When the Breach Hits the Fan: Understanding Cyber Insurance

Mea Clift, who has spent decades in security leadership and now advises insurance underwriters, opens by placing cyber coverage alongside general liability and other business lines. She explains that general liability generally does not treat electronic data as tangible property, while cyber policies cover first-party costs such as forensics, data restoration, extortion response, and business interruption measured as lost income. Third-party coverage addresses claims arising from vendor breaches, privacy violations, and regulatory proceedings.

The talk then tackles common misconceptions, including a rumored exclusion for a specific endpoint security product, which she said is not how underwriting works. She covers the war exclusion, which is being reconsidered as conflict moves into cyber operations, and betterment coverage, which applies only after a covered event and typically does not replace whole systems. Fines are covered only under some policies and jurisdictions. Underwriters look at basics such as MFA, patching of actively exploited vulnerabilities, asset inventory, recovery speed, and vendor risk. Trends discussed include ransomware and business email compromise, along with claims tied to biometric privacy laws and tracking technologies.

Her practical advice is to report incidents early, since carriers can connect policyholders to breach response teams quickly, to answer questionnaires candidly with a security leader involved, to run business impact analyses that include managed service providers, and to treat the carrier relationship as an ongoing partnership. The session closed with audience questions about warning signs in policies and in customers.