Cyber risk is no longer an IT or CIO issue — it has become a boardroom conversation: Evaa Saiwal, Practice Head – Liability & Speciality Risk, Policybazaar for Business
In an exclusive interaction with Express Computer, Evaa Saiwal, Practice Head – Liability & Speciality Risk, Policybazaar for Business, discusses how the company is transforming complex liability and cyber insurance into business enablers. From addressing emerging risks and leveraging AI to educating MSMEs and startups, she highlights a strategic, proactive approach to insurance in an era marked by digital threats, reputational risks, and interconnected claims.
As you lead the liability practices at Policybazaar for Business, can you walk us through your strategic approach to building scalable and innovative insurance solutions in such a complex space?
I’ll tell you, in the corporate world, it is very well known that there are different types of risks and there are always risk transfer mechanisms. Most of the non-tangible risks that companies face and when I say non-tangible, I mean the risks that you don’t see, the silent hidden risks, these come onto the P&L of companies as legal lawsuits or third-party demands etc., and are essentially liability risks.
It is definitely complex because it is essentially a legal contract between an insurance company and the insured, which is the company itself, that outlines what kind of risks are covered. And this is the wording that, when a claim comes, is interpreted to process the policy and payout. It is not as simple as, for example, covering an asset like a table or machine of your company , if there is a breakdown, then XYZ would be the payout etc. It’s a little complex when it comes to claim mechanisms in this space.
Now, coming to Policybazaar for Business — we are comparatively a newer player in the market. We started this practice back in 2022, and it’s a highly competitive market, also because there are players who have been present for a decade or so, offering the same liability insurance and providing their advisory services. Although they’ve been around for a long time, I felt and because of my experience in liability insurance for more than a decade now, that we could build a more scalable, better and innovative model in this space.
As I told you, liability insurance is complex by nature, but our job is to make it intuitive for our clients, especially in this digital-first economy, where the risk is non-tangible. It is not physical; it is financial, it is reputational, and it is algorithmic. So, at Policybazaar for Business, we are reimagining liability insurance as a business enabler. We don’t want our clients to see insurance as a post-event solution or a reactive thing. We want to design this as a proactive approach to risk.
As cyber threats are evolving very rapidly, how are you aligning cyber insurance offerings to meet the dynamic needs of Indian businesses — especially for MSMEs or startups?
Over the past six to seven years, we’ve seen that cyber risk is no longer an IT issue. It is not a CIO or CISO issue anymore. It has actually become a boardroom conversation.
What we’re doing is we’re also aligning our cyber offerings by embedding risk mitigation into the buying journey itself. We’re creating real-time indicators for digital footprint and third-party dependencies of the clients, embedding those into their risk-buying exercise.
For MSMEs, we’ve actually built modular, API-friendly covers that integrate with their tech stack. Smaller companies who are taking cyber insurance for smaller limits can come to our website and buy this easily. For larger, more mature, and intricate risks, we are designing covers that combine breach coaching, legal advisory, and a full stack of coverage.
Our goal is to move cyber insurance from a reactive to a predictive approach.
Liability and special risks are largely intangible and often underappreciated in traditional risk management. How are you educating businesses about their criticality, and what trends are you seeing in their adoption?
Great question. I feel that education is at the core of our adoption strategy. We’ve built a content-driven ecosystem that connects decision-makers , founders, CFOs to real scenarios. We are continuously educating these stakeholders about ongoing lawsuits against directors, co-founder disputes, privacy violations, and aligning these situations with the insurance that could cover those claims.
We are basically drawing a connection between risk and risk mitigation. The big change is that intent, now liability insurance is being pulled into strategic planning much earlier in a business lifecycle. For example, in IPO-bound companies; earlier, insurance wasn’t such an important conversation. But now, due to a few significant claim scenarios in the industry, even IPO-bound companies are looking to transfer their risks through insurance.
We are also seeing companies broadening their understanding of D&O, EPLI, and PI — understanding that these insurances are no longer optional. They must buy these policies as part of a robust risk mitigation exercise. So, yes, we are one of the enablers of that shift. Education, communication, and advisory form the core of this process.
Just in line with what you said — are there any mandates or awareness plans as part of your policy? How do you brief this to the companies you work with?
We do have marketing plans that we’ve been executing with both existing clients and prospects. We are very active on social media platforms like LinkedIn where myself and the team continuously try to educate people about these liability risks and how they can be managed.
Our marketing teams are also creating reach-outs through PR machinery and through events, etc. Yes, we are doing everything we can.
Let’s come to the technology aspect. AI, ML, and data analytics are playing a key role, especially in offering higher customer experiences. How are you using these technologies to shape customised insurance solutions at Policybazaar for Business?
Yes, AI and analytics are not just buzzwords for us. We’re trying to embed them at every touchpoint right from the quote mechanisms to claim intelligence. We’re building tools that use industry benchmarks, behavioural analytics, and historic claims data to help underwriters perform smarter underwriting.
We also feel that a lot of reinsurance companies, where the actual risk is underwritten, are actively trying to understand how AI can be embedded in their underwriting mechanisms. We believe AI can help the industry in three ways: understanding the risk, underwriting the risk, and processing claims smarter and faster.
Going forward, what kind of emerging risks do you think will redefine the business insurance landscape? And how are you preparing to stay ahead?
Today, as we speak, the future looks bleak. We don’t know what it’s going to be. Either on the tech side or with global power struggles , but risk will always sustain. Risk is just changing faces as every process changes.
Our focus will definitely be more towards AI and tech risks. As businesses shift decision-making to machines, liabilities around that will also shift. Along with that, reputation as a risk is becoming more important. Everything is on social media — with misinformation and cancel culture, regulatory actions can impact brand image. Reputational risk needs to be managed well.
Thirdly, we foresee interconnected claims. One single event could trigger multiple policies — like a cyber claim can trigger a D&O or a PI policy. Interconnected claims will be a big theme going forward.
In this geopolitical scenario, things look a little uncertain. Do you have any specific future focus areas — in terms of policies or technology?
We’re actively speaking to insurance companies. In the end, it’s the insurance companies who are the risk bearers and we are the advisors in the solution, but we don’t bear the risk.
So, we have to convince the insurance companies to understand these risks and underwrite them smartly.
For example, a D&O policy excludes cyber insurance where we are continuously talking to and pressuring insurance companies to understand that this cannot be the way forward. So yes, we are having those dialogues.
On our side, we are creating support machineries for our clients. For instance, if our cyber client wants advisory on how to handle a breach, we’re aligning them with our in-house teams for post-breach solutions. We’re also connecting them with different cybersecurity vendors — we’re building a marketplace for cybersecurity alliances. Similarly, we’re building in-house legal advisory for our clients, so they know how to approach a claim. It’s not the end of it but it’s the solution we’re offering.
Given the increasing political tension and cyber threats targeting India’s critical infrastructure — are there any strategies for real-time protection?
We have a solution that monitors breaches on public-facing assets for our clients. We do continuous monitoring for a month or two, based on our agreement. If they are seeing any breach or faulty open ports, we let them know.
