Renewing a cyber insurance policy for a large manufacturing company can appear to be a deceptively simple exercise. A broker runs the market, the premium comes back lower or higher, and the decision on the executive’s desk looks like a number to accept or push back on.
This renewal outcome kept the limit, cut the retention substantially and added the company’s own incident response partner to the policy, with no retention for the first 72 hours. The market was cutting the premium by roughly a third anyway, and the changes cost a few percent on top of an as-is renewal.
The decision
Security owned the domain and the process, and the broker negotiated with the insurers. I built the decision material and made the recommendation together with the sourcing team, consulting the CISO, CFO and CIO along the way.
The decision was to keep the limit, cut the retention substantially, and add the company’s own preferred incident response partner to the policy as a designated responder. The first-response provision, no retention for the first 72 hours above a small threshold, was the insurer’s offer. Our ask was to use the company’s own partner inside it. On the next incident, the team that already knows the environment starts on the insurer’s account rather than after a negotiation. The threshold was the answer to the insurer’s concern that the provision would be used for everyday incidents. It is set low enough that the partner is covered from the first serious case, and high enough that the insurer isn’t paying for every phishing email. The price of all of it was a few percent on top of the as-is renewal.
The insurer sold the retention cut at a few percent, added the response partner at agreed rates, and included a set of cover improvements. It refused to pair the lower retention with a larger share of the programme. Preventative services came inside the premium, tabletop exercises and risk assessments among them. They are a second opinion on the roadmap from someone with money on the outcome.
Two rules make the first-response provision usable. The insurer is notified of every incident regardless of size, and raising a claim is limited to named roles.
Measured against the incidents the company has had, the new terms would have paid the response and forensics cost from the first serious case.
What was set aside, and what it would have cost
Cancelling would have saved the whole premium. The company’s own loss bands put a medium incident alone at several times that premium. The saving was real, and the exposure it bought was larger than the saving, so it was set aside.
Changing the limit was set aside in both directions. A lower limit was priced at about a quarter of the premium. The exposure bands argued against cutting cover, and the saving was set aside. A higher limit was struck out before it was quoted, after consulting executives. The same money spent on control maturity has a better payback than a layer of cover the company would likely never reach.
The alternative that initially looks attractive was to keep the limit, bank the market saving and raise the retention on top. Doubling or quadrupling the retention saved between a tenth and a quarter of the primary premium. The break-even on that saving worked out at the better part of a century. What is easy to miss is that if you double the deductible you don’t get any of that money back on a bad day. You’ve sold cover for a discount and kept the risk. The chosen route cost a few percent instead of saving a tenth to a quarter. That spread is the price of a policy that responds to the incidents the company has rather than the ones it hopes never to have.
The fourth alternative was one I tabled as an alternative spend option: take the market saving, with or without a lower limit, and ring-fence part of it for maturity work, monitoring and response capability that had been asked for before and not funded. The premium saved would then become a control rather than a line in a cost report. It was discarded after consulting the same executives, on the trade-off. The saving would have bought a fraction of the maturity programme, too little to move the company’s risk position, whereas a few percent of it spent on the retention cut and the response provision changed what the policy does on the next incident. And a saving that isn’t ring-fenced at the point of decision is a cost saving and nothing else.
The problem and the constraints
Cyber insurance primarily provides financial relief when a major cyber incident occurs, typically covering in part the response and forensic costs, business interruption and the increased cost of working, restoration of data and systems, extortion payments where lawful, and third-party liability and regulatory costs. It doesn’t reduce the probability of the incident on its own. Below the retention and above the limit, the company carries the loss itself.
At executive level a policy provides two things. The first is reasonable cover for the year the company can’t absorb on its own. The second is a defensible position afterwards: the company had cyber insurance.
The question that mattered was whether the policy gives the company anything beyond those two things, and whether the smaller incidents could ever be claimed. The standard answer, that a policy at this limit exists for the events at many times the retention and that business impact rather than IT cost is what gets you there, was true and incomplete. It is where the retention cut started. Every incident the organisation had had landed below the retention, and nobody could say by how much, since incident cost was estimated afterwards by the people involved rather than collected as it happened. In my experience organisations that count anything count the response cost, the hours and the external invoices, however the business impact is typically not collected, since what a stoppage cost is knowledge the business side holds and nobody asks for it while the incident is running. A policy that has never been tested is an assumption with a premium attached.
The constraints pulled in different directions. The market was soft, so a saving was coming whatever we did. The company was under cost pressure at the same time, so not renewing at all was on the table. The executive expectation was a risk-based answer, where the company could take more risk and where less, rather than maximum cover. The broker’s own quantification gave no case for a lower limit.
The learning for the next renewal
The learning for the next renewal is to collect business loss data systematically while an incident runs, the response hours and the external invoices from the response side and the stoppage cost from the business side, so that the retention is argued on what incidents have cost rather than on what people remember them costing. Without that record the retention is a bet on incident size. With it, the question of whether the smaller incidents could ever be claimed answers itself.
One check for your own policy is whether the cost of your last incident exists as a record or as an estimate made afterwards. If it is an estimate, the renewal conversation starts there, not at the premium.
Three more checks before binding. Whether the premium is allocated to the entities the policy protects, because a group policy pays the parent, and without that allocation a payout for a subsidiary’s loss can lose a third to tax. When the first-response clock starts, from the first war room or from partner hours consumed, because that is a contract term and not a courtesy. Whether every responder you would call is named on the policy with its rates, because the list closes at binding and stays closed for the year.
Related work
- You can outsource the work, but never the accountability on the Btec case, where the contract rather than the security posture decided what the breach was worth.
- Your recovery targets are probably right on recovery cost, which is the bulk of any loss and the part a policy pays.