Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. A board wants to pay to prevent publication of the exfiltrated data. What must be said before even discussing the amount?
That the data is already out and no mechanism obliges an attacker to destroy it: paying to prevent a leak buys a promise that does not exist, while paying to shorten an interruption buys something real but imperfect
The motive decides everything, because it determines whether anything is being bought at all. The answer on unlawfulness is legally right and factually inert: a prohibition does not stop publication by an actor out of reach. The one limiting cover to restoring access invents a purpose condition policies do not set, and it loses the essential: what is missing is not the cover, it is the consideration. The one wanting the exact volume first keeps a requirement reasonable elsewhere and puts it in the worst place, since it would delay by weeks a decision the interruption makes urgent, and a better known volume would not make the promise more reliable.
Glossary entry · double-extorsion2. How does the module make a ransom demand and a rebuild from backups comparable?
By converting the difference in duration into business interruption: weeks of rebuilding at a given margin represent an amount set against the sum demanded
The calculation is cold and not sufficient, but having done it is what separates a decision from a reaction: without it, fear decides. The answer relating the ransom to the full cost of the incident produces a ratio always favorable to paying, since the denominator contains items the payment does not reduce. The one comparing it to the sub-limit confuses a capacity with a value: what insurance can reimburse says nothing about what the thing is worth. The one applying a probability discount looks rigorous and mistakes its object: uncertainty about the key does not reduce the price demanded, it reduces what is obtained, so it bears on the expected benefit and not on the amount.
Glossary entry · perte-exploitation3. An insured pays then notifies. What was prior agreement protecting, and why is the step unrecoverable?
The insurer cannot verify after the fact what it would have verified before, the reasonableness of the amount, the reality of the threat, the compliance of the recipient: the cover becomes a contested claim on spending that can no longer be undone
This is not ill will: some checks exist only beforehand, and the irreversibility of the spending does the rest. The answer on limitation invokes a real and unrelated mechanism, prior agreement being nothing like an interrupting act. The one limiting agreement to the negotiator's fees narrows a condition that bears on the payment itself. The one invoking subrogation names an effect that interests the insurer and stays theoretical here, recovery against perpetrators out of reach being worth little; above all it moves the reason toward the loss of an insurer's right when it rests on the physical impossibility of verifying.
Glossary entry · bonne-foi4. The module compares the prohibited payment to something the certification has already seen elsewhere. To what, and how is the parallel exact?
To the covered but unpayable loss: the cover responds, the spending is legitimate, and the transfer is prohibited. That is why verifying the recipient is a precondition and not a formality
What is distinctive here is that nothing is excluded or forfeited: the cover is in force and the transfer remains prohibited, which is very different from an exclusion. The answer on the war exclusion describes exactly the mechanism this case IS NOT, and that is the confusion the parallel serves to dispel: an exclusion removes from scope, an impediment leaves the cover intact and blocks payment. The one on the time deductible keeps the shared nuisance, urgency frustrated, and misses the nature of the block. The one on failure to notify imputes a lapse to the insured where there is none: the prohibition applies whatever its diligence.
Glossary entry · ofac-sanctions-cyber5. What is a negotiator's actual work, and what value does it produce independently of the amount obtained?
They open a channel, check the counterpart truly holds the key, test decryption on a sample, and SLOW a conversation the attacker wants fast: that slowing lets restoration advance, so the calculation change
Slowing is not a side effect of the negotiation, it is one of its products: each day gained advances restoration and lowers the value of what is being bought. The answer on a discount describes what the word negotiator suggests and reduces the role to a price discussion. The one making them a substitute for the director runs into the module's central point, the decision belongs to the company and to nobody else, and it promises a personal protection no mandate provides. The one having them certify sanctions compliance entrusts to a provider a check conducted by specialists in that field and which remains a separate precondition.
Glossary entry · declaration-de-risque