National Cybersecurity Awareness Month: How to connect with and prepare your clients

What is national cybersecurity awareness month?

Every October, Cybersecurity Awareness Month serves as a reminder of the importance of digital safety and cyberattack prevention. Launched in 2004¹, this initiative has grown into a collaborative movement involving governments, businesses and educational institutions with the goal to have valuable conversations for simple, effective steps for safer online behavior not just in October, but all year. 

A new Nationwide survey found that while most consumers are taking basic precautions, including installing software updates when prompted (78%) and using multi-factor authentication (74%), many are engaging in risky behaviors like using the same password across multiple sites or apps (50%) or sharing personal information over the phone (40%).²  

While 81% of middle market business owners feel prepared to prevent cyberattacks, just 63% of small business owners say the same. In fact, two-thirds of SBOs admit they haven’t given much thought to what they would do if they fell victim to a cyberattack. 

Cyber threats are becoming easier to launch and harder to spot. That gives agents an important opportunity: helping both personal and commercial clients prepare before a suspicious email, fake payment request, or stolen password disrupts their daily life. We asked a panel of experts to weigh in on cybersecurity trends and the opportunity to prepare clients. 

Our panel includes: 

• Vikas Chopra, AVP, Technology Risk Management, Nationwide 

• Bobbie Goldie, VP, Commercial E&S/S Cyber, Nationwide 

• Chris Manci, Co-Founder, Principal, Insurance Partners Alliance 

• Luke Turano, Co-Founder/Principal, Insurance Partners Alliance 

How to talk about cybersecurity awareness month with clients this October

What does an effective cybersecurity conversation between an agent and client sound like?

Bobbie Goldie: I have noticed most agents have been increasingly discussing cybersecurity exposure and the importance of a cyber insurance policy to protect a client in the event of a cybersecurity event. I appreciate how daunting this can be for agents, as I have been in their position. But now it’s important for agents to go deeper and focus on the predict and prevent aspects needed for clients to continue to run their businesses. As cyber bad actors continue to become more sophisticated and are increasingly utilizing AI to attack organizations, cybersecurity and the potential of a cyberattack is top of mind for organizations. Business owners expect the challenge to grow. Nine in 10 or more say AI is making it easier for cybercriminals to launch attacks at scale, and 88% say AI-enabled attacks have become more sophisticated over the past year. 

Proactive agents have begun to pivot conversations regarding cybersecurity and are providing insight and information on how a cyber insurance policy can not only protect you after a cyber breach, but also many carriers provide tools and resources to predict and prevent a breach. 

A simple way to discuss the pre-breach tools is to liken them to a property policy which may provide support and guidance through loss control. The carrier gives information to help the client to implement certain safety measures to have improved protection against threats.  Certain cyber policies include similar support to help predict and prevent cyber incidents. 

Chris Manci: An effective cybersecurity conversation should be practical, understandable, and focused on the client’s business rather than technical terminology. Agents should approach cybersecurity as a broader risk-management and business-continuity discussion, not simply as an opportunity to sell cyber insurance. 

A good starting point is asking a client something like, “If someone gained access to your email account tomorrow, what could they do with it? Could they access customer information, redirect a payment, impersonate you, or disrupt your business?” 

From there, the agent can discuss the client’s cybersecurity controls, employee practices, backups, payment-verification procedures, incident-response plan, and insurance protection. The goal is to help the client understand both how to reduce the likelihood of an incident and how to recover if one occurs. 

Luke Turano: For personal lines clients, I think the best cybersecurity conversations start with everyday life rather than technology. I might ask a client, “If you received a text from your bank right now saying there was a problem with your account, would you click the link?” Or, “If your son or daughter called and said they were in trouble and needed money immediately, how would you verify it was really them?” These are situations people can relate to.

As agents, we’ve traditionally talked with families about protecting their homes, cars and personal property. Today, their digital lives and identities are another part of that conversation. Cybersecurity doesn’t have to be intimidating or overly technical. It can simply be a discussion about protecting your family, your identity, your finances and your personal information.

What everyday behaviors should agents discuss with clients?

Vikas Chopra: Strong cyber habits do not need to be complex. Encourage clients to use multi-factor authentication and unique passwords, install software updates, back up key data, and confirm unusual payment requests through a trusted second channel. 

For commercial clients, employees should also know how to spot and report suspicious messages. Attackers often target a rushed or distracted person because that can be easier than breaking through technology. A few habits, practiced every day, can close common gaps and protect clients. 

Bobbie Goldie: Cyber carriers have minimum standards for cybersecurity hygiene, to receive a cyber policy quote, which is why it’s important for an agent to discuss these everyday cybersecurity basics. These items may include:   

• Multi-factor authentication (MFA): require a second proof of identification in addition to a password when logging in; 

• Software patching: Install security fixes on your software before criminals can exploit known weaknesses. Many small to mid-size organizations rely on standard software packages from third party vendors. These vendors will provide recommended updates that you should update/patch. 

• Privileged access management (PAM): Control the powerful “master key” accounts that can change or access almost anything in your systems. 

• Password security: Prevent employees from using weak, reused or stolen passwords. 

• Email security and training: Helps lower the likelihood of a business email compromise (BEC) from things like phishing emails, fake invoices, malicious attachments and criminals pretending to be the CEO or vendors.  

Luke Turano: I think you start with the basics: strong and unique passwords, multifactor authentication, keeping phones and computers updated, being cautious about links in emails and texts, monitoring financial accounts and credit reports, and being thoughtful about what information you share on social media. 

Families should also talk about cybersecurity together. We spend a lot of time teaching kids about physical safety, but increasingly we need to teach them about digital safety as well. The same is true with older parents and relatives who may be targeted by sophisticated scams.  

One of the simplest pieces of advice is also one of the best: slow down. Most scams create urgency. If someone says you have to send money, provide a password or give personal information immediately, stop and verify the request independently. 

How can agents turn high concern about cyber risk into specific actions rather than fear or inaction?

Chris Manci: Give clients a manageable list of actions. For example, ask clients to concentrate on training employees, enabling MFA, establishing payment-verification procedures, maintaining secure backups, and developing an incident-response plan. 

The message should be: You cannot eliminate cyber risk, but you can make your organization substantially more difficult to attack and much better prepared to recover. Agents can then review the client’s cyber insurance to determine how it complements those preventative measures. 

Luke Turano: Make it manageable. I wouldn’t give a homeowner a list of 25 cybersecurity recommendations and expect them to implement everything tomorrow. Start with three things: turn on multifactor authentication for important accounts, review your passwords and talk with your family about how you’ll verify unusual requests for money or information. Then, we can talk about the insurance side. Does your homeowners policy provide any protection for identity theft or cyber events? Is additional personal cyber coverage appropriate? What resources would be available if something happened? The objective isn’t to scare people, it’s to help them feel more prepared. 

How has AI changed the cybersecurity landscape

Our research found when it comes to AI-powered threats, most consumers rely on monitoring and vigilance, while only about a third use tools such as robocall filtering (35%), email security protection (34%) or identity theft/credit monitoring services (33%). 

More than half of agents (52%) have observed an increase in commercial client claims related to generative-AI scams or fraud attempts in the past 12 months, yet only about half (51%) believe clients are prepared to identify and respond to AI-powered cyber threats.  

Which client segments or industries show the greatest need for more proactive cyber education?

Vikas Chopra: Industry alone does not define cyber risk. How a business works matters more. Companies may face greater risk when they rely on email, move money online, store private data, or have limited security resources. AI raises the stakes by helping criminals create polished and personal messages, voices, and requests. 

Size is no shield. Agents can help clients identify where trust, urgency, and weak verification steps could be used against them. From there, they can discuss safeguards that fit the business. 

Bobbie Goldie: All organizations are targets for a cyber incident, no matter size or industry. As the cyber bad actors are utilizing AI to focus on hundreds of small and mid-market clients at the same time. Because smaller organizations may not have the same cyber hygiene sophistication as larger organizations, they have a higher likelihood of finding cyber vulnerabilities. 

Luke Turano: I don’t think there’s a household that’s completely immune, but certain groups deserve additional attention. Families with children have to think about social media, gaming accounts, passwords and how much personal information their kids share online. Older adults can be particularly vulnerable to financial and impersonation scams. Affluent households may be specifically targeted because criminals believe there’s a greater financial opportunity. And anyone regularly moving significant amounts of money, buying a home, for example, needs to be especially careful about wire fraud and impersonation.  

AI has raised the stakes because scams are becoming more believable. Poor grammar and an obviously fake email used to be warning signs. Today, a fraudulent message can be extremely polished, and voice or image impersonation can make an urgent request feel much more convincing.  

How should agents communicate with clients who are highly concerned but not confident they can identify an AI-powered scam?

Bobbie Goldie: The bad actors are utilizing AI to attack organizations. AI makes it easier, faster and harder to detect, which is why the identification of AI is not important. What is important is ensuring your cybersecurity posture is continually managed and updated as needed. Additionally, agents should discuss a client’s own use of AI to create efficiencies and speed up certain business processes. However, they’re leaving the organization vulnerable to a cyber incident with regards to the policies and training their employees on how to use AI properly. Our survey found that six in 10 business owners say employees use public AI chatbots or writing tools for work-related tasks, while just 36% have written policies governing employee AI use and 37% provide training on responsible use.  

Some basic considerations around AI policies could include:  

• Is there an AI tool your employees are required to use and is it within the firewall? 

• Do you have rules about your employees using third party AI agents outside of your firewall?  

• What rules are in place around the type of information that can be shared on third party tools? 

Chris Manci: Tell them they don’t need to become experts at identifying AI-generated content. Instead, they need procedures that work whether the communication is real or fake. 

If the CEO appears to call requesting an urgent wire transfer, verify the request independently. If a vendor emails new banking instructions, call the vendor using the telephone number already on file. If someone asks for a password or MFA code, don’t provide it. If a family member unexpectedly asks for money, contact that person separately. 

The key message is: Don’t trust the communication simply because it looks real, sounds real, or comes from a familiar account. Trust your verification process. That turns fear about AI into a specific behavior employees can follow. 

Luke Turano: I would actually tell clients they shouldn’t rely solely on their ability to spot the fake. As AI gets better, that’s going to become increasingly difficult. Instead, create family rules that work regardless of how convincing something looks or sounds.  

If someone calls claiming to be your child and needs money, hang up and call your child directly. If your bank texts you a link, don’t automatically click it, go directly to the bank’s app or website. If someone unexpectedly requests a password, verification code or payment, independently verify the request.  

Families can even establish a simple code word that only family members know for emergency situations. We’re moving from “Does this look fake?” toward “Do I have a process to verify that it’s real?” 

Cybersecurity tips and solutions to provide clients

What do clients most commonly misunderstand about what commercial cyber insurance covers?

Bobbie Goldie: I believe the misunderstanding when purchasing a commercial cyber insurance policy is that your policy may provide important cybersecurity solutions to assist you with staying in business. I have noticed some cyber carriers tend to make these offerings too complex for agents to understand and communicate the importance and benefit of these services. We need to understand our audience and ensure we are speaking similar language. These conversations should not be highly technical. Agents need to push for a clear understanding so they can discuss these valuable services to their client in way they can understand. 

Chris Manci: A common misconception is that purchasing cyber insurance means the business is automatically protected against anything involving a computer, email, or the internet. 

Cyber policies can differ significantly in their coverage, exclusions, deductibles, sub limits, definitions, and requirements. Coverage for ransomware, business interruption, data restoration, regulatory expenses, incident response, social engineering, fraudulent funds transfers, business email compromise, and incidents involving third-party vendors can vary. 

Agents should discuss specific loss scenarios rather than simply asking whether a client has cyber insurance. For example: “If an employee receives a convincing email supposedly from your CEO and wires $100,000 to a criminal, how would your current insurance respond?” That question can uncover coverage gaps that simply asking “Do you have cyber insurance?” will not. 

Luke Turano: I think many personal lines clients assume their standard homeowners policy automatically covers everything that happens to them online. That’s not necessarily the case. Depending on the carrier, policy and endorsements, personal cyber coverage may help with things such as identity theft, cyber extortion, online fraud, cyberattacks or data recovery. But coverage varies, exclusions and limits matter, and certain types of financial fraud can be treated very differently. That’s where the agent adds value. We’re not just asking, “Do you want cyber coverage?” We’re helping the family understand what could happen, what protection they already have and where there may be gaps. 

How can agents move the conversation beyond “Do you have cyber insurance?” to “How prepared are you to prevent, withstand, and recover from an attack?”

Chris Manci: Agents can structure the conversation around five questions: 

• Prevent: What are you doing to keep criminals out? 

• Verify: How do employees verify requests involving money, credentials, or sensitive information? 

• Detect: How quickly would you know that an email account, computer, or system had been compromised? 

• Respond: Does everyone know whom to contact and what to do immediately after discovering an incident? 

• Recover: Can you restore your data and business operations if your systems become unavailable? 

Cyber insurance then becomes part of the response and recovery strategy, rather than being presented as the client’s entire cybersecurity strategy. This approach also helps position the insurance agent as a risk-management advisor rather than simply a provider of insurance products. 

Bobbie Goldie: It’s important speak to your clients in plain English instead of cyber tech security language. As Chris mentioned, focus on the five questions in a way that relates to the impact of their business. Once you have this conversation, you can lead into the importance cyber insurance plays as a strong mechanism to assist clients in predicting, preventing, and protecting against a cyber incident. Some carriers contract with best-in-class cybersecurity organizations that assist in the predict phase with continuous monitoring outside and/or inside a company’s firewalls. These service providers can notify an agent or the direct client of a potential high severity cyber vulnerability that could morph into a cyber incident. Some cyber carriers also partner with service providers support them to remediate a high severity vulnerability before the bad actors gain access to your system. This is the prevention portion of a strong cyber insurance policy. And then lastly, an agent should end with protection, which is when an incident does occur, a strong financially sound cyber carrier is there to support you and provide additional support of cyber breach response and the financial aspect that is covered under the insurance policy. 

Luke Turano: I think we need to approach personal cyber the same way we’ve approached other household risks for years. We don’t tell a homeowner that having insurance means they don’t need smoke detectors, locks or an alarm system. Insurance is the financial safety net; prevention is still incredibly important. Cyber should be no different.  

A final word on cybersecurity readiness

Cybersecurity Awareness Month reminds us that small, intentional steps can go a long way in protecting what matters. From strengthening your agency’s defenses to educating your clients, this is your chance to be a trusted voice in digital safety. Cyber risks are growing, but so are the resources and tools available to help protect against them. The right conversation can help clients reduce that risk, respond with confidence, and recover faster when something goes wrong. 

About our panelists

Vikas Chopra is an experienced information security and technology risk leader with over 25 years of IT and cybersecurity experience. As AVP, Technology Risk Leader for Property & Casualty, Vikas leads the Business Information Security Office (BISO) within Information Risk Governance at Nationwide. In this role, he serves as the primary cybersecurity and technology risk advisor to the Property & Casualty organization, partnering with business and technology leaders to integrate security into strategic decision-making. Vikas is responsible for advancing cyber risk management, strengthening security governance, and fostering a culture of security awareness while enabling the business to innovate and operate securely in a rapidly evolving threat landscape.  

Bobbie Goldie Bobbie Goldie brings a wealth of experience across the insurance industry, with a track record of driving profitable growth, leading complex underwriting organizations, and building high-performing teams across both the carrier and broker environments. Her product experience ranges from commercial package policies and large commercial lines to extensive experience in the financials lines, professional liability and cyber. She is widely recognized for her ability to blend underwriting discipline, data-driven strategy, collaboration, and pushing the envelope on insurance innovation.  

Chris Manci is a former Nationwide exclusive agent with 24 years in the industry. His father, Joe Manci, was a Nationwide Insurance Manager for 45 years before him. His wife and four children are his life and inspiration. Chris feels immense pride in helping agents and their families, just like his, maximize their business potential. 

Luke Turano is following in his father’s footsteps of 42 years, Luke is a second generation former Nationwide exclusive agent with 20 years in the industry. Building relationships and strengthening communities are his passions in life, but his foundation starts and stops at home with his wife and two daughters.