Invited Speaker

This session walks security and compliance staff through cyber insurance, with the speaker noting that it is educational rather than legal advice. It opens with risk management: accepting, avoiding, mitigating or transferring risk, with insurance sitting in the mitigation and transfer categories. The speaker separates first-party losses, which hit the organization itself, from third-party liability for harm caused to others, and notes that internal remediation and internal investigation costs usually stay with the company.

The middle covers typical coverage lines such as regulatory defense and fines, notification, public relations, credit monitoring, outside incident response, ransomware payments and lost income. Exclusions get the most attention, including new-or-should-have-known clauses, breach-of-contract exclusions, war limits and sublimits that may or may not stack. Incident handling is central: a small control group, outside counsel hiring a separate forensics firm under a specific scope, and tight distribution of the report help protect work product. Two cases contrast a protected report with one that lost protection. Ransomware brings sanctions screening for payments, insurer disputes over voluntary payments and rising deductibles.

The takeaways are to review exclusions against actual controls, pre-approve response vendors with the insurer, settle in advance who holds the policy and who to call, and test restores, since recovery can take weeks. Small organizations should carry at least some coverage.