Working with your cyber insurer after an incident

Before calling vendors, find the policy (or ask your broker for it) and read three things: how and how quickly you must give notice, whether the insurer must consent before you incur costs, and whether the insurer runs an incident hotline you are expected to use. Policies differ widely, and the wording, not general practice, decides what is covered.

Late notice and costs incurred without consent are two of the most common reasons claims get complicated. If you are unsure, give notice early; you can usually provide details as they become known.

1. 01

   Give notice

   Use the method the policy specifies, and record the date, time and reference number.

2. 02

   Copy your broker

   Brokers can help you understand the policy and deal with the insurer.

3. 03

   Ask what needs consent

   Forensics, legal counsel, notification costs, public relations and, especially, any ransom payment often require the insurer's prior consent.

4. 04

   Ask about counsel

   Many policies expect or offer breach counsel. Counsel-directed investigation can matter for how reports are handled; that is a legal question for counsel.

Some policies require you to use vendors the insurer has approved, some allow any reasonable vendor with consent, and some pay a lower amount for vendors outside a list. Check before you engage anyone, including us. If you already have a forensic or IT provider you trust, ask the insurer whether they can be approved for this claim, and provide whatever information the insurer asks for.

Whichever vendor is used, make sure they understand that the work may be relied on by an insurer, by counsel and possibly by a court, and that evidence must be preserved accordingly.

Insurers need to understand what happened, what it cost, and whether the loss is covered. NIST SP 800-61 Rev. 3 (2025) emphasizes documenting the incident throughout the response; that documentation is what supports the claim. Expect to provide:

The pressure to get running again is enormous, and some rebuilding cannot wait. But wiping systems before forensic images are taken can make it impossible to establish root cause, scope or whether data was stolen. It can also leave gaps in the claim and in your own legal position.

A good responder can usually preserve key evidence in hours, in parallel with containment, following ISO/IEC 27037 practice for collection and preservation. Ask for that explicitly.

Insurers and counsel usually need some facts early, for example whether personal information is involved, before a full investigation is complete. Expect a preliminary briefing or memo first, clearly labelled as subject to change, and a final report later with the evidence for each finding and its limitations.

Make sure everyone understands the difference. A preliminary 'no evidence of exfiltration so far' is not a final conclusion, and decisions made on it should be revisited when the final report arrives.

See also our page on forensics for breach counsel and insurers.

• Every vendor engaged, with date of engagement and whether insurer consent was obtained
• Internal staff overtime and hours diverted to the incident
• Hardware and software bought to recover
• Lost revenue and extra expenses during downtime, with how they were calculated
• Notification, call centre and credit monitoring costs, if any
• Legal and public relations fees
• A single cost log kept by one person, with receipts attached

• Giving notice late, or only after costs have been incurred
• Paying a ransom, or engaging a negotiator, without insurer consent
• Destroying evidence while restoring systems
• Inconsistencies between the incident facts and the security controls described in the application
• Assuming a vendor is approved because someone said so, without confirming
• Treating preliminary findings as final