October is Cybersecurity Awareness Month, and this month IT Weapons is focused on a question many Canadian organizations only ask after an incident: what does it take to use your cyber insurance when you need it? We brought together a claims leader from Trisura, a security awareness specialist from Beauceron Security and our own Manager of Compliance to examine it from three angles. Their conclusions point to three practices: understand the claims process in advance, treat your people as part of your defence, and keep your controls current between renewals. This post summarizes what they shared and the steps you can take now.
Prefer to begin with a specific topic? Use the timestamps below:
3mins: Why people still click, and what insurers look for (Chris McGinn, Beauceron Security)
19mins: How a cyber claim works, from first notice to resolution (Ryan O'Leary, Trisura)
33mins: Keeping controls current between renewals (Scott Anderson, IT Weapons)
52mins: Q&A
Know the claims process before you need it
A cyber claim moves quickly, and the decisions made in the first days often shape the outcome. Ryan O'Leary, Vice President and Technical Lead, Specialty Insurance Claims at Trisura, has spent ten years guiding complex claims. His advice is to learn a small number of principles in advance, rather than the entire process, so that you can act with confidence when an incident occurs.
Cyber policies cover two kinds of cost. First-party coverage reimburses your own expenses, such as forensic investigation, restoration, notification, legal fees and business interruption. Third-party coverage responds to claims made against you by customers, vendors, individuals or regulators. On the first-party side, three practices matter most:
A typical response brings together the insurer's claims team, breach counsel to direct the response and protect privilege, forensic specialists, and vendors for restoration, negotiation and notification. Confirm now how your policy requires a claim to be reported, whether through a claims line, a claims email or your broker, and record those details in your incident response plan.
Security awareness is part of the claims conversation
Chris McGinn, Director of Channel Sales at Beauceron Security, examined the part of cyber risk that is hardest to capture on an application form: human behaviour. He shared that phishing written with AI assistance achieved a 54% click rate, compared with 12% for phishing written by humans. Attackers can now personalize messages at scale, although the underlying technique remains social engineering.
Beauceron's data points to habit, not carelessness. Almost 40% of clicks came from people who were rushing or did not remember clicking. New hires are the most exposed, clicking at about 6.8% in their first six months compared with 3.7% for employees with five or more years of tenure, so annual training alone can leave new staff unsupported for months.
Insurers are adjusting accordingly. Applications once asked simply whether security awareness training was in place. Increasingly, they ask how often it runs and what the results show. A trend of improving click and report rates is a stronger response than a yes. Chris recommended building an evidence file that includes:
Program design matters as well. Beauceron's data supports short, spaced lessons totalling 40 to 60 minutes a year over long annual sessions. It also supports a no-blame approach: people who fear consequences are half as likely to report a mistake, which makes recognizing good reporting more effective than penalizing clicks.
Keep your controls current between renewals
An insurance application records the state of your environment on a single day. After an incident, the full timeline can be reviewed, so controls need to remain effective and provable well beyond renewal. Scott Anderson, Manager of Compliance at IT Weapons, framed this with an analogy from his years as a skydiver. A jumper can inspect the main parachute before every jump, but the reserve is packed away and depends on a rigger's inspection and a signed card. In the same way, a security control is the reserve, its validation is the inspection, and the evidence is the packing card.
Controls drift without anyone intending it. In Scott's example, multi-factor authentication was confirmed for all remote access at renewal. A vendor project later required a temporary exception that was never closed, and months afterwards a compromised account turned out not to have MFA. Temporary exceptions become permanent unless someone owns them.
Scott recommended a simple register for each critical control that records what it covers, who owns it, when it was last checked and what evidence exists. Five areas merit regular revalidation:
Working through a plan, do, check, act cycle across the year turns renewal into a review of evidence already in hand, rather than a last-minute search for screenshots. An IT provider cannot guarantee eligibility or payment, and the risk remains yours, but it can contribute technical expertise, operating discipline and records to help keep controls current.
Steps to take now
Discuss your situation with our team
The full discussion is in the video at the top of this page.
Every organization's policy, environment and renewal date are different. If you would like to discuss where you stand, such as what your policy requires, which controls to confirm first or how to begin an evidence file, our team at IT Weapons can set aside time with you. No preparation is needed. Book a meeting with our team at here. If you prefer to write first, email info@itweapons.com or use the Contact Us form on our website, and we will respond right away.
Statistics and findings in this post were shared by the speakers during the session, and the sources are the speakers' own. This post is educational and is not legal, insurance or compliance advice. Check your own policy for its notice, consent and eligibility requirements.