The first cover to respond in a cyber loss is not the one reimbursing a loss, it is the one paying people to come and work. Response costs cover technical investigation, legal advice, notification logistics, crisis communications, and sometimes monitoring offered to affected individuals. They are consumed in the hours following discovery, before anyone knows what has been lost, and that precedence is what makes them structural: how well they are spent decides the duration of the interruption and the extent of the liability, that is, the other two parts of the loss.
One must first understand why the insurer imposes a panel of providers and why the insured goes around it. The insurer has negotiated rates, knows the quality of the teams, and has organized the legal chain protecting investigation reports. The insured, for its part, calls at three in the morning the provider it knows, the one that has run its systems for six years, because that is the human and professional reflex. That reflex is expensive: most policies reimburse off-panel providers only after prior consent, sometimes at panel rates, sometimes not at all, and consent is not given retroactively.
The question of legal privilege deserves to be raised early, as it is poorly understood outside law firms. An investigation report commissioned directly by the company is a company document: it can be sought in later civil or administrative proceedings, and it will state, with the technical precision that is its virtue, everything that had not been done. The same report commissioned by a lawyer, in preparing the defense, enjoys protection that varies by jurisdiction but exists. That is why the recommended chain puts the lawyer first and the investigator second, and it is a decision taken in the first two hours or never.
Then comes the consumption mechanics, which surprise finance departments. Response costs almost always carry a sub-limit, that is, a ceiling below the policy's, and sometimes sub-sub-limits by category: so much for investigation, so much for communications, so much for individual monitoring. Those ceilings are read before the loss because they meet real orders of magnitude: a serious investigation of a mid-sized information system runs into hundreds of thousands of euros, and notifying several tens of thousands of people has a low unit cost and a considerable total.
A distinction contracts handle badly must be added, and it decides allocation: the line between repairing and improving. The insurer pays restoration, not modernization. Yet a company whose servers were encrypted never rebuilds them identically: it takes the opportunity to segment its network, change its backup, impose an authentication it had deferred for two years. Those expenses are legitimate and they are not covered. Separating the two as the rebuild proceeds, rather than at claim time, is what avoids a painful argument over a lump-sum invoice.
One timing point deserves attention because it resembles nothing else in insurance. Here, speed of notification is not a contractual formality but a cost driver: every hour between discovery and intervention increases the extent of encryption, the volume exfiltrated and the length of the interruption. An insurer insisting on an emergency number to be called immediately is not merely protecting its procedure, it is protecting the final amount. It is the one case where the insured's interest and the insurer's coincide perfectly, and it should be said to technical teams that experience the call as administrative friction.
The discipline comes to three decisions prepared in the cold, because none is taken well at three in the morning. Know who calls, in what order, on what number, and have it written on a document that does not live on the encrypted network. Know whether the usual providers are on the insurer's panel, and if not, have asked for their listing before the loss rather than consent during it. And know that the first person called is the lawyer, not the IT engineer, not because law matters more than technique but because the order decides what the technical report will become.
A 400-person services company discovers at 6 a.m. on a Friday that its file servers and management system are encrypted. The IT director calls its usual managed services provider at 6.20 a.m., which sends two engineers and begins restoring. At 11 a.m., he commissions an investigation report from a specialist firm, in the company's name. The insurer is told only on Monday at 9 a.m. The policy provides a response cost sub-limit of 250,000 euros, a panel of approved providers including neither the managed services provider nor the firm, and prior consent for any off-panel provider. Where do things stand?
Three decisions were taken in five hours and each costs something, though none is unreasonable taken alone. Calling the usual provider is the normal reflex, and it is off-panel: costs incurred from Friday to Monday will be reimbursed only after consent, which is not given retroactively, and at best at panel rates. The loss counts in engineer-days and will be argued over at length. The late notification is graver than it looks: it is not first a matter of contractual deadline but of cost, every hour between discovery and the intervention of a practiced team increasing the extent of encryption and the length of the interruption, hence the other two parts of the loss. But the heaviest decision is the 11 a.m. one, and nobody saw it as such: the investigation report was commissioned by the company in its own name, not by a lawyer. That technical document, which will state precisely what had not been done, will be a company document, disclosable in later civil or administrative proceedings. That is irreversible, and it was what had to be decided in the first two hours. What remains to be done comes to two steps: seek the insurer's consent on the providers in place and on what follows, documenting it, and have legal counsel take over the investigation chain for what has not yet been produced.
- 01Response costs are consumed before anyone knows what is lost, and how well they are spent decides interruption length and liability extent.
- 02An off-panel provider is reimbursed only after prior consent, and consent is not given retroactively.
- 03The order of calls decides the technical report's fate: commissioned by the company it is disclosable against it, commissioned by a lawyer it may be protected.
- 04The insurer pays restoration, not modernization: separate the two as the rebuild proceeds, never on a lump-sum invoice.
- 05Here speed is not a formality but a cost driver, and it is the one item where the insured's and the insurer's interests coincide perfectly.