Cyber Insurance Claims: What to Prepare Before You Need Your Policy

October is Cybersecurity Awareness Month, and this month IT Weapons is focused on a question many Canadian organizations only ask after an incident: what does it take to use your cyber insurance when you need it? We brought together a claims leader from Trisura, a security awareness specialist from Beauceron Security and our own Manager of Compliance to examine it from three angles. Their conclusions point to three practices: understand the claims process in advance, treat your people as part of your defence, and keep your controls current between renewals. This post summarizes what they shared and the steps you can take now.

Prefer to begin with a specific topic? Use the timestamps below:

• 3mins: Why people still click, and what insurers look for (Chris McGinn, Beauceron Security)

• 19mins: How a cyber claim works, from first notice to resolution (Ryan O'Leary, Trisura)

• 33mins: Keeping controls current between renewals (Scott Anderson, IT Weapons)

• 52mins: Q&A

Know the claims process before you need it

A cyber claim moves quickly, and the decisions made in the first days often shape the outcome. Ryan O'Leary, Vice President and Technical Lead, Specialty Insurance Claims at Trisura, has spent ten years guiding complex claims. His advice is to learn a small number of principles in advance, rather than the entire process, so that you can act with confidence when an incident occurs.

Cyber policies cover two kinds of cost. First-party coverage reimburses your own expenses, such as forensic investigation, restoration, notification, legal fees and business interruption. Third-party coverage responds to claims made against you by customers, vendors, individuals or regulators. On the first-party side, three practices matter most:

• Notify your insurer promptly. Notice is often a condition of coverage, and deadlines vary by policy, with 15 days being common. It does not need to be a complete report. Early notice allows your insurer to involve its response vendors, and you can supply details as they become known.
• Obtain consent before incurring costs. Most policies require the insurer to approve expenses in advance, typically by naming the vendor and the scope of work. Consent is not a coverage determination, which follows the proof of loss, but it prevents disputes later.
• Document as you go. The claim is the insured's to prove. Records of expenses and decisions, kept as the incident unfolds, allow reimbursement to proceed more quickly.

A typical response brings together the insurer's claims team, breach counsel to direct the response and protect privilege, forensic specialists, and vendors for restoration, negotiation and notification. Confirm now how your policy requires a claim to be reported, whether through a claims line, a claims email or your broker, and record those details in your incident response plan.

Security awareness is part of the claims conversation

Chris McGinn, Director of Channel Sales at Beauceron Security, examined the part of cyber risk that is hardest to capture on an application form: human behaviour. He shared that phishing written with AI assistance achieved a 54% click rate, compared with 12% for phishing written by humans. Attackers can now personalize messages at scale, although the underlying technique remains social engineering.

Beauceron's data points to habit, not carelessness. Almost 40% of clicks came from people who were rushing or did not remember clicking. New hires are the most exposed, clicking at about 6.8% in their first six months compared with 3.7% for employees with five or more years of tenure, so annual training alone can leave new staff unsupported for months.

Insurers are adjusting accordingly. Applications once asked simply whether security awareness training was in place. Increasingly, they ask how often it runs and what the results show. A trend of improving click and report rates is a stronger response than a yes. Chris recommended building an evidence file that includes:

• Training completion by person and date, including new hires
• Click and report rates over time, and what happens after a click
• Follow-up with repeat clickers and higher-risk departments
• Role-specific training, such as payment verification for finance teams

Program design matters as well. Beauceron's data supports short, spaced lessons totalling 40 to 60 minutes a year over long annual sessions. It also supports a no-blame approach: people who fear consequences are half as likely to report a mistake, which makes recognizing good reporting more effective than penalizing clicks.

Keep your controls current between renewals

An insurance application records the state of your environment on a single day. After an incident, the full timeline can be reviewed, so controls need to remain effective and provable well beyond renewal. Scott Anderson, Manager of Compliance at IT Weapons, framed this with an analogy from his years as a skydiver. A jumper can inspect the main parachute before every jump, but the reserve is packed away and depends on a rigger's inspection and a signed card. In the same way, a security control is the reserve, its validation is the inspection, and the evidence is the packing card.

Controls drift without anyone intending it. In Scott's example, multi-factor authentication was confirmed for all remote access at renewal. A vendor project later required a temporary exception that was never closed, and months afterwards a compromised account turned out not to have MFA. Temporary exceptions become permanent unless someone owns them.

Scott recommended a simple register for each critical control that records what it covers, who owns it, when it was last checked and what evidence exists. Five areas merit regular revalidation:

• Identity: MFA coverage everywhere, privileged accounts, permissions that have grown over time, and accounts left open after someone leaves
• Endpoints: compare your security tool's reporting against your device inventory to identify missing agents
• Vulnerabilities: prioritize internet-facing systems and flaws already being exploited
• Recovery: back up everything in scope, test restores, and keep immutable copies, ideally one offline
• Response: keep incident response plans and contacts current, and confirm when they were last exercised

Working through a plan, do, check, act cycle across the year turns renewal into a review of evidence already in hand, rather than a last-minute search for screenshots. An IT provider cannot guarantee eligibility or payment, and the risk remains yours, but it can contribute technical expertise, operating discipline and records to help keep controls current.

Steps to take now

• Confirm your policy's reporting requirements. Note how to report a claim and the notice deadline, and add both to your incident response plan.
• Select five to ten answers from your insurance questionnaire. For each, record the owner, the date it was last verified, any exceptions and the evidence you could produce today. Scott called this a "packing card."
• Verify three core controls first: multi-factor authentication, endpoint detection and response, and backups. Together they cover identity, detection and response, and recovery.
• Review your training cadence. Confirm that training and phishing simulations run on a regular schedule and that new hires are enrolled automatically.
• Begin an evidence file. Keep training records, click and report trends, and notes on follow-up in one place.

Discuss your situation with our team

The full discussion is in the video at the top of this page.

Every organization's policy, environment and renewal date are different. If you would like to discuss where you stand, such as what your policy requires, which controls to confirm first or how to begin an evidence file, our team at IT Weapons can set aside time with you. No preparation is needed. Book a meeting with our team at here. If you prefer to write first, email info@itweapons.com or use the Contact Us form on our website, and we will respond right away.

Statistics and findings in this post were shared by the speakers during the session, and the sources are the speakers' own. This post is educational and is not legal, insurance or compliance advice. Check your own policy for its notice, consent and eligibility requirements.