Jonathan Spry: How Envelop Risk taught an entire industry to use its data

Jonathan Spry co-founded Envelop Risk in 2016, applying machine learning to an industry he felt was drowning in data it didn't know how to use. Today, the Bristol-based business underwrites cyber and emerging risk on behalf of insurers around the world and Spry has a message for business leaders: it's not a question of whether you get attacked, but when.

Speaking to Sir Richard Harpin on the Business Leader podcast, Spry explains how AI is reshaping insurance from the inside, why he thinks poor cyber hygiene is the industry's real Achilles' heel and the mistake in Envelop's own early years that he says others can learn from.

In our interview, you will learn about:

• Why he believes a cyber attack is a 100 per cent certainty for every business
• The blind spot in most cyber response plans that has nothing to do with hackers
• How he raised $130m from SoftBank without giving up his independence
• The mistake Envelop made in its first few years – and why patience saved the business

Why insurance was ready for an AI rethink

Spry's background was in capital management, but he spotted a gap that now seems obvious. “The insurance industry was doing very little when it came to using data and digitalising their businesses,” he says. Compared with the defence and aerospace sector, where he saw far more sophisticated use of statistical modelling, insurance was sitting on huge volumes of data and doing nothing with it.

“I just didn't see any reason that we couldn't take the best from one industry and apply it to an industry which, frankly, is dealing with risk, has huge amounts of data, but was not using it properly.” That instinct, combined with meeting a group of US-based machine learning specialists at a moment when the technology was, in his words, “a far less fashionable subject 10 years ago,” became Envelop Risk.

A decade later, Spry says the bigger insurers that were slow to move are now following Envelop's lead, and the business increasingly partners directly with them, offering not just analytics and risk transfer but hands-on support in getting the best out of their own data.

Envelop describes its underwriting model as “augmented” rather than automated. “We don't necessarily feel that a human will have to be in the loop on every underwriting or insurance-related decision forever in the future,” Spry says. But for the most complex risk analysis and relationship management, people still matter. “It's still quite important to have humans in the loop, and that's our business model.”

The one hygiene mistake Envelop Risk always sees

Envelop doesn't sell cybersecurity directly but Spry is emphatic that better hygiene underpins everything the insurance industry does. “It's becoming harder to achieve insurance for cyber if you don't get the basic cyber hygiene right,” he says. “Software will never be perfect and we truly believe that there are always going to be vulnerabilities. What we need to do is make the best efforts we can to ensure that cyber hygiene is as high as it can be.”

The bigger danger, he says, rarely comes from a single company's individual weakness. “It's really the correlation of risks and the aggregation that cause the problems,” he explains, whether that's a widespread software vulnerability or a single threat actor targeting many victims at once.

Understanding cyber insurance take-up puts the scale of the exposure in context: Spry estimates the proportion of SMEs with cover in place is “probably less than you might speculate,” often in the low teens as a percentage, and below 10 per cent in some countries. Even some large, high-profile retailers that have suffered attacks in recent years didn't have cyber insurance in place, though those that did, he says, “have looked pretty smart in making sure that they've used that correctly.”

Spry is direct about the odds facing any business, insured or not. “Pretty much every company has some vulnerability,” he says. “If you've not been attacked already, it is a question of when... not if... this is a kind of 100 per cent risk.”

His advice to founders and CEOs is to treat cyber hygiene, culture and insurance as complementary, not substitutes for one another and to make sure risk management is embedded in board-level thinking rather than delegated and forgotten.

Modelling doomsday scenarios with AI

Where Envelop's technology adds most value, Spry says, is in imagining what could go wrong at a scale no group of humans could brainstorm unaided. “We're actually really benefiting from the use of AI and machine learning and reinforcement learning to generate hundreds of thousands of scenarios well beyond those scenarios that we could hypothesise around as humans,” he says, from cloud outages and ransomware gangs upping their game to genuine black swan events.

One category is consistently underestimated, he argues: what Envelop calls “non-malicious cyber-risk”. “It's sometimes overlooked that non-malicious cyber risk is actually quite prevalent as well,” Spry says, citing software bugs, supply chain failures and simple human error, whether that's an insider mistake, incompetence, or just poor training and culture.

Asked to name the two biggest cyber risks facing a mid-sized business today, he points first to unpredictable black swans and second to ransomware, which he says isn't going away and is evolving in a troubling direction: gangs increasingly re-attacking victims who have already paid once.

Average ransom demands have fallen, partly because insurers are getting better at negotiating on policyholders' behalf, but the aggregate cost keeps rising and Spry draws a direct line from the criminal activity to wider geopolitics. “These things are all linked to the criminal activity,” he says, “whether it's sort of direction or it's tacit approval.”

Scaling funding from SoftBank

Envelop's early funding followed a fairly conventional path: seed investment, friends and family, family offices, then a Series A led by two AI-focused venture firms. Four and a half years ago, it closed a much larger Series B of $130m, led by SoftBank.

“We've not needed to raise money since then,” Spry says. “We are profitable as a business and cash-generative, which is a great way of raising money. It means you're raising money without really having to try too hard to meet new investors.”

His advice to other founders raising capital starts with choosing investors as carefully as a co-founder. “These are people you will have to work very closely with,” he says, and warns against ignoring the value some investors bring beyond the cheque itself: introductions, advice, sometimes operational support.

He's equally clear-eyed about the endpoint of any investor relationship. “Whoever you take investment from, ultimately you're looking to get divorced, and you have to think through the timelines, their expectations, what kind of returns you can deliver.”

What investors are really buying, in Spry's view, is a defensible moat. Envelop's, he argues, is a data flywheel: “More business perhaps brings more data, and more data brings more business.”

On where that leaves the business long term, whether a London listing, a US listing, or continued private ownership, he's deliberately non-committal, though he doesn't rule out London given the city's deep pool of specialty insurance and reinsurance expertise. “We don't see any huge need to relinquish our independence immediately, and I'd like to stay independent a little bit longer.”

How Envelop Risk got its timing wrong

Asked what he'd do differently with hindsight, Spry points to timing rather than strategy. “We overestimated how quickly parts of our industry would adopt new techniques,” he says. “You tend to overestimate what might happen within five years, but then forget that those things will still happen within 10 years.”

The risk of moving too fast was pouring resources into technology while the market, and the humans doing the buying, caught up at their own pace. Envelop's response was to stay disciplined rather than retreat. “We've never exposed ourselves to runway problems and running out of cash,” he says. “We like to wait for a little bit of evidence and then kind of double down and scale up.”

He's equally candid that product management, a discipline he believes is chronically underrated in insurance, has quietly been one of Envelop's advantages. “Finding product-market fit and really thinking about the adoptability of your product, the usability, and how you retain your customers, not just acquire them, that for me has been a bit of a secret source,” he says.

On leadership and retention, his answer is conviction rather than perks. “It's conviction in the narrative that we have,” he says. “We actually bet on ourselves. We take risk alongside our other balance sheet partners.”

Spry is also a strong advocate for co-founders over going it alone, and for mentoring in both directions. He credits his own co-founder relationship with filling gaps in his thinking he couldn't have closed solo, and still tutors founding teams through his old business school, Oxford's Saïd Business School. “It's very much a two-way street,” he says of mentoring. “I get a lot back from that and I'm learning a lot.”

Why Bristol beats London for talent

Envelop is headquartered in Bristol, with further operations in London and Bermuda, a deliberate choice rather than an accident of geography. “We went there deliberately because we saw a talent pool which had defence and aerospace as part of it,” Spry says, pointing to the region's aerospace industry, GCHQ nearby, strong universities and a young, mobile population. “It ticked all of the right boxes for us. We moved there to get the talent, and certainly haven't suffered from doing that.”

Four leadership lessons from Jonathan Spry

Look for the industry sitting on data it isn't using. Spry built Envelop on a simple observation: insurance had huge amounts of data and very little discipline in using it, unlike sectors such as defence and aerospace. Founders scanning for opportunity should ask the same question of their own industry rather than assuming the obvious gaps have already been filled.

Treat every risk to the business as either malicious or human, not just malicious. Envelop's modelling gives as much weight to bad training, human error and internal process failures as it does to hackers. Leaders auditing risk in their own business should look inward as hard as they look outward.

A defensible moat matters more to investors than a growth chart. Spry raised $130m by convincing SoftBank that Envelop's data flywheel (more business bringing more data, more data bringing more business) would compound over time. Founders fundraising should be able to explain what gets harder to copy the longer they run, not just how fast they're growing.

Being early to a trend isn't the same as being ready to spend on it. Envelop backed machine learning in insurance a decade before it was fashionable, but admits it overestimated how quickly the industry itself would catch up. Waiting for evidence before scaling investment kept the business out of cash trouble while the market took its time.

Listen to the full conversation with Jonathan Spry on the Business Leader podcast.