The five preceding lessons have given a notion, a history, a reading method, four lines not to forget and a marine case. What remains is to turn them into a usable object, and that object is a table. It almost never exists, and that is what makes this lesson the most profitable of the course: most companies, including large ones, know their cyber policy, know their property policy, and have never set the two on the same page with cyber as a column.
The table is built one line per contract, and five columns are enough. The contract and its insurer. The position on cyber, which is one of four possible values: affirmative, plain exclusion, exclusion with write-back, silence. What the position leaves out, in one sentence and not as a quoted clause. The amount at stake, limit or sub-limit. And the date the clause was last redrafted, the column nobody fills in and that nonetheless explains half the surprises.
Once the table is filled, it is not read line by line, one looks in it for three shapes. The first is the hole: a feared scenario that neither the cyber policy nor any other takes, because the cyber policy is too small and the others carry a plain exclusion or a trigger the scenario does not cross. It is the commonest and costliest shape, and it shows only by crossing the lines, never by reading one contract alone.
The second shape is the double, where two policies answer for the same loss. Contrary to intuition this is not good news: two insurers owing the same amount argue, and the insured waits. The double is handled by an order-of-settlement clause saying which responds first, and that clause costs less than an extension. The third shape is the dependency, where cover on one line is conditioned by the characterization reached on another, for instance a write-back conditioned on a fire that only the property adjuster can record.
One must then know what to do with the silences the table reveals, and the natural reflex is the wrong one. The natural reflex is to ask for an exclusion everywhere, so that everything is tidy. That turns an uncertainty into a certain absence of cover, and costs the insured whatever chances the silence left it. The useful request is different and is put like this: let the insurer write down its position, whatever it is. A written exclusion beats a silence, a write-back beats an exclusion, and knowing beats all three.
This work has a side effect reaching beyond insurance, worth announcing because it helps get it funded. Filling the column for what the position leaves out forces the company's feared scenarios to be named, which few organizations have done in writing. The table then becomes a board document rather than an insurance document: it says, line by line, what the company has decided to carry itself, and that decision already existed without ever having been taken by anyone.
It remains to say how often the table is redone, because a table dated three years ago is worse than no table: it gives false assurance. It is redone at each renewal for the line concerned, and in full when one of three events occurs: an acquisition, which adds entities and local contracts; a change of insurer on an important line, which often changes the clause with nobody flagging it; and the placing or increase of an affirmative cyber policy, which moves the holes and doubles of everything else in the program.
A temperature-controlled logistics company, 700 employees, four warehouses, draws up its program table for the first time. It shows the following. Affirmative cyber policy, 4 million euros, placed in 2025. Property and business interruption policy, 55 million, cyber exclusion with write-back for physical damage consequent on fire, clause of 2022. General liability policy, 10 million, no mention of cyber, wording of 2014. Crime policy, 2 million, no mention of cyber, wording of 2019. Cargo policy, 3 million per event, plain cyber exclusion of 2023. Management's feared scenario is a four-day stoppage of the refrigeration control system, causing loss of stored goods worth 6.5 million euros and customer claims of 4 million. What does the table say?
The table says three things that reading any single contract could not, and the first is a hole. On the 6.5 million of lost goods, one must first observe that the stored goods belong not to the company but to its customers, which moves the question from the property policy towards liability. On the property side, the 2022 write-back is conditioned on fire and the scenario involves none: whatever the write-back does not cite stays excluded, so the 55 million does not respond. On the affirmative cyber side, the 4 million responds but covers less than the goods loss alone, before any customer claims. The hole is therefore established and it runs to some 6.5 million on a scenario management itself named as its most feared. The second shape is a dependency, and it is the file's most interesting: the 4 million of customer claims looks to the 2014 general liability policy, which is silent, and the fate of that share will depend on the characterization reached elsewhere, notably whether spoiling of refrigerated goods belonging to third parties is treated as physical damage. A silent 10 million policy is here an opportunity rather than a defect, and asking for its exclusion would be exactly the opposite of the step to take. The third observation bears on the dates, the column nobody fills in: 2014 for liability, 2019 for crime, whereas the cyber policy was placed in 2025. The program's holes and doubles were therefore moved by that recent placing without the two oldest lines being reread. Three steps follow. Take the cyber policy's limit to market, which is the real subject and not the property policy. Ask the liability insurer to write down its position on cyber, without asking for an exclusion. And redo the table at the next renewal of the liability line, since the program changed shape in 2025 and two contracts still do not know it.
- 01One line per contract, five columns, and the column nobody fills in is the date the clause was last redrafted.
- 02This table is not read line by line: one looks in it for a hole, a double, and a dependency.
- 03The double is not good news: two insurers owing the same amount argue, and an order-of-settlement clause costs less than an extension.
- 04Asking for an exclusion everywhere turns an uncertainty into a certain absence of cover: the useful request is that the insurer write down its position.
- 05The table is redone in full on three events: an acquisition, a change of insurer on an important line, and the placing of an affirmative cyber policy.