Biggest Cyber Insurance Mistakes To Avoid

Cyber insurance expert Joseph Brunsman joins Cyber Crime Junkies to outline its structure, pitfalls, and evolving rules. Drawing from his books Damage Control and Open Before Crisis, as well as cases like Travelers vs. ICS and Uber's breaches, he explains how businesses often mishandle policies, leading to denied claims and massive costs. Emphasis falls on prevention over reliance on coverage, given rising cyber threats like ransomware and wire fraud.

Core Components of Cyber Insurance

Cyber insurance splits into two sides: third-party claims (liability, such as class actions from data breaches or regulatory fines from bodies like HHS-OCR, FTC, or state attorneys general) and first-party claims (business recovery after events). First-party covers four buckets: data breaches or cyber events (access and theft of PII, PHI, PCI, or confidential info); ransomware (restoration, negotiation, payments—though often excluded); loss of funds (wire fraud, social engineering, invoice manipulation, with policy-specific definitions and sublimits like $100,000 caps); and miscellaneous (reputational harm, bricking, crypto-jacking—useful only if relevant). Coverage overlaps buckets, but terms like "social engineering" vary by policy, not statute, demanding close reading. Unlike standardized auto policies, cyber policies lack case law, making outcomes unpredictable; regulatory fines are