DUAL Underwriting Perspectives: The cyber controls that matter most, and what claims tell us

Jamie Dobbs

Cyber Underwriter

Jamie Dobbs, Cyber Underwriter for DUAL UK provides five areas he believes brokers should be discussing with their clients to help them be prepared for an incident, and to respond to an incident.

Working in cyber insurance, I am often asked which cyber security controls matter most.

It is an understandable question. Businesses face a long and growing list of threats, while new security products and technical terms can make it difficult to know where to focus.

My view is that the fundamentals still make the biggest difference.

That does not mean cyber risk is standing still. Attackers are finding new ways to bypass security controls, access email accounts and exploit trusted relationships. However, many claims still come back to a familiar set of weaknesses.

For brokers, this creates an opportunity to move the conversation beyond whether a client simply has cyber insurance. We should also be asking how prepared that client is to prevent an incident, respond when something goes wrong and recover afterwards.

Here are five areas I believe brokers should be discussing with their clients.

1. MFA is essential, but it is not the finish line

Multi-factor authentication, or MFA, remains one of the most useful controls available and should be enabled wherever possible.

However, MFA alone cannot remove the risk of an account being compromised. Attackers may use phishing, session theft or other methods to obtain access. Businesses therefore need several layers of protection around their accounts, devices and data.

This should include controlling administrative access, keeping software up to date, reviewing unusual account activity and removing access promptly when somebody leaves the organisation.

Claim example: A real claim demonstrates the danger. An attacker gained access to the email account of a partner at a law firm, most likely through a phishing email. The attacker was then able to monitor the account and its high-risk personal and financial information. A later forensic investigation found evidence of a persistent attack lasting between 60 and 70 days. The account contained 88,000 emails and provided access to numerous files. The response, including forensic, legal, credit monitoring and communications support, cost more than £133,000.

2. Third-party risk is often underestimated

Most organisations rely on suppliers, software providers and other partners. Those relationships help businesses operate, but they also create routes through which cyber incidents can spread.

A company can invest heavily in protecting its own systems and still suffer a loss because somebody it trusts has been compromised.

Claim example: In one claim, a travel business arranged payment for a chalet on behalf of a client. Criminals had compromised the chalet owner’s email and intercepted messages between the two parties. They provided replacement bank details, and the payment was sent to the wrong account. Although the insured’s own network had not been breached, the social engineering section of the policy responded. The total payment, including the loss and fees, was £27,000.

This is a useful reminder that businesses should not rely on email alone when payment details change. A simple verification process, using a known telephone number or another trusted channel, can help prevent a fraudulent transfer.

3. Backups only matter if they work

Most businesses I speak to say they have backups. Fewer can say with confidence that they test them regularly and know how quickly they could restore their critical systems.

A backup is not useful simply because it exists. It needs to be protected from the same attack that affects the main network, and the business needs to know that the data can be restored.

This is particularly important where ransomware or another disruptive incident stops normal operations. The ability to restore systems quickly can make a significant difference to the length and cost of an interruption.

4. Cyber security is a business issue, not just an IT issue

A cyber incident can affect operations, revenue, customers, employees and reputation. It can also create legal and regulatory responsibilities.

This means cyber risk cannot sit solely with the IT team. Senior management needs to understand the organisation’s exposure and take part in decisions about preparation and response.

Claim example: One financial services firm was contacted by attackers who claimed to have gained access to its systems and extracted personal information. The attackers had used administrator credentials obtained through a remote access tool and were believed to have accessed servers containing customer and employee data. The response involved forensic specialists, legal advisers, identity protection and communications support. Although no claim payment was recorded for the underlying loss, the response costs and fees came to £285,708.89.

What stands out here is the range of support required. A serious cyber incident is rarely just a technical investigation. It may also require decisions about regulators, affected individuals, communications and reputation.

5. People remain a vital line of defence

Technology is essential, but many incidents still begin with somebody receiving an email, opening a link or responding to a convincing request. That does not mean employees should be blamed when something goes wrong.

Regular and relevant training is more useful than a once-a-year exercise. Employees should understand common warning signs and feel able to challenge an unusual request, even when it appears to come from a senior colleague, client or trusted supplier.

Claim example: In another claim involving a law firm, an employee clicked a link in an email sent from what appeared to be a trusted legal contact. The firm’s outsourced IT provider initially found no malicious activity and believed the email had been spoofed. The insured nevertheless notified DUAL and its breach response partners as a precaution.

That early notification proved important. The email account had been compromised. A subsequent review identified 801 individuals who might have required notification, with 171 ultimately meeting the notification requirements under GDPR. The total response cost was £107,000.

There are two important lessons here. The first is that a clean initial scan does not always mean an account is safe. The second is that early reporting can help the response team establish what has happened before the incident develops further.

The broker’s role in building resilience

Brokers do not need to become cyber security engineers. Their value lies in asking practical questions and helping clients understand where insurance fits within their wider approach to cyber risk.

In my view, a productive client conversation should cover three areas:

1. Prevention: What controls are in place, and do they reflect how the business actually operates?
2. Response: Does the client know what to do, who to contact and when to notify the insurer?
3. Recovery: Can the business restore essential systems and continue operating after an incident?

Cyber resilience is not always about having the latest technology. More often, it comes from consistently applying the basics, testing them and acting quickly when something does not look right. At DUAL, we strongly believe that prevention is better than cure, which is why we worked with Arete on suggestions in managing your organisation’s cyber security.