Cyber risk transfer used to be relatively straightforward: purchase insurance, review the limits and assume the organization had shifted a meaningful portion of its exposure. That assumption no longer holds. Today, cyber risk transfer is fragmented across overlapping policies, exclusions and emerging protections – many of which only apply if organizations can demonstrate how they responded during an incident.
For boards, that shift is significant. Cyber risk transfer is no longer just about coverage. It is about whether that coverage will hold up under testing, and whether the organization can prove it acted appropriately under pressure.
Cyber Risk Transfer Is No Longer a Single Policy
A decade ago, cyber insurance was often treated as a comprehensive solution. Steven Schwartz, co-founder and general partner at FireTower Risk Solutions, explained how the market has shifted away from a single, all-encompassing policy. “Carriers priced for losses that they can model – extortion, business interruption and privacy notifications,” he said. “The losses that actually hurt companies, though, were outside that model.”
The shift has resulted in a layered system of cyber insurance, directors and officers (D&O) coverage and more targeted protections, each addressing different aspects of risk, but not always working together. “Where companies ultimately get hurt is when they have an event like a vendor breach where no single policy is designed to be first to respond, or a regulatory matter that’s too small for cyber insurance but too niche for D&O insurance,” Schwartz said.
The exposure of individual executives, particularly chief information security officers, is a specific gap within that fragmentation. The criminal conviction of Uber CISO Joe Sullivan and the Security and Exchange Commission’s case against SolarWinds’ Tim Brown are increasingly shaping how security leaders evaluate their roles and responsibilities.
Where Cyber Risk Transfer Coverage Breaks Down
Fragmentation becomes most visible during an incident, when multiple policies are triggered and expectations collide with reality.
Schwartz explained how cyber insurance and D&O insurance interact. “A cyber incident can touch both: a cyber insurance response to a first-party loss and a D&O response when shareholders or regulators go after the directors. The interaction between the two gets messy.” Competing timelines, separate legal teams and expanding exclusions can create friction during incident response.
BreachRx CEO and co-founder Andy Lunsford reinforced that gap from a different angle, noting that even when organizations invest heavily in coverage, they often fail to meet the requirements for using it. In practice, incident response plans and insurance policies are often static documents that are not followed under real-world conditions.
The result is that coverage exists, but its effectiveness depends on how well organizations execute under pressure.
From Cyber Risk Transfer to Proof
The shift from coverage to proof is redefining cyber risk transfer.
“Coverage disputes are never about the event. They are about whether the insured can prove how they responded to it,” Schwartz said.
Lunsford described how expectations have evolved in response to regulatory scrutiny and now extend to decision-making across the organization. “You need to be able to show your work,” he said. “You need to have a system of record that says not just how the security team handled something, but how the business responded across all the stakeholders.”
“Security leaders will be judged less on whether an incident happened and more on how they prepared, how it escalated and what was communicated,” Sullivan added.
Together, these perspectives reinforce that protection is increasingly contingent on behavior and response during and after an incident.
Execution Under Pressure – And the Limits of Cyber Risk Transfer
If proof is the new standard for coverage, execution and documentation become the challenge.
In the early stages of an incident, teams often rely on a patchwork of communication channels. “The hardest thing to document is typically who was involved in a decision and what facts were known at the time,” Sullivan said. “Teams default to verbal updates, fragmented chats and ad hoc calls, which later create gaps in the story that regulators will assume are intentional.”
Renee Guttmann, former CISO at Royal Caribbean, Coca-Cola and Time Warner Inc., explained what happens when leaders respond to incidents in real time and under pressure. “The biggest gaps are often in the ‘obvious’ details that go undocumented: who identified the issue, who declared the incident, who was involved and when and whether delays or missteps increased impact,” she said. “These are exactly the questions regulators will ask – and the hardest to answer later,” after months or years have passed and documentation is incomplete.
Breakdowns are not limited to documentation. “Breakdowns most often occur at the intersection of security, legal, and the business when decision rights and ownership aren’t defined in advance,” Sullivan explained.
Lunsford added that even well-developed plans are often not followed in practice. “The reality is when you go into an actual incident, nobody is pulling out their insurance policy and incident response plan, and making sure they’re following it to a T,” he said. That disconnect between plan and execution is where risk increasingly resides, and why BreachRx developed its cyber incident response management platform, which includes up to $3 million in coverage for legal fees, fines and other costs for incidents managed on the platform for individual executives in addition to corporations.
The Rise of Personal Exposure in Cyber Risk Transfer
As expectations shift, so does accountability. “The conversation has shifted from technical controls to personal accountability,” Sullivan said. He also noted that while many CISOs now seek explicit assurances that D&O insurance will cover them, they lack control over allocation, particularly if relationships with their employers deteriorate after an incident.
Guttmann observed similar concerns across the CISO community. “Personal liability remains very much top of mind,” with some leaders reconsidering whether to take on the CISO title at all, given the potential exposure highlighted by recent individual prosecutions.
Lunsford connected that trend back to structural gaps in coverage, noting that many of the lawsuits CISOs face are not clearly addressed by either cyber insurance or D&O policies.
Together, these perspectives highlight a growing misalignment between authority, accountability, and protection.
What Fragmented Cyber Risk Transfer Means for Boards
For boards, the implications extend beyond insurance purchasing decisions. “Boards own the response discipline,” Schwartz said. “Buying insurance is easy. Making it pay is the governance.”
He recommends that directors ask, “When was the last time that we tested our policy language against our incident response plan and program, and show me the delta?” That question reflects a broader shift in oversight. Boards must now understand not only what coverage exists, but how it interacts with incident response processes in practice.
Lunsford emphasized that relying on static plans and policies is not sufficient. Organizations must be able to execute consistently and at scale, particularly as the volume and complexity of incidents increase.
From a CISO perspective, that execution depends on clear decision rights and alignment across stakeholders. Without that alignment, incidents can quickly devolve into disjointed responses that undermine both operational outcomes and legal defensibility.
A Different Standard for Cyber Oversight
The underlying change is structural. Cyber risk transfer is no longer defined by policies alone, but by how organizations operate under pressure and how well they can demonstrate that performance, sometimes months or years later.
For boards, that means shifting oversight from insurance coverage to capability. The board must be able to confirm not just that protection exists, but that the organization can demonstrate in detail how it can respond when tested.
Did you enjoy this story on cyber risk transfer? Don’t miss my next one: use the blue “follow” button at the top of the article near my byline to follow my work, and check out my other columns here.
