Five cyber insurance mistakes, from new risks to renewal

Most cyber insurance mistakes happen after the application is signed. The business changes, an incident starts, and a legal question arrives that nobody planned for. Three moments cause the most avoidable damage: a new exposure nobody reported, an extortion demand, and a notification sent too early or too late.

Each is a failure of sequence and of reading, made by careful people who are moving fast. The fix in every case is to know who decides before the moment arrives. Five mistakes follow, in the order they tend to occur.

What to take away

During the year

1. Changes nobody reports. A new client whose records you hold, a new payment channel and a new system that a customer depends on each change the exposure the premium was built on. Premium inputs are described elsewhere, and each change may alter your notification obligations.

Keep a running note through the year so renewal is not a memory test. The same note should catch a safeguard disabled "temporarily", a leaver whose privileged access was never removed, and a backup routine that fails silently for months, because each one changes the truth of something you told the insurer.

Tell the broker when a change happens and ask what the wording says, rather than hoping it is not asked about later. A policy review at each business change is the simplest way to keep the declared controls true.

2. Trusting the headline limit. The headline figure is easy to compare across quotes, so it gets compared. Underneath sits a table of sub-limits, and in this line the categories most likely to produce a small-business loss, funds transfer fraud above all, are the ones most often capped far below the headline.

A new payment channel should therefore prompt one question to the broker: what ceiling applies to funds transfer fraud, and has it changed? The table is the policy and the headline is the cover. How one clause decides a loss is shown in the worked examples.

In the first hours

Two early calls are legal rather than technical: whether to answer a demand and whom to notify. Both sit behind an earlier one, because under many wordings the insurer must be notified and vendors approved first. The order is hotline, approval, then the IT provider.

3. Handling an extortion demand yourself. Responding to, negotiating or paying a demand raises legal questions, including sanctions considerations, and is handled through counsel and the insurer's process. The Treasury Department's OFAC advisory on ransomware payments says the U.S. government strongly discourages private companies and citizens from paying ransom or extortion demands.

The federal StopRansomware guidance from CISA, the Cybersecurity and Infrastructure Security Agency, is worth reading in a quiet week rather than a loud one. Doing it alone can create problems that no policy addresses, so treat the demand as a legal event with a process and let the first reply come from the people the policy provides.

4. Notifying people before you know what to notify. Who must be told after an incident, and how quickly, is set by state law and depends on whose data was involved and where they live. Telling everyone immediately feels responsible and can be wrong in both directions.

Specialist counsel on the panel exists to work this out, and your state attorney general publishes the notification requirement that applies where you are. If the incident also touches customer contracts, the boundary with your liability program sits in the general liability guide.

At renewal

5. Losing the retroactive date. On a claims-made policy the retroactive date decides how far back the cover reaches. Intrusions are commonly discovered long after they began, so a cheaper policy with a later date quietly excludes the period in which an unknown problem probably started.

If you move, have the new insurer match the expiring date in writing before binding. The renewal mistakes list covers renewal errors in general, and it is worth a read before any switch is agreed.

Who decides each call

Each call has an owner, and the mistakes above are mostly a call made by the wrong person at the wrong time. Write the owners into the incident plan before an incident, and keep the hotline somewhere that survives the incident itself.

None of these is a failure of security. They are failures of sequence and of reading, and the overview of the line explains why the consent provision and the sub-limit table make sequence matter so much.

Common questions

We are small. Do the same mistakes apply?

More so. A small business is more likely to have one person answering the application, no incident plan, and a funds transfer fraud exposure larger than anything else on the policy.

Is there any mistake that cannot be fixed later?

The first-hour ones are the hardest to undo, because costs already incurred without consent are already incurred. Changes and renewal terms can be corrected by telling the broker before a claim exists.

Should we notify everyone straight away to be safe?

Not necessarily. Notification is set by state law and depends on whose data was involved and where they live, and telling everyone at once can be wrong in both directions.

Who decides whether a mistake affected the claim?

The insurer takes a position under the wording. If you disagree, a lawyer in your state who reads policies is the person to ask. Your state insurance department handles complaints about the insurer's conduct, not the meaning of the contract.