Weaponized Search, AI Attacks, and the New Face of Risk: Highlights from Our USI Webinar

1 "" (0)
00:00:00.000 --> 00:00:00.822
Okay.

2 "Beth Johnson" (1121332224)
00:00:00.822 --> 00:00:20.000
Good morning and good afternoon. Welcome to usi's June webinar series featuring Todd Kozikowski . He's the CEO and founder of four Warn. I'm Beth Johnson I'll be moderating today with the help of Jim Kinge also. Before I introduce Todd, just a couple of logistics, we are.

3 "Beth Johnson" (1121332224)
00:00:20.000 --> 00:00:40.000
The recording the session. So you'll, you'll receive an email with the link to it in the next couple of days. There were a couple of pre submitted questions that we'll get to feel free to send additional questions into the chat. Please do, the chat option to all panelists, it makes it a little easier for us to keep track track of those.

4 "Beth Johnson" (1121332224)
00:00:40.000 --> 00:01:00.000
Your lines are muted, you won't have a chance to unmute, so chat will be the way to get to us. So with that, I'm pleased to introduce Todd at for warn. He leads the efforts to expose emerging risks that are fueled by search manipulations, AI exploitation, and coordinated digital abus.

5 "Beth Johnson" (1121332224)
00:01:00.000 --> 00:01:20.000
As a veteran technology leader, Todd has guided companies from startup through IPO, helping generate more than $5 billion in market value. He's known for developing advanced intelligence strategies that predict litigation risk and cyber threats. He holds his BS from Baits College and.

6 "Beth Johnson" (1121332224)
00:01:20.000 --> 00:01:35.873
To advanced studies in astrophysics at Harvard's the Sonian Center for astrophysics. So that seems like it'll probably be a different webinar to talk about all things astrophysics related, but Todd, thank you again for joining us. The floor is yours.

7 "Todd" (3334650368)
00:01:35.873 --> 00:01:55.790
Thank you so much, Beth, and thank you for everyone at USI for the opportunity to share what we do at four warn. And certainly thank you all for taking the hour here to connect and to spend some time with this topic. This is an, is going to be a, I think hopefully a really eye opening session for many.

8 "Todd" (3334650368)
00:01:55.790 --> 00:02:24.350
Of you who are looking at kind of next generation risk, trying to understand how AI is playing into that ecosystem, and we're gonna share a lot of examples over the next 40 min and and really what I'd like to kind of highlight for everyone today, our organizations are all facing a new form of risk and new fraud exposure, and what we're gonna talk about today is search engine optimization and AI optimization, AIO.

9 "Todd" (3334650368)
00:02:24.350 --> 00:02:44.350
What's a new term, and how and we're not looking at just deep fakes, deep photos, images of, of, of car accidents or receipts. We're talking about the manipulation and the change of how the internet actually works, how the search works on the internet and how it can be manipulated by opportunists as well as fraudsters. And we're gonna take a look at.

10 "Todd" (3334650368)
00:02:44.350 --> 00:03:04.350
And exploitation, how synthetic websites could be created and a whole host of other cyber threats that we see in the work that we do at Fort Horn. We'll discuss how opportunists target companies and we'll share some very specific examples today and then we're gonna talk about what do we do about it. It's one thing to identify it, but how do we turn that into.

11 "Todd" (3334650368)
00:03:04.350 --> 00:03:20.730
Action how do we turn that into action across our company? Because this, as we'll find out, it's not just say a claims issue or an underwriting issue or marketing issue. This really is a collective effort because it hits, the risk hits companies in different ways.

12 "Todd" (3334650368)
00:03:20.730 --> 00:03:40.730
So just a brief introduction for how this got started and why this got started. For Warn was created about two years ago, and so we've not been in the market very long. It's only been just a little over 24 months, but our research started a little bit longer before that and it really started in large thanks to a company called demo.

13 "Todd" (3334650368)
00:03:40.730 --> 00:04:03.180
Tech which is a rating agency. They've been business in business for over 40 years and they were doing a postmortem analysis of several companies that had failed in the Florida marketplace. Joe Patrelly, who is the president of demo tech, really took, took an, was one of the very 1st in Florida to to rate companies when none other would.

14 "Todd" (3334650368)
00:04:03.180 --> 00:04:23.180
And in the late, in late 2018 2019, there was an unprecedented amount of new lawsuits that were being filed in Florida and in that time, and we'll share some of this data, many of those companies had failed and Joe went back to understand and really asked the question why and how, how.

15 "Todd" (3334650368)
00:04:23.180 --> 00:04:44.360
Did this happen? And so Joe reached out to me, he and I had been involved in a, in a several projects in the past. Over the past 30 years I had spent a number of of years in building technology companies as you've heard, but also doing some joint research projects and intelligence projects for several big search engines on the side. And so with that background, part of the.

16 "Todd" (3334650368)
00:04:44.360 --> 00:05:09.649
The analysis was to look at some of the digital targeting that was taking place and what happened in Florida. And that opened up kind of a slew of of of new forms of risk and this is what we'll share today. The company since then were founded by a group of engineers and data scientists and and business leaders, we've worked with associations and organizations actively day in, day out, including the NAIC, the national insurance crime.

17 "Todd" (3334650368)
00:05:09.649 --> 00:05:29.549
You're a coalition against insurance fraud and we're also actively engaged in working with federal agencies, including the FBI, the net the NSA as well as one other three letter acronym in DC for nation state sponsored cyber activity. So we will share some of those results today in the activity. This didn't.

18 "Todd" (3334650368)
00:05:29.549 --> 00:05:49.549
This wasn't created out of thin air. We spent really a significant portion of our time and still do meeting from top down across a large number of folks across the industry from from regional carriers to mid market all the way up to to large national carriers, to transportation businesses and reinsurers, all are being infected with this new type of role.

19 "Todd" (3334650368)
00:05:49.549 --> 00:06:09.089
Risk. And to give you a sense of what we've heard from your peers across the industry, we would hear, e.g., if a claim is filed, it's too late. How do we go up the pipeline to understand how this instigation had even started? That relationship, that kind of sacred relationship between an insurance carrier and.

20 "Todd" (3334650368)
00:06:09.089 --> 00:06:29.089
Their policy holder is becoming more and more intercepted by some of the opportunities that we see and using the techniques and tactics that we'll expose. And so how we prevent that and how we mitigate some of that exposure is a big part of what we'll talk about today. AI as we know, is changing a lot of the business, but using a.

21 "Todd" (3334650368)
00:06:29.089 --> 00:06:49.089
AI, we we have a new form of fraud that we have to detect and having those tools available to us is a challenge, and so how we adapt to that is a, is a clear challenge for many folks. Litigation funding. Never did we think that law firms and lawyers would be paused to an investment chest board. So how is that now replacing and changing and adding a new form of.

22 "Todd" (3334650368)
00:06:49.089 --> 00:07:09.679
We've also heard folks say geez, you know, we need an early warning system, not just for claims, but across the company. How do we collectively understand this new type of risk? And and the last part is, you know, we all have different definitions of social inflation. And you know how how do we interpret, how do we interpret that kind of on the same page and act on the same page?

23 "Todd" (3334650368)
00:07:09.679 --> 00:07:31.249
Page with what that means. And to that end, social inflation, you know, when we think of social inflation, we often think about it maybe in three co three ways. One is the growth of 3rd party litigation platforms and and you know you you see AI being used to optimize what judge, what jurisdiction, what's the right settlement amount amount based on past history.

24 "Todd" (3334650368)
00:07:31.249 --> 00:07:48.179
That's informing AI on how to optimize. And then we also see of course the growth of 3rd party litigation funding and of course higher and higher settlement amounts and nuclear awards. All of that has been contributing and I think that's been the storyline certainly for the past three to five years.

25 "Todd" (3334650368)
00:07:48.179 --> 00:08:06.659
But there's one other component to that that really, in our minds has really exacerbated this even more so and that's this notion of search manipulation. Because if you think about it, you can't have a lawsuit without a claimant name. And one of the best and most effective ways to get to that claimant name.

26 "Todd" (3334650368)
00:08:06.659 --> 00:08:26.659
Is to be able to find them online and to intercept them in their engagement online. And as a result, what we're seeing is an increase in claim frequency above historical levels leading to higher loss adjustment expenses and combined ratio challenges. It's putting pressure on teams to respond to this new type of risk. They may not have the the.

27 "Todd" (3334650368)
00:08:26.659 --> 00:08:54.359
The technology, the metrics, the, the, the kind of the lens into this. We're also finding that, you know, there's a reluctance without hardcore evidence, it's hard to pursue. And part of that is because the fraud fraud has has evolved and opportunism has become much more scientific. We're talking of new synthetic websites, not just, not just people's IDs, but we're also talking about how we're seeing technology being used to create.

28 "Todd" (3334650368)
00:08:54.359 --> 00:09:14.359
3rd party websites that look and and feel like our own website, they're copied almost like a double Ganger site. We're seeing new attack surfaces across different technologies. And as a result, arriers are are are struggling to keep up with this because by the time we detect it, it's too late. We've already made a payment out, and a claim, the tools that.

29 "Todd" (3334650368)
00:09:14.359 --> 00:09:32.639
We're using to analyze this. Maybe the data's just not exactly in line with how to be able to find it. And maybe we also need to prioritize new KPIs around fraud, especially around this new new emerging growth. So you you know the these are have all been contributing.

30 "Todd" (3334650368)
00:09:32.639 --> 00:09:47.669
And where I'd like to start in this discussion is with a definition, and then we're gonna peel back into some examples and the definition I wanted to start with that just so that we're all on the same page is SEO search engine optimization.

31 "Todd" (3334650368)
00:09:47.669 --> 00:10:04.139
Many of you maybe familiar with that term, but it's nothing more than how do we move traffic to our site? How do we, how do we get engagement to our website? And traditionally we can do that one of two ways. We can, we can rank for that content by creating organic.

32 "Todd" (3334650368)
00:10:04.139 --> 00:10:24.139
Content in the form of blogs, keywords, certainly, web articles, right? And, and we put those keywords strategically placed so that search bots can index that, they hopefully page rank that up high and of course we we get an elevated position and, and say Google, so that we drive clicks.

33 "Todd" (3334650368)
00:10:24.139 --> 00:10:43.049
The other way is that we can, we can buy it. We can we can bid on paid keywords and we can spend money to entice and of course if we've run a search before, you've seen the paid ads, the sponsored ads at the top of search and then the organic results. What we're gonna talk about today is what happens when bad actors.

34 "Todd" (3334650368)
00:10:43.049 --> 00:11:03.049
Intercept and integrate malicious content inside those areas, inside paid ads, inside and out ranking and organic search results. And to give you a sense, and just I I mentioned here a hundred and 90 billion was spent on search advertising. Just for comparison when we drive around the country today and look at billboards especially.

35 "Todd" (3334650368)
00:11:03.049 --> 00:11:28.279
Little advertising, it seems you can't go to a city without seeing another ad. That market, that outdoor billboard market was about 7 billion. So what we're talking about online is 25 times larger than what we're seeing. So this is a different world. So when we go back to that story of demo tech, looking and asking about, hey, Todd, could you run a postmortem analysis on.

36 "Todd" (3334650368)
00:11:28.279 --> 00:11:45.689
Those companies that that went under. What we're looking at here on the left hand side are seven to eight companies that had become financially in solvent, and you're looking at new lawsuits year over year. These are not cumulative. These are brand new lawsuits filed in that year.

37 "Todd" (3334650368)
00:11:45.689 --> 00:12:05.689
And you can just see it's just a kind of up and to the right correlation, right? These companies were were highly stressed and and Joe Petroleu from Demotek, you know, really had the hypothesis to think that, you know, maybe this was something more that more than just billboards and advertising that there was maybe a possibility that they were being litigated to death.

38 "Todd" (3334650368)
00:12:05.689 --> 00:12:24.779
And that's exactly what we ended up uncovering, and we'll explain how that came about. So let's take you back historically. In March of 2022, when I started this research, we were looking at a public adjuster bidding on 1200 keywords spending $650000 to generate 3700 clicks a month.

39 "Todd" (3334650368)
00:12:24.779 --> 00:12:41.099
So right then and there, we, we have to pause because this is an individual, this isn't a company, this isn't an organization, this is just one person with a budget of $650000. There are not many companies that even have that type of budget for digital marketing, but.

40 "Todd" (3334650368)
00:12:41.099 --> 00:12:59.159
This begins to kind of, you know, tip your head a little to think, is there a business model here? And sure enough there is, and you're starting to see they were targeting very specific insurance companies, Omega insurance, Westcom insurance, mobile homeowners in Louisiana, even though this public adjuster is based in Florida.

41 "Todd" (3334650368)
00:12:59.159 --> 00:13:19.159
What we also begin to see is how they were targeting and soliciting policy holders. If you think about search, in general search is very geodependent. If I do a search from my home versus my headquarter, my office headquarters versus maybe where I, where I go to work out or wherever. Search will change relative to.

42 "Todd" (3334650368)
00:13:19.159 --> 00:13:37.589
Do your geography, and what opportunities started to figure out was that they could manipulate an out rank on search results in very specific geographies where brand was being out ranked. So e.g., one of the tactics that we had started to unveil was being able to out rank for the claims department phone number.

43 "Todd" (3334650368)
00:13:37.589 --> 00:13:55.439
Many of us, if, if we have a tree fall on our house, we may not have the claims department phone number stored in our phone, but we might turn to a search engine and run a search. And what we might find is that an opportunist has outranked for our, for the claims department phone number. They may either use the one 800 number.

44 "Todd" (3334650368)
00:13:55.439 --> 00:14:11.849
And insert themselves above or they may insert their own phone number with their own marks and brands and logos. What we started to do was call these numbers and they would say hi, we're company XYZ claims department. We'll say yes, are you company XYZ? And they'll say, well, we're the claims department?

45 "Todd" (3334650368)
00:14:11.849 --> 00:14:27.599
We'll say yes, we understand you're the claims department, but are you a company XYZ? And then click. And we would get this over and over again. And then hurricane idealia came and it wasn't a particularly large hurricane, but by this point we had our 1st set of clients in Florida.

46 "Todd" (3334650368)
00:14:27.599 --> 00:14:47.599
And they reached out to us and they said, Todd, we're getting our 1st notice of loss, and yet the hurricane is 250 mi off the coast. We we we don't even have enough wind to fly a kite. How how how is it possible that this is happening? And we started to analyze and we started to realize that there were law firms setting up websites bidding on keywords 75 to a hundred dollars a click.

47 "Todd" (3334650368)
00:14:47.599 --> 00:15:03.719
And they were promising. They were saying, hey, if you file 1st, you'll be 1st in line, you'll get paid 1st as well. And so we started to see that generation happening. And Maui, just 48 h after the, if you remember the fires, just 48 h we had.

48 "Todd" (3334650368)
00:15:03.719 --> 00:15:23.719
Law lawyers supplying in from out of state, soliciting folks that were, it was actually technically illegal, they weren't licensed to do so, and they were sending again websites bidding on keywords and the 1st lawsuits were happening. We had a client there in Hawaii who was receiving their 1st lawsuits, not even just, not even 48 h after the the events had started. So the.

49 "Todd" (3334650368)
00:15:23.719 --> 00:15:49.079
That was the the stress that we were seeing. And then the granddaddy of all was mccleney Mosley. Many of us maybe familiar with this case for those not, this was a law firm in Texas that took in $40 million in private equity funding. 14 of it was spent on targeted SEO marketing and campaigns, and they were targeting folks in Louisiana, and, and unfortunately hundreds of folks's names were ended or or were.

50 "Todd" (3334650368)
00:15:49.079 --> 00:16:05.729
Were submitted as part of insurance claims fraudulently. And we, we were at this time early stages of calibrating our models and learning about the kind of digital behaviors that were happening online and and so we had certainly shared some results to.

51 "Todd" (3334650368)
00:16:05.729 --> 00:16:23.579
To the commissioner of insurance and you know at that time it was considered opportunism and of course the story unfolds very differently today. Just to give you a sense in the marketplace, a hundred and $14 is the going rate right now for Los Angeles fire attorney. And why it's because there are more folks.

52 "Todd" (3334650368)
00:16:23.579 --> 00:16:43.579
Creating advertisements, they're creating websites, they're creating clickbate opportunities, case evaluations, and while this is happening, we always say it form is we're not really worried too much about what you see online. That happens. SEO has a, has a, has the right to be there. It's what you don't see that we have the real concern, and that's what.

53 "Todd" (3334650368)
00:16:43.579 --> 00:17:05.149
What we're gonna talk about next. Just to put this into context, large national consumer brands like Ford Starbucks mcdonald's, they spend on average about $300000 each per month to promote a product, to service, a drink or so on. What we've uncovered at Ford Warn is that there are law firms spending almost $2 million a month to promote their digital advertising and targeting on services.

54 "Todd" (3334650368)
00:17:05.149 --> 00:17:21.929
It's $2 million, it's almost $24 million a year just on paper click advertising. So the the problem as you can imagine is if it's now more than one one firm, but what if there are hundreds of firms? That opens up a whole new form of risk across the industry.

55 "Todd" (3334650368)
00:17:21.929 --> 00:17:37.379
Not just for companies, but for their clients, even personally. And this is what we're seeing. To give you a sense of that one law firm, as I mentioned, there are two ways that you can attract traffic to your site. Organically, this law firm.

56 "Todd" (3334650368)
00:17:37.379 --> 00:17:56.729
Will generate over 200000 clicks in one month with their, with their content schemes. On the paid side, they will bid on 74000 keywords and very targeted keywords and generate 15000 clicks. And together they will target more than a hundred different businesses.

57 "Todd" (3334650368)
00:17:56.729 --> 00:18:14.489
To give you a sense in the 12:00 position is Walmart three down, two down is FedEx, but the other 98 all represent insurance companies. And what we're looking at is what we call a topalistics threat mat. It looks at the magnitude and scale of targeting by this particular opportunist.

58 "Todd" (3334650368)
00:18:14.489 --> 00:18:29.669
And we can learn from this about where this is happening, what geographies are being targeted, what insurance lines are being targeted, what weaknesses and policy provision have they figured out to target as well? So we look at the loss types that they're analyzing as well.

59 "Todd" (3334650368)
00:18:29.669 --> 00:18:49.669
To give you a different perspective, imagine if you had a collection of opportunities grouped together to target one company. That's exactly what we're seeing here. These are a hundred and 37 different opportunities in the form of law firms, contractors, like a roofer, to a public adjuster, as well as 3rd party.

60 "Todd" (3334650368)
00:18:49.669 --> 00:19:15.569
Entities and these even include cyber groups that we'll talk talk through. Collectively, they spend $60 million to target one national carrier. And what you see on the right hand side, all those little circles, the size of the circle corresponds to the size of, if you will, the resourcefulness and and overall targeting by that opportunist, and inside that are the circles, the smaller circles represent the carriers.

61 "Todd" (3334650368)
00:19:15.569 --> 00:19:33.779
That are being targeted, and so it allows us to track and and monitor the different size and scale of targeting that's being done. So even the small, the small circles while they, they, they are small relative to some of the biggest circles in that in that ring, they still represent targeting and still represent claims and lawsuits.

62 "Todd" (3334650368)
00:19:33.779 --> 00:19:49.109
And that's the thing that we're, we're uncovering. So we talked a lot about SEO, but there's this new thing called AI, and that's what we're, we're here to talk about next is how is that now being manipulated?

63 "Todd" (3334650368)
00:19:49.109 --> 00:20:09.109
And with that context of SEO, today when we run a search, we're now getting results from, e.g., Google Gemini, and we see those search results appearing and we're trusting that content. And Google uses that content, they use user engagement and behavioral signals from dwell time and click through rates and they're looking at human behavior.

64 "Todd" (3334650368)
00:20:09.109 --> 00:20:26.969
Here to see and judge what what information should be included inside a large language model. But the question we're here for is, could that potentially be hacked? And I wouldn't be here otherwise if we didn't. So sure enough, what we're seeing is an entire new attack surface.

65 "Todd" (3334650368)
00:20:26.969 --> 00:20:46.969
And that attack surface is in the form of auto generated fake websites that appear and may look like yours, but are providing services, maybe selling insurance, and we're gonna show examples of that. We're seeing AI generated content in the form of articles, FAQs, blogs. Why? Well, that content gets indexed by search.

66 "Todd" (3334650368)
00:20:46.969 --> 00:21:09.899
Lots it gets ranked as though it's traditionally normal content, but it's not. And so it's being manipulated. And then we see the emergence of synthetic backling farms. What is that? Well, if I link to your website and you link to me, that's considered in the industry good linked juice. I didn't make that term up, but that's, that's the term that that's used. We have good linked juice. We're building a network.

67 "Todd" (3334650368)
00:21:09.899 --> 00:21:29.899
But what happens if you have someone that links to you that has a whole collection of really bad backlinks? Spam, fishing, schemes, malware schemes or others? And that's what we're gonna talk about and what that looks like. And so you can imagine there's a potential gamification here around AI, and there's a lot of potential pitfalls here as well as.

68 "Todd" (3334650368)
00:21:29.899 --> 00:21:51.799
Much as there's a promise of good and we're all starting to experience experiment with tools like chat GPT, which are terrific. The rules of how that's evolving and what goes into those engines is changing. And that's what we're gonna share today. So let's take an example. Let's look at this is a client of ours Louis and a citizen. I can share this. Richard Newberry allowed me to show.

69 "Todd" (3334650368)
00:21:51.799 --> 00:22:13.169
He's the CEO of Louisiana citizens. They're the insurer of last resort in Louisiana. An article was written about them from NPR, and this was a storyline that was a good story about their service and work around a particular hurricane. The article was taken by a group of bad actors in Russia.

70 "Todd" (3334650368)
00:22:13.169 --> 00:22:30.209
The articles were replace, the links within the articles were replaced with links being served off of servers in Russia with fishing and malware schemes. The entire article was then backlinked, if you will, attached, if you will, to the domain of Louisiana citizens.

71 "Todd" (3334650368)
00:22:30.209 --> 00:22:49.139
In the process, the marketing team thought geez, you know, this is such a great article, they wanted to promote it like anybody would, except they promoted the wrong article. And in the process they put it out on social media, people were exposed. And so this exposed folks to, again, phishing and malware and other forms and schemes.

72 "Todd" (3334650368)
00:22:49.139 --> 00:23:09.139
But then you get to back up and ask the question, why would they do this? Why, why would a, a cyber criminal group overseas want to target an insurer of last resort? Well, one of the ways that you can knock a known brand off its kind of search pedestal. You think of some of the large national carriers.

73 "Todd" (3334650368)
00:23:09.139 --> 00:23:29.879
The ones that have dominating marketing budgets and dominating marketing presence, there's something called domain authority. Domain authority represents your kind of search viability, your credibility online, you know, government agencies have higher search authority, right? There's lots of content, but they're, they're a known validated source, certain news organizations.

74 "Todd" (3334650368)
00:23:29.879 --> 00:23:49.879
But one of the ways that you can knock a large brand off its search pedestal is to apply this notion of of of toxic backlinks. And when you apply a bunch of them, you can suppress the domain authority of that targeted company. You do that enough times and then you can launch the 3rd attack, which is then you can actually out market them.

75 "Todd" (3334650368)
00:23:49.879 --> 00:24:12.029
And outrank them in geopeticular markets. And that's exactly what happened to Louisiana citizens. So when you do that, you can then launch yet the next attack. And this is an example when the attack hits the federal government. This is Fema, the federal emergency Management agency, and the national Flood insurance program. These are known programs.

76 "Todd" (3334650368)
00:24:12.029 --> 00:24:31.259
And what we had detected early on through this scheme was this site was carbon copied and hosted off of a server in Germany. People were filing flood claims going and reporting to the site. And as you could imagine, information was being stolen and being harvested and then being resold into the dark web months later.

77 "Todd" (3334650368)
00:24:31.259 --> 00:24:51.259
And so we see where this, where, where not only backlinks, but SEO where you use SEO and AI to actually outrank even the federal government and that can have profound risk as we see here. And so we see lots of these different examples and so we're gonna highlight a few of these now in.

78 "Todd" (3334650368)
00:24:51.259 --> 00:25:12.329
In this next part. So let's take a look at some of these examples and the way I like to, I tried to categorize this to make sense because this can be sometimes a little bit overwhelming and so organizing it into kind of buckets and families of of risk and attack vectors is what we do at four warn. We we analyze all of these and so the categories on the left hand side.

79 "Todd" (3334650368)
00:25:12.329 --> 00:25:32.329
So we're gonna talk about black hat and technical SEO. Not something that traditionally lands you into prison, but it goes against search guidelines and it has real repercussions for organizations. Synthetic and AI deception, we're gonna talk about collusion network when organiz when organized groups get together to commit.

80 "Todd" (3334650368)
00:25:32.329 --> 00:25:49.829
Fraud and and opportunism. And we're, we're gonna highlight a few of these examples now. So let's, we'll dive deep here and we're gonna illustrate a few companies, and these are, these are, you know, publicly available. These are known threats that we've seen and shared before.

81 "Todd" (3334650368)
00:25:49.829 --> 00:26:09.829
Blackhat SEO, there's a notion of what we call keyword stuffing. Keyword stuffing is where you take a word and you repeat it many many times on a particular webpage. In the past, this was something that search engines would, would certainly recognize and **** analyze, but with the advent of AI, you can generate a lot more content much.

82 "Todd" (3334650368)
00:26:09.829 --> 00:26:37.409
More quickly, and what we're seeing is a proliferation of not just websites but content within those websites and what we're seeing here is the use of USAA on a website over close to almost a thousand times. So why would they do that? Well, this is a way to make a webpage appear authoritative and actually a great way to drive traffic, and so to pick off traffic not just from USAA but anybody having a question around what they might be trying to rank for.

83 "Todd" (3334650368)
00:26:37.409 --> 00:26:56.189
And what's remarkable is we're also beginning to see something called web cloaking, where you take the key word USAA or whatever phrase you'd like. Maybe they don't pay claims or somebody doesn't pay claims, and you put the the font color the same as the web page color. So it blends right into the, into the screen.

84 "Todd" (3334650368)
00:26:56.189 --> 00:27:16.189
So a human eye can't detect it, but a search bot can. And as a result, you begin to raise that rank up or a nefarious site. We see fake law firms who will spawn up new domains with different names. In some cases, when we can identify them, we share this with Google. It can be de indexed and literally rem.

85 "Todd" (3334650368)
00:27:16.189 --> 00:27:35.909
Moved from the site and and from search from the search index, but it's a way of protecting organizations and companies. We see semantic SEO. So travelers as we now is all spelled with one L But what happens when an opportunity see it? They see the world from a very different perspective and they may see travelers with two L's.

86 "Todd" (3334650368)
00:27:35.909 --> 00:27:54.419
And so as a result, you begin to see the bidding of, of travelers with two L's so they can pick off traffic to their site. They can create fake websites with two L's, they can pay claims with, you know, have you process claims with two L's So we see these types of techniques. There's nearly a couple dozen different what we call black hat techniques.

87 "Todd" (3334650368)
00:27:54.419 --> 00:28:11.549
That exists and and certainly need to, to, to be stopped. We mentioned about some of the toxic backlinks, but one of the services that we often provide is being able to audit all of your backlinks coming in because even the smallest of companies that sometimes we engage with, we will start to see.

88 "Todd" (3334650368)
00:28:11.549 --> 00:28:29.249
Activity coming from across the world. And so if you have a company that's based in say Wisconsin doing business in just Wisconsin, why do they have 15 comp countries who are also attaching to their site trying to drive different services or trying to potentially commit fraud? And so we see these patterns emerging.

89 "Todd" (3334650368)
00:28:29.249 --> 00:28:49.249
We also begin to see the notion of large language model content injection. So like I said, we're all starting to use chat services like chat GPT, but what happens when we start to use them as search engines? More and more of us are doing this. In fact, Google just last week we were on a a call with the head of search and the head of AI and.

90 "Todd" (3334650368)
00:28:49.249 --> 00:29:13.729
For the 1st time 2024 represented the peak in search traffic. What's happened is it's gone down because it's now migrated over to large to these to the large language models like chat GPT or mode AI. And what we're seeing though is that even this can be manipulated. And even here you can see in this very 1st statement, you should avoid giving a statement to a state farm adjuster.

91 "Todd" (3334650368)
00:29:13.729 --> 00:29:35.099
Without 1st consulting a lawyer. State Farm may fight to delay payment and question the validity of your injuries. This is Google Gemini providing this answer. So the question then becomes, how does this get inside Google Gemini? How does a large language model potentially get manipulated? And that's exactly what what's being happened, what's happened here.

92 "Todd" (3334650368)
00:29:35.099 --> 00:29:50.639
Right, we're seeing law firms in this case ranking for content. And as I mentioned SEO matters to large language models. In fact, the way Google Gemini has worked traditionally is that it takes 75 % of its content off the top twelve search positions.

93 "Todd" (3334650368)
00:29:50.639 --> 00:30:09.929
So if you can rank up, if you can build content up, you're gonna become a viable intake to the algorithm of, of the large language model. That has continued to expand with some of the kind of next generation approaches for what's feeding into that model, but you can see that you can begin to.

94 "Todd" (3334650368)
00:30:09.929 --> 00:30:29.929
Have a very, you can you can instigate a claim from a contested space just from the this type of activity. And when it's targeted to companies, this is represents a whole new way of risk. We're seeing engines like copilot affected or even other engines like yendex, which is a Russian search engine, of course, you might expect that.

95 "Todd" (3334650368)
00:30:29.929 --> 00:31:00.289
I see some activity on this. So this is what we're looking out for and policing this and and understanding how this affects your brand and the exploitation of your brand is really the heart of what we're trying to see and do it for warm. I mentioned about dopple Gangler websites. This is a real world example of a, of, of a, one of our clients, a large MGA, their site again carbon copied hosted off of a server in Norway run by a group out of Russia.

96 "Todd" (3334650368)
00:31:00.289 --> 00:31:20.289
And again, they were trying to sell insurance, process claims, as well as a collection of other, exploited websites from them. We even see this with reinsurers, they are not immune to this type of targeting. So AI is being used to copy sites, it's also being used to spawn up new content.

97 "Todd" (3334650368)
00:31:20.289 --> 00:31:48.689
But also new interfaces for, in this case insurers to log in and share information. Again, harvesting information just as we saw with Louisiana citizens and the exploitation of of their situation. So these are the real risks that we have to look out for. The last part I'll mention just is around this idea of collusive activity. And one of those is really a focus around manipulation rings and even in the case of user generated content.

98 "Todd" (3334650368)
00:31:48.689 --> 00:32:08.689
Many of us may not be on TikTok, we may not be all the all the time on Facebook or so on, but those represent kind of that, that next generation way of communicating as well as being able to promote a brand, right? And we've seen it, but we're also seeing it being used.

99 "Todd" (3334650368)
00:32:08.689 --> 00:32:29.069
To be weaponized. And what we're finding is there are some opportunists who are not only sponsoring their own content and creating content, but they're hiring others to engineer content for them. Even though they may not be a client of theirs, they're promoting information that is then attached and targeted to a particular, to a particular company.

100 "Todd" (3334650368)
00:32:29.069 --> 00:32:49.069
We're also seeing an immense amount of activity around very specific legal based marketing firms that have the expertise and the science. And I I use that term a lot, but the science of marketing has changed so much from in the last just few years that the science has become much more.

101 "Todd" (3334650368)
00:32:49.069 --> 00:33:12.989
Are profound and exacting in terms of how we think about content online. And so we can see examples here where it's become a business model. We see brand impersonation happen where folks are pretending to be part of a company or representing a brand or an extension of that brand. And again, to us, this needs to be identified. To us this is a, a trademark infringement.

102 "Todd" (3334650368)
00:33:12.989 --> 00:33:31.709
We also see collusive bidding. So I mentioned how you can get traffic to your website through paper click activity. So imagine if you had two or three bad actors grouped together to bid together and outbid everybody else in the market for certain keywords so that website traffic goes to your sites and your clicks.

103 "Todd" (3334650368)
00:33:31.709 --> 00:33:51.709
And we see that happening. In fact, there was one example recently where we were working with a carrier who in between a auto body shop, a personal injury lawyer and a medical office, all bidding on keywords, but they were also driving a scheme across the country across different cities with that same targeting and collectively generating.

104 "Todd" (3334650368)
00:33:51.709 --> 00:34:15.869
Names in the total of about $27 million. So these are real real threats. So what do we do about it? And that's where form was kind of you know, I always said this was the company that we we weren't even focused on wanting to build a company. This was actually a response to what we were seeing cause it was so great. And so we focus on what we call digital risk intelligence. And the idea here is to detect and disrupt.

105 "Todd" (3334650368)
00:34:15.869 --> 00:34:35.869
Tech enabled opportunism. How is this emerging? How is it not only spawning loss and litigation but potentially fraud? And the goal here is not just to protect the carriers but the policy holders as well because they're also being exposed to these same tactics. And this we've seen this across so many different businesses from carriers.

106 "Todd" (3334650368)
00:34:35.869 --> 00:35:02.099
Years, Transportation to retail, family offices, small businesses, all are affected with these types of schemes. Today we analyzed and scanned roughly three quarters of a trillion data points across search engines, search platforms, marketing platforms, we triangulate and cross validate data so that we can understand the breadcrumbs that are being left behind in the activity that we see online across these different marketing campaigns.

107 "Todd" (3334650368)
00:35:02.099 --> 00:35:22.099
And we scan roughly 20000 opportunities across 1500 companies on a daily basis. We are looking for activity. We're trying to see who works with one another potentially, but also what are the new emerging patterns and schemes that are forming not just in our state but, but nationally because something that happens in the Pacific Northwest or the.

108 "Todd" (3334650368)
00:35:22.099 --> 00:35:48.149
Or up in Maine may have a profound impact for somebody in Georgia. So we need to be able to understand those behaviors and we put all of this information into what we call a threat intelligence report. These are run quarterly. They're the surveillance and the alerting is happening continuously and we provide this in the form of various use cases. To give you a sense of, of, of, you know, a breakdown of of four warn a little more depth.

109 "Todd" (3334650368)
00:35:48.149 --> 00:36:07.889
You know, we try to ask the question right up front, what are you up against? Who are you up against? Are you facing a a local law firm or a local contractor or just or or maybe a cybergroup or are you backed by some type of national syndicate or state sponsored cyber organization looking to drive activity?

110 "Todd" (3334650368)
00:36:07.889 --> 00:36:25.439
We are surveilling across a collection of different attack vectors from collusive networks to black hat SEO approaches and brand impersonation to 3rd party litigation funding rings because understanding the size, the scale and magnitude is really important.

111 "Todd" (3334650368)
00:36:25.439 --> 00:36:45.439
And we want to put this information up into understanding the claim patterns that we're seeing and the risks that we're seeing, and then using that information downstream to impact the rest of the organization. We also then want to help prioritize how to respond. You know, for many organizations, we, we feel already overworked overloaded. You know, there's.

112 "Todd" (3334650368)
00:36:45.439 --> 00:37:05.439
Just not enough tile on all in our day to you know qualm our our headaches, but what at the end of the day, we also need to help, we have helped prioritizing what to go after because there is so much and part of what we're doing here, a running joke from from our clients that they call this the death star. But this is a a an image, a real live image of of of thousands of other.

113 "Todd" (3334650368)
00:37:05.439 --> 00:37:26.539
Opportunities and in the middle there, on the upper right hand is an actual company being targeted by various opportunities. What we're looking at is how they're connected and we're monitoring the behavior of how these organizations are connected to one another, some in the US, some global, but they're all working together in concert to create a new form of risk.

114 "Todd" (3334650368)
00:37:26.539 --> 00:37:45.359
And this is what we call form warn topolistics. The idea is to track this and and help organizations get ahead of it. The last part is then we summarize this up into the what we call a risk score. And this is, you know, again, a way to quantify and, and frankly to be, to be transparent.

115 "Todd" (3334650368)
00:37:45.359 --> 00:38:01.979
Get the company to say, you know, here, here are, here's your current risk, here's your risk relative to the the the folks that are targeting you, the, the opportunities that are targeting you, how much they're targeting you, but also is it working against you? Are they, are they successful at what they do?

116 "Todd" (3334650368)
00:38:01.979 --> 00:38:18.870
And do you have your, your, you have vulnerabilities internally to be able to respond? Is there a point? So we we monitor all of this in the form of of new forms of strategic intelligence that make that actionable, not just for say a claims team, but across an entire organization because each will have a different perspective.

117 "Todd" (3334650368)
00:38:18.870 --> 00:38:38.870
The last thing I'll just mention is we we talk a lot about surveillance and top holistics, but putting this in into work across different teams, there are different use cases for different groups. So for those representing different departments today, know that this information can be repurposed for all different use cases as you can see here from triage.

118 "Todd" (3334650368)
00:38:38.870 --> 00:39:02.520
Through screening to underwriting, even up to marketing. You know, oftentimes in marketing, we think of it as a brand building exercise, and the running joke I often like to say is, you know, if you, if you want to hide a dead body, you put it on page two of Google because nobody ever goes to google, right? It's a second page, right? And that's true with opportunists. When we run our searches for say the claims department phone number.

119 "Todd" (3334650368)
00:39:02.520 --> 00:39:22.520
If we're sitting in our headquarters or maybe even our home, we maybe appearing in the 1st ranked position or maybe the top three or four positions. But what happens if we move four or five zip codes down the street? Do we still get the same results? And if not, how are we looking at defending, you know, our marketing efforts? We, we, we never think of.

120 "Todd" (3334650368)
00:39:22.520 --> 00:39:49.760
Marketing as a defense measure, but we actually in this next generation with AI have to begin thinking about as do all departments, how do we prioritize and how do we protect ourselves from this type of digital risk? A big part of this is how do we build a better digital mode around the business? And when it works right, it works really well. And so this is an example of a client on the left hand that started with a risk score of 71, they dropped it to 47 in less than nine months and and in this time.

121 "Todd" (3334650368)
00:39:49.760 --> 00:40:23.630
And we had detected a false site. We detected a false bill payment site. We detected bad logins that were for for agents that were being manipulated. Of course, we had opportunism and and areas of fraud being committed, but also being able to shore up a really great response and mitigation strategy. I mentioned Louisianna citizens earlier, just to give you a sense, and this is Richard Newberry in just three months they saved over $9 million in their claims and they count 1 % in their litigated claim frequency dropping, which is translated to that $9 million. So.

122 "Todd" (3334650368)
00:40:23.630 --> 00:40:48.346
So that's a a really big deal in being able to offer up results. So with that, I'm gonna, ask certainly, we'll open it up to some questions and certainly encourage all of you, please, if you have more questions or would like a more personal view of four warn, we'd certainly love the opportunity to share more, certainly follow us up on LinkedIn and look forward to to next answer.

123 "Beth Johnson" (1121332224)
00:40:48.346 --> 00:40:49.560
Answering some questions.

124 "Beth Johnson" (1121332224)
00:40:49.560 --> 00:41:14.785
Thank you. Great. Thank you, Todd such, such interesting information. I know I was unaware of many of these things and I imagine that's probably the case for a lot of consumers, so couple of questions that were received are are pretty similar, so, thank you for the work you're doing. What do we do individually as the consumer, as the policyholder, as the person buying the insurance from the insurance company? What.

125 "Todd" (3334650368)
00:41:14.785 --> 00:41:47.780
Yeah, great, great questions. There, there are there are so many different personal kind of use cases in our day in terms of protecting our own digital risks as we've seen you know for 1st and foremost, if, if we do have a legitimate claim, if we do have a real issue, you know, certainly we we contact our insurance companies directly. There's, you know, the, as we've seen, there's a lot of interception around, hey, talk to a law firm 1st or talk to us 1st. And in the past we've seen.

126 "Todd" (3334650368)
00:41:47.780 --> 00:42:14.370
Contractors driving aobs, right? It's assignment of benefits and saying, hey, we'll negotiate with the insurance company ourselves. Don't worry about it homeowner. And so have that direct relationship because that four times than not, they're there to bat for you, they are there to work for you and work with you. Even on the on the digital risks, you know, we we carry our phones with us all the time. One of the questions I often ask folks is when was the last time you turned your phone off?

127 "Todd" (3334650368)
00:42:14.370 --> 00:42:34.230
Literally shut it down because from a digital risk perspective, what most people don't realize in the world of cyber, there are many websites that we go to that drop little bits of code and these are non transient. They're, they may just sit there. I often I give the experience and and this is the.

128 "Todd" (3334650368)
00:42:34.230 --> 00:42:54.230
You know, the, the personal feeling of, you know, you just had that conversation with your spouse and then all of a sudden you you've just been given an advertisement, you say, is that coincidental or was they were they listening in on the phone conversation? Well, there is code to be able to do that. And so what we often say, these are non transient programs that are being run.

129 "Todd" (3334650368)
00:42:54.230 --> 00:43:14.230
And so what we often suggest is just turn your phone off and reboot it because that will erase or delete those types of codes that are running in the backdrop of your phone and and then re, you know, certainly reboot, always update your operating system. You know, again, we work with a lot of federal agencies. The activities that we're seeing online are re.

130 "Todd" (3334650368)
00:43:14.230 --> 00:43:35.390
Really scary. I'll give you another example. Search when we run a Google search today, it's it's it's very common we get a set of results, which, which is great. In certain cases, we're seeing certain companies being targeted and large retail companies sometimes are around the ends of those targeting. And so just be very careful before clicking on.

131 "Todd" (3334650368)
00:43:35.390 --> 00:43:59.660
It's something because what we often will see is those search results that you're expecting, maybe they are replaced. They may look, they feel the same, look the same, but they're being served off of servers from an adversarial country. And we've seen various examples of that starting to form more and more now nationally. And so in working with groups like the NSA and others to help us identify but also to to bring.

132 "Todd" (3334650368)
00:43:59.660 --> 00:44:18.365
Getting Awareness to folks around these issues. We always say just do an extra read. Look at that URL. I shared some examples earlier of of websites that would be common to say file a flood claim when FEMA or, you know, programs that we'd expect to be, to be kind of sanitized and protected, but just do a double check each time you're.

133 "Beth Johnson" (1121332224)
00:44:18.365 --> 00:44:20.340
Looking at those URLs if you can.

134 "Beth Johnson" (1121332224)
00:44:20.340 --> 00:44:40.340
Yep, great, great advice, and I'll just add to that. Talk to you, your broker, your insurance agent, whoever it is also if you're not sure. So go right go straight to the insurance carrier but use us to because we have the we definitely have the correct information on how to get a hold of them. So that's great. Thanks. So on.

135 "Beth Johnson" (1121332224)
00:44:40.340 --> 00:45:00.354
On that AI generated portion, when you talked about how the fraudulent information is is being put in that overview, can you talk just a little bit? I'm sure there's a lot, a lot behind it, but can you give us a little bit more on how does, how does that work? How does we rely on that information as, as truth, like you said, how does that.

136 "Todd" (3334650368)
00:45:00.354 --> 00:45:18.570
So, you know, one of the reasons I wanted to talk about SEO 1st before we talk about AI. So in the world of marketing, the world of of content, you know, we, we create these content articles with key words that get indexed and and parsed for, for, you know, for, for ranking.

137 "Todd" (3334650368)
00:45:18.570 --> 00:45:38.570
And and that was in the past, that's how search engines would, would kind of algorithmically look at how to rank something along with with a couple of other metrics, a couple of key metrics. But what's evolved or what's changed with AI in large language models is now they are looking at content in a very different way. It's not so much about the the.

138 "Todd" (3334650368)
00:45:38.570 --> 00:46:03.060
The density of that content. They're looking at the the if you will, the engagement of a user with that content, and there's something called, believe it or not, it's a quantification of the readability of a site called the flash score. And so it looks at the sentence length, it looks at the number of syllables in a word, but you know, is this a 5th grade reading level? Is this 6th grade, 7th grade, 8th grade by quantifying that.

139 "Todd" (3334650368)
00:46:03.060 --> 00:46:23.060
We begin to large language models have a better or an easier way of reading that material, and what opportunists had figured out in recently in the last six months is if they could build content that's really simple and easy to understand, they would actually out rank even large companies for the same content except that they were.

140 "Todd" (3334650368)
00:46:23.060 --> 00:46:47.630
Able to inject it right into large language models and manipulate what they might wanna say. And so this is why I I, you know, we call alarm bells off on this because this is a concern, right? These are, the algorithms of this are still being defined out. This is still very early on. We think about the internet, you know, now we've been using this for decades, but it's taken some time to kind of iron out a lot of problems that we've had and you think of across the.

141 "Todd" (3334650368)
00:46:47.630 --> 00:47:15.166
All different business units. AI is in its infancy and there's a lot that's gonna come through with what we're gonna see. So, you know, that so you know, I I think for for businesses, this looks at a whole different perspective of how we market, what content we use and and how we, we interact for for people using these services and on websites and engaging. This really requires a little bit extra, you know, read through.

142 "Beth Johnson" (1121332224)
00:47:15.166 --> 00:47:42.175
As much as we can. Sure. And I think we, we are used to information at our fingertips and so we will take maybe that path of least resistance of you give me the short and dirty up here at the top. I'm gonna take it so good to know. Well take one last question here. You talked mostly about property casualty. Do you see this impacting other, other lines going into health care of others.

143 "Todd" (3334650368)
00:47:42.175 --> 00:47:48.600
Yes, actually I I was just at on a.

144 "Todd" (3334650368)
00:47:48.600 --> 00:48:08.600
On a subcommittee panel on long term care, and we're seeing this in in life insurance products, we're seeing synthetic IDs, we're seeing websites and cybergroups stealing those IDs. And so yes, we see it in life insurance, we see it in workers comp, we certainly see it across all lines.

145 "Todd" (3334650368)
00:48:08.600 --> 00:48:37.490
I I'd like to tell you that it was just contained to PNC, and that it was just in Florida, but it's not, right? Florida was just the the kind of initial grounds, but this has become not just a national but a global issue because we see some of the same tactics being done overseas as well. And, and it's not just insurance, right? As we've seen, it's it's in transportation. Some of them are captive. So yes, they're, you know, they're very much targeted. Risk retention groups are being targeted. So they're they're.

146 "Todd" (3334650368)
00:48:37.490 --> 00:48:49.439
There's a lot of activity here and you know whether it's because we're part of this litigious society or not, we are still finding activity globally using these tactics and, and, and, and.

147 "Beth Johnson" (1121332224)
00:48:49.439 --> 00:49:16.519
Techniques. Yeah, ok. Well, appreciate your time and all the information you provided. If if those participating here, if your question, you didn't make it into the chat or you had something else that pops up, feel free to contact. You've got the contact information there for four warn or contact your USI representative and and we'll be happy to assist you. So, with that, thank you again, Todd for your time and.

148 "Todd" (3334650368)
00:49:16.519 --> 00:49:22.020
We appreciate you fighting the fight. Thank you for the opportunity and thank you everyone for taking the time.

149 "Beth Johnson" (1121332224)
00:49:22.020 --> 00:49:29.784
Time to join. All right. Thank you.