Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. A director calls the insurer the morning of discovery and asks to open a file to assess the loss. The step is correct in property insurance. Why is it expensive here?
Because in cyber the first two days DETERMINE the loss instead of recording it: extent of encryption, volume taken, length of interruption. Asking to assess assumes an amount already fixed, when it is still forming
In property insurance, the insured suffers then claims, and the time between the two barely moves the amount. In cyber, time IS the amount. The three other answers are classical insurance reflexes carried over unchanged: the form of notification, the criminal complaint, the adjuster's role. None is absurd, and that is what makes them worth ruling out. The first shifts the subject onto a formality when what is at stake is a cost. The second invents a condition that does not exist. The third describes a real caution about estimating, but it is beside the point while the loss is still growing: what had to be avoided that morning was not the estimate, it was the wait.
Glossary entry · police-stand-alone2. Among the four covers, which one alone has the property that using it well shrinks the other three, and by what route?
Response costs: a practiced team on site at six in the morning shortens the interruption, limits exfiltration, and so bounds the future liability
Response costs act BEFORE anyone knows what was lost, and that precedence is what gives them their effect on the rest. The three other covers pay a consequence already formed. The one naming business interruption confuses an indemnity with working capital: it settles long after the rebuild and does not fund it. The one naming extortion repeats the argument directors make under pressure, and the module dismantles it elsewhere: the key works poorly and the data is already out, so the payment does not buy what people think. The one naming liability describes the opposite of its calendar: it is a long tail item, and rushing to settle it is precisely what to avoid.
Glossary entry · perte-exploitation3. What distinguishes the calendar of third party liability from that of the first two covers, and what conduct does it impose?
It is a long tail item grafted onto an instantaneous event: claims arrive over years, and the urge to settle it fast to close the file must be resisted
A one day event produces claims over years, before different courts, brought by people who do not know each other. It is the only one of the four covers whose exact measure does not exist at the time of the loss. The answer running the exposure from notification gives a regulatory step an effect on third party rights that it does not have, and it is dangerous because it suggests delaying a notification to buy time. The one bounding it by the indemnity period borrows from business interruption a mechanism that holds only there. The one starting it after response costs are exhausted describes a clean succession that is false: the four covers run in parallel, they do not hand over to each other.
Glossary entry · rc-pro4. How does extortion cover differ from the other three as to the insurer's role?
It is the only one where the policy decides nothing: paying is the company's decision, which insurance reimburses under conditions rather than steers
Nobody but the director can weigh the survival of the business against what the payment funds, which is why the split holds: the policy frames a decision it does not take. The answer on prior agreement keeps a real condition of this cover and makes it the distinguishing feature, when other covers carry one too and the agreement says nothing about WHO decides. The one making the negotiator a substitute describes their work poorly: they open a channel, check the counterpart holds the key, test decryption on a sample, and slow a conversation the attacker wants fast. The one imagining a direct payment invents a route and misses the point: the subject is not where the money goes, it is who carries the decision to commit it.
Glossary entry · double-extorsion5. An insured reports "my cyber claim". What does that sentence fail to say, and why is the gap measurable?
Which of the four covers is being called: they pay neither the same things, nor the same people, nor at the same time, and the order they are called in determines the final amount
Four covers housed in one contract and triggered by one event do not form a single cover, and naming the event says nothing about which one is being called. The three other answers name information that will all have to be produced, which is what makes them plausible: amount, cause and date are genuine questions in this file. None is the question of the first morning. The amount does not yet exist and cannot guide action. The technical cause will come out of an investigation that has not started. The date will be documented from logs, some of them encrypted. What is decided at that instant, and only then, is which cover is woken first.
Glossary entry · principe-indemnitaire