep um so it's really interesting time to join inside security and the tears in the grad scheme and i thought you know what i like this place and stick it i'll stick it out yeah the rest of that was kind of history you like that and so did you get it did you get a graduate degree in cyber i did yes i did the mechanical engineering one first.

9:21That was an undergrad. Then grad school was in cyber. Yes, I did an M.N. in mechanical engineering. And then when I started working in cybersecurity, I then went back to uni whilst working as well. Wow. Did a M.S.E. in information security. That was, you know, at the time it sounded like a great idea. And then while I was doing it, I brought to myself. Okay, so we're going to resume. So you were working and then you were doing your master of science in cybersecurity. Yeah. And you're a very good security. It sounded like a great idea at the time and it sounded like a Spanish tool. And then while I was doing it, I kind of sat there.

9:59I remember doing my dissertation and still sitting there and I was like, right. I've got to write a dissertation now and I've still got a job. It's like, why the hell did I do this to myself? That's pretty brutal. Yeah, that was not fun. Yeah. That's pretty brutal. But you did it. I did it. I got through that. Yeah. But that's good. What I like about the engineering mindset is that fundamentally, you can be an engineer in any of the engineering disciplines, but it fundamentally teaches you problem solving. Yeah, that's it. I mean, engineering is problem solving at its heart. Ideally, it's not regulatory compliance.

10:33It's a problem solving degree. I think that's a big thing I'd say from it, right? Just the ability to kind of look at any problem and just say all right well how would i start trying to solve it and quite often i'll try and solve something i don't solve it but it's just that ability to get started if i really liked so was the it wasn't the same issue with cyber security that the idea of being the the good cop uh protecting protecting folks from all these uh all these threats or what what about it was really appealing to you i think at first it was just quite a technical kind of discipline it was um and quite fun as well so when i came into this was on cyber security because we would build drones and pack drones big posts it's fun exciting why not right and then within a couple of years cyber security then came to ask a massive board issue and revolutionary compliance started here again cyber risk management started becoming its own discipline and suddenly it was the thing that was a really fun thing to do suddenly became a hey if this gets done really badly at a company People that die or do we get massively fired and so on.

11:38It was kind of like, whoa, are they? Now I've got a job that actually means something. That actually really needs to be thought about rather than, hey, I want to build a joint and pack a joint because it's fun. Yeah. Yeah. Yeah. It's serious. I mean, I think it's probably one of the most important technical professions in insurance right now. Yeah. considering that insurance sits on the treasure trove and the honeypot of data the amount of data that has PII yeah I mean it's everything you'd ever need to hack the world is inside of insurance here yeah it's it's incredible and it's the thing that I find crazy is how and I mean you'll see when you look at all the vendors in ITC ways there's loads of data and there's treasure trove data but the way it's been standardized and inflated and categorized it's just not that great yeah so insurers have loads of data but they're just not using it very well yeah whereas if you're like well they're not using it very well and they're not using it very well for their own purposes for good purposes and and then of course a lot of other people want to use their data for them which is dangerous and not good yeah it's not ideal but there's ways there's you know there's there's some nice bits out of it but all right so let's jump let's jump in and have a a little bit more substantive conversation i mean your path into insurance was different.

13:01I appreciate you explaining how engineering led you into cybersecurity and led you into the field. And obviously, then your career in cyber led you into the honeypot of honeypots insurance, which makes a ton of sense that you would eventually wind up in financial services somewhere because it's such a big deal. And banks, obviously, are the other parties that have just an incredible amount of data that's out there already. Most of my cybersecurity background was a financial institution, mostly with banks and a bit of government as well. I did a little bit of insurance, but not loads. And I think, you know, after eight years of it, I just kind of wanted a change of pace, change of scenery.

13:40Having worked at banks, I kind of saw, well, I looked at the regulations and clients and the culture, if you will, within the organization. I was kind of like, let's try insurance out. They must be friendlier. Yeah. Well, let's talk about Mosaic for a second. What does Mosaic do? So Mosaic is a specialist insurance company that are based out. We've got regional hubs across six countries, but two Lloyds syndicates that we underwrite on behalf of. So the thing that's unique about Mosaic is we underwrite on our Lloyds syndicator, then also stretch out our cast to third parties in the management partners.

14:11So essentially it's like that MGA model, except we have skill in the game on our Lloyds syndicator favor as well. So for every risk, there's a way. You share in the risk. Yeah, we share that risk. Yeah. so we always have 20 to 25 percent of the risk on our minimum and what lines um so i think it's 10 lines now cyber insurance is the main one i obviously focus on but i'll probably get it wrong but i think it's cyber political violence political risk environmental liability professional liability energy liability litigation uh so no stuff financial institutions oh it's all over the place. It's a true mosaic of coverage.

14:51It's an actual mosaic is actually a mosaic. The name is pretty cool. The mosaic's appropriate. Yeah. Okay. So when you say you primarily focus on cybersecurity, you're the CISO for the insurance company, but you also focus on the cybersecurity insurance line. So explain how that works. Okay. So I have two reporting lines. I report to the chief operating officer, who is our SMF 24. So she leads operational resilience for the organization and my cyber security deceter role feeds into that for cyber resilience and then I also ripple into the head of cyber underwriters here as well so cyber underlying it's about 40 underwriters globally spread across six countries so it's both Canada, US, Bermuda, UK, Germany and Dubai and essentially what I do is I use my cyber security knowledge to help them improve how we assess individual risks, whatever you risk that we do if you're transferring to us, and then use threat intelligence to map out the types of scenarios that can make our portfolio of risks.

15:52So you're doing for your insureds what you do for yourself. Exactly, yeah. But then I also get to partner with the insureds as well and help them define what their strategy should be. Because they have their own CISOs too sometimes. Sometimes they might not. And sometimes they don't. Sometimes it's the head of IT or it's someone legal in risk doing that. They'll title someone as CISO even though they're mainly the head of IT. That happens a lot. They happen a lot, yeah. Yeah. But it's good fun because you see a whole world set of companies. Mosaic typically is in the mid-market and large corporate space, a kind of organization's revenues of$150 million plus.

16:26This year, we opened up our S &E platform as well. So we're now serving that kind of$150 million revenue bracket where you just don't have a CISO in those sorts of companies. it's a lot of outsourcing to manage service providers and not necessarily the people with the expertise to challenge to really understand what their risk profile looks like. So you get a whole set of different challenges just for those insurals. So at ITC, you're speaking about cyber risk through the eyes of a CISO, which is good. I mean, from your perspective, a CISO's perspective, which you wear two ball caps, right? You have your CISO hat for your company, and then you have your risk engineer hat for your clients.

17:05So let's say from your CISO hat, what does that partnership look like in practice? And how can insurers help security leaders better understand, quantify, and reduce cyber risk? And so I'm asking you to kind of wear your CISO hat, but also your risk engineer hat. How do you partner up with your clients and help them? So I think there's a really interesting bit here. It's one thing I'm really passionate about solving. So general assumption is, company wants to buy side insurance insurance buyer tends to be the risk packages so someone in the cro or the office yep they are the motivator are the chief legal officer yeah yeah but not the person who's day and day of nope dot is site spooked their motivation is get the best coverage of the most coverage with lower bbs that's their motive that's what they're going in with the broker to talk about and that's what parries up one and pass two for now the problem that you have is before the companies decided to buy cyber insurance there's typically a risk management conversation a bit further ahead where someone decides we have cyber risk but we need to transfer alpha and the person who made that decision or made the blade to say they're going to transfer it is someone who's bought that cyber security mindset but said there are things that genuinely keep me up at night right now there are things that just really struggling to solve for i want is transfer out some bloweries and right now you've got a real big disconnect between the person who knows what could really go wrong and the person who's buying insurance coverage and you know having the conversation on what should the policy wording look like what should the endorse talk so do you play mediator to get them to talk to each other yeah so you're yeah so you're like part you're part therapist to help them talk to each other i mean honestly it's my therapy as well to be honest yeah like when i go to like CISO conferences we just call it CISO therapy at this point it's just us all venting with each other but um it is genuinely like that as well it's just going in there and making sure that the risk manager appreciates that the type of insurance they're buying you need to have the scenarios that could be deteriorating go wrong with the organization but that's so hard for them to stay up to date with i mean yeah the the threat scenario right now is insane it's changing all the time yeah but but like changing faster than i've ever seen a change yeah i started writing software building systems and getting involved in the internet when the internet commercialized yeah 1992 93 yeah before that i was on bulletin board systems so we've had threats the whole time yeah you know a lot of it was malicious viruses yeah um the stuff that goes on now is is wild because it's state sponsored it's well funded it's well organized and they run a lot like the insurance companies that that we work out or it's literally a criminal marketplace at this point yeah you don't really need technical capability and i'd say that the big default defining moment was in the past you need to have the technical capability to operate your tasks but have that commercial mindset to monetize it as well whereas now you don't really need the technical capability you just need funding to go to the marketplace and source and assemble the capabilities that you need it you don't really need the commercial mindset either because you've got randomizer service operators will take that on for you as well.

20:20So really, you don't need that much to be a criminal. And I think that's the thing that's really changed the game here. It's not so much a capability shift, it's more just the capacity of people who could be cybercriminers has changed so dramatically. Yeah, and they needed less people. Yeah. I mean, they have their own open source models or open weight models that they're putting on their own machines that don't have morality limits. Yeah, they don't have guard rails, they can you know they can just operate at will you don't need to their emails are getting a lot better their text messages are getting sick yeah uh their their synthetic voice work they're doing i was reading something the other day where um it's more for the asia pacific region where typically when they were looking at when when like a person moved in i think it was japan was trying to work out if an email was phishing or legitimate they just looked at how the characters were placed together because if i was trying to write a phishing email in japanese like don't know Japanese it's going to come across really broken when a native speaker reads it so that's how they just detect oh well that's really broken it must be fishing but with generative AI as as two to three years ago which actually it became very easy to write in Japanese or in Chinese or in Korean and other native languages in in a script that just looked like a native speaker wrote it so suddenly you just saw an uptake from highest keys detecting malicious phishing emails that were working in the specific region yeah and it they make sense because now you can write them perfectly yeah no i could write them perfectly yeah you could too it's great yeah you got threat vectors everywhere now and their heart it used to be easy to sniff out the the the schemes because the formatting was wrong the images were wrong the html was poorly formed there was always this like sense of urgency every time as well whereas nowadays i think what you find is that the starting conversation is there's no urgency there's no link there's no very chill it's just a it's normally just to be like i'll email you but i'll pretend like i was emailing someone else i'll pretend i was emailing someone with jake and you'll come back and correct you and say hey i'm james i'm not jake and i'll be like oh you're right oh but anyway now that we're trying why don't we try a bit more and it works it works you know my cousin's a comedian and uh he's big now but when he started he had to find a way to get into the market yeah and so he did this thing called crank texts okay and he would text from his cell phone thousands and thousands of thousands of numbers manually this is 20 years ago yeah so he just typed it in his phone doing the numbers yes and committing by one and then he would just say hey what's up yeah now this is how they're using now this is what goes on now yeah and then they would say not much and he'd cool how you doing we're not we're chatting yeah and so it was a material percentage of people would engage in a pretty in-depth conversation with him and uh they were hilarious because he's a comedian he made it funny and then he would screenshot the conversations and put them on his website yeah and then use it as fodder in his next stand-up bit.

23:35But it was amazing how many people engaged. And it's amazing to me still how many people engaged. I think there's a real concern at the moment of our security industry, but it was a discipline where we spent a lot of time trying to educate people and train people on what bad looks like. And then it's almost become a bit of a liability shift of if you train your users, then it's their fault when something goes wrong, right? But the reality is, and the way that I look at it is, if Mosaic gets taken down because someone clicked on a dodgy link, that's my fault. If the whole company goes bust because of a link, that's not my fault.

24:11That's my fault. You need to plan that resilience and build that in and have that, what we call defense and death. And that's really kind of the crux of your job, isn't it? Yeah. It's just, I mean, it's really good fun. My job is basically sitting there and thinking, right, how would I hack Mosaic? What would I do to triple Mosaic? How would I impact our customers? and then be like, all right, well, how will I stop? So have you done a synthetic voice simulated attack? No, no, not here. Not here. Pretty easy to do now. It's not hard. We did it at a previous shop in a red team. There's some open source tools out there that make it quite simple.

24:44Yeah, they're quite good. I mean, one thing that we kind of worked out is, you know, when you're trying to find, like I said, the voice or videos of another person, you don't necessarily have to call them and keep on the phone for a long time. Just go on social media. People speak at conferences all the time that gets published everywhere look at the company's internal marketing spot what are they putting on instagram and tiptock for whoever wants to be that next you know i've been coming market generator right and then you just pick up these little snippets from there and you've got all your source material yeah yeah it's real it's insane yeah yeah the legitimate providers of simulated voice and video for people if they want to use it uh in ads they make you validate and verify that you are who you are yes they don't want their tool to be used but there's a lot of other tools that Don't do that.

25:28Yeah. So, all right. So, I mean, we've got a couple minutes left. Like, what's your... I'll start on the negative side, then I'm going to end on the positive side. What right now, September 30th, 2026, what keeps you up at night right now? Biggest threats, biggest challenges. What do you, like, worry about? For me, a lot of it comes down to just the basics. there's a lot there's two issues with the basics right the first one is there are very simple things that you can do in an organization towards excellence health that are process-based things don't require big technology to spend but it just requires effort a lot of effort you should be put in to get a control to a position where it actually prevents a threat one of the things that worries me is people people sort of seek the uh the easy alternative oh what if i just spend loads of money on this tool what could be there's so many tools out there that say they're ai powered cyber security or next generation ai cyber security and it's just a lot of fluff that you're going to spend money on that doesn't actually do what you need it to do yeah and if you just spend the time and the effort just doing it manually just putting in the effort and not trying to outsource your problem into another company and spend all that money then they'll solve it pretty quickly I think data classification as data block probation is a really big example where you spend a lot of time trying to shit the data classification problem to other organisations if you say oh they can classify the data for me they'll do and it's really expensive to take it that way I'm just coming to work out yet outside of that the other thing I was going to say about basics is the goalposts just keep changing we talked about you mentioned divide the threats from 1992 93 to now just change so rapidly so wildly different yeah very different i remember basics used to be you had you just have a really secure password now it's multi-factual authentication right you need to have antivirus plus plus yeah yeah well i mean the passwordless plus the p yes yeah yeah and then two factor twice a day now it was it was once a month then it was once a week yeah then it was once a day and now the facial ideas now it's now it's 12 hours now intras now i was for mosaic now it's all passwordless yeah and intra and i mean it's biometric it's it's it's the authentic authentication authentication changed almost zero for decades and in the last two in the last two years it went like holy crap i'm everywhere needs a fa yeah two of a but not just two of a two of a passwordless biometric like it's we are rapidly going to a point where they'll never get any passwords anymore you know because you're you're past past keys are becoming you know which which are fantastic you know very convenient yeah and it's also just like yeah i have to be tears of passwords in my head like they're really the stuff i just don't care about art to like i really need to be you to worry but the thing that's really annoying for me is i've got that all in my head while i've been on the past yeah it's that muscle management then it's a vulnerability itself yeah whereas switching it all to fire a match if the buzzword it just makes my life all easier all right so that's what you're most concerned about what's keeping you up yeah what are you most excited about frontier ai i think um it comes up a lot as buzzword but for me looking past that like there's loads of high out there in the market about what frontier ai can do and where will gail steve i'd say for a cyber criminal it's not really a game changer yet social engineering is still a very easy way to compromise company to compromise identities it works on its fairy tree why would they switch the frontier ai a lot more expensive those options to glitched but on a defensive use case frontier ai the ability to detect zero day vulnerabilities the mythos i mean mythos found 26 year old vulnerabilities yeah holy cow and all that tells us is says well further i think there's two two things to take away the first one is the types of reviews that we have today code reviews human reviews security stress and so on did not detect it so we've got a great step change there the second bit is i don't believe that no one knew about this for 26 years it's more likely that people knew about it but just weren't willing to burn their zero day on it until they have to have a better opportunity yeah we're going to find zero days that haven't been burned yet and have given this factor of pizza before they get burned defense does which is great i'm most concerned about people doing stupid things yeah i that's always what keeps me up is getting people getting a phone call and it's the gift card scam which is so common uh i have two three friends who fell good to fell victim to the gift card scam one who lost their job over it okay wow that's pretty serious yeah it is yeah um and were they being stupid no naive i'd call it naive yeah uh trusting um you know and and so that that keeps me up well i'm most excited about the frontier models as well i i'll be honest like i use it as a proactive pin tester proactive security review um i did vibe code my jamesvenom.com site yeah Because why not?

30:57Yeah. Like, why wouldn't I? I love it. Yeah. I want something to play with that's mine. I have my, you know, I have my team and they do all the other corporate sites. First thing I did. Yeah. Is I went in and did a full pin test. It's been really fun as well. Yeah. And then I told it to dive 10 levels deeper. I said, okay, you spent 10 minutes. Yeah. I need you to spend an hour. Yeah. And then I did like max, you know, top edition, max effort. Yeah. Then I put a, you know, slash loop command. that I'm like, I really need you to dig deep and hard and try to get into this software. And I mean, it came out with like 27 upgrades.

31:30It was pretty remarkable. And so while I think that, yes, the criminals have this, yeah, so do we. Yeah. And I think that's the big thing that's really changed. But the big thing about AI is not a brand new topic. I mean, I remember when I started back in 2016, AI was doing operations. The thing that was really annoying is our risk appetite and the defensive side it's just a lot lower than than a criminal's for a criminal if they use ai and offensive cyber operations and it doesn't work cool life moves on they just do something else it's not a big deal whereas for us if we use ai to autonomously make decisions and it goes wrong it's gonna hurt a lot so ai is not new for cyber security defense it's just we've gotten to a point well i mean we've gotten to a point where offense criminal cyber previews are just that the landscape's so asymmetrical in their favor that we're almost kind of forced to try this new thing but we've also got much more trust in how it actually works we can explain and understand it better so we actually know why it's making the decisions that it's making i'll tell you this it's it's the it's maybe it's not the best consultant but it's one of the best it's the thing that annoys me is it's a massive people who ease up yeah oh yeah oh my god everything i ask it's like jay that's so smart you're so amazing and now i just started ending my prompts with give me your honest opinion and then it's like this is great but honestly it's not that great i've done yeah i've i've done a i've done a lot of memory updates to claude to get it to not be a sick of it yeah so well look we're at time thank you so much for coming on the podcast i appreciate it um you know this has been a great conversation and i'm excited about you being in insurance and your first time in Vegas and your first time at ITC.

33:17It's fun. I'm looking forward to it. And to all our listeners out there and listeners, thank you for tuning in today to Geek Out, our episode and interview with Jay Vinda for Mosaic Insurance from beautiful London, England. You'll see some more from us here at ITC 2026. Have a great day. Enjoy the ride and geek out.

33:55We'll be right back.