Google Cloud is bringing its innovative Risk Protection Program (RPP) to Australian shores, offering local businesses a new way to secure cyber insurance that directly reflects their real-time cloud security posture. The expansion, announced this week, comes as the Australian cyber insurance market enters a period of disruption, driven by rising premiums, tougher underwriting conditions, and a tightening regulatory landscape.
At the heart of the program is a unique proposition: use security data already collected through Google Cloud to streamline the insurance process and potentially secure better terms. The RPP, which launched in the US in 2022, is now backed by a growing roster of global insurance heavyweights, with Beazley and Chubb joining founding partner Munich Re, including its specialty and SME-focused arms.
The timing couldn’t be more significant for Australian enterprises. Organisations are facing escalating cyber threats, including a spike in ransomware attacks targeting critical sectors like retail, healthcare, and logistics. At the same time, regulatory reforms from the Australian Prudential Regulation Authority (APRA) — notably CPS 230 and CPS 234 — are mandating stronger operational risk and information security controls across the financial system and beyond.
These pressures are causing a ripple effect in the insurance market. According to brokers, insurers are becoming more cautious, demanding higher premiums and stricter evidence of security maturity.
“Many CISOs feel like the insurance process isn’t keeping up with modern threats or cloud environments,” said Monica Shokrai, Head of Business Risk and Insurance at Google Cloud. “We created the Risk Protection Program to address that disconnect — by bringing real-time risk visibility to insurers and enabling customers to translate their security investments into meaningful financial benefits.”
Turning Cloud Posture into Policy
The core of Google’s offering is the Cyber Insurance Hub, a tool that allows customers to generate detailed reports on their Google Cloud configuration, benchmarked against industry standards like the CIS Benchmarks. These reports can be shared directly with insurers, allowing for a faster and more tailored underwriting process — a departure from the traditionally manual, questionnaire-driven approach.
The program also incorporates a concept known as cyber telematics, where actual metrics from a customer’s cloud environment help shape policy pricing — a model akin to usage-based car insurance. Google claims this method leads to fairer, more responsive coverage, especially in a market that has struggled to quantify cyber risk consistently.
Expanding Coverage, Including for AI and Quantum Risks
In line with the growing complexity of enterprise technology stacks, the expanded program now includes Affirmative AI coverage for organisations using Google Cloud’s artificial intelligence tools. It also introduces quantum computing risk protection, recognising the long-term security challenges posed by advances in cryptography-breaking technologies.
These new features reflect a broader evolution in the insurance sector’s understanding of emerging risks — and Google’s intention to help shape that evolution.
For smaller, cloud-native companies, the process is even simpler. Beazley is trialling a one-page attestation process for eligible Google Cloud users, eliminating the traditional insurance application altogether.
A Win-Win for Security and Compliance
From a regulatory perspective, the RPP could help Australian organisations meet their obligations under APRA’s standards and evolving privacy legislation. With compliance increasingly tied to demonstrable controls and reporting, the ability to generate and share audit-ready security data is becoming a valuable asset.
Customers already using the program overseas report significant efficiency gains. Etsy’s CISO Justinian Fortenberry said the platform has “transformed” their renewal process. “Because I know what data the insurance underwriters are going to be using, I can proactively respond to any questions and therefore cut down time dramatically.”
For enterprise customers underwritten by Munich Re, the program also includes access to Mandiant’s threat intelligence and incident preparedness services, offering further value in a time of constant cyber vigilance.
Google’s Broader Play in Cyber Resilience
The expansion aligns with Google’s broader push into enterprise security and risk management, as it positions itself as a proactive partner in customers’ operational resilience — not just a technology provider.
While the cyber insurance industry continues to evolve, initiatives like RPP could serve as a blueprint for how insurers and cloud providers can collaborate to address the insurance gap many organisations face today.
“This is about rewarding organisations for doing the right things,” Shokrai said. “If you’re investing in security, you should see that reflected in your insurance coverage.”
As Australian companies continue to digitise and regulators turn up the heat, programs like RPP offer a rare combination of compliance support, financial efficiency, and cyber preparedness — at a time when all three are in short supply.
