Cyber Risk Practice

We review cyber programs every week. The pattern is the same: a broker sold a $1M cyber policy two years ago, the business signed the application without reading the exclusions, and nobody has looked at it since. Then the business gets hit with a ransomware demand, a wire fraud loss, or a data breach notification obligation, and the policy either doesn’t respond or responds with sublimits that don’t cover the actual cost.

The gaps we see most often:

• Social engineering / funds transfer fraud excluded or capped at a small sublimit. Wire fraud is one of the most common and most expensive cyber losses for mid-market businesses.
• Business interruption with waiting periods that are too long or calculation methods that don’t match how the business actually earns revenue.
• Dependent business interruption not included. If your cloud provider, payment processor, or key vendor goes down, your revenue stops. Most cyber policies don’t cover that unless you ask for it.
• Regulatory coverage sublimited or restricted to specific statutes. HIPAA, state privacy laws, PCI fines, and GDPR all create different regulatory exposures.
• Coverage triggers that don’t match the actual incident. Some policies require a “security failure” to trigger coverage. If an employee falls for a phishing email and voluntarily wires money, that’s not a security failure under some policy forms.

We don’t sell cyber insurance. We structure cyber programs. There’s a difference.

Cyber exposure varies by industry because the data, the regulatory environment, and the attack surface are different. We place cyber across all the industries ZRM serves, but the heaviest concentration is in sectors where the data is sensitive, the regulatory penalties are real, and the attackers are paying attention.

HIPAA makes healthcare the most regulated industry for data breach. A single breach involving protected health information triggers notification to every affected individual, HHS reporting, and potential OCR enforcement action. Healthcare data breaches are consistently among the most expensive of any industry, with costs that routinely run into the millions. We structure cyber for healthcare organizations with HIPAA-specific coverage, regulatory defense, and business interruption that accounts for the revenue impact of EMR system downtime.

Banks and credit unions face wire fraud, account takeover, and card data exposure. Social engineering coverage with adequate limits is non-negotiable for any financial institution. We coordinate cyber with the FI bond so there are no overlaps or gaps between the crime and cyber coverage.

Property management companies and multifamily operators collect rent payments, store tenant personal information, and increasingly use connected building systems (smart locks, HVAC controls, access systems). A breach exposes tenant data. A ransomware attack on the property management platform disrupts rent collection across entire portfolios. Cyber coverage for real estate operations needs to address both data and operational risk.

Nonprofit organizations handle donor data, beneficiary records, and payment processing. They’re targets because their IT budgets are smaller and their staff security awareness is often limited. We place cyber for nonprofits with limits and retentions that fit nonprofit budgets while covering the exposures that matter: donor data breach, wire fraud from spoofed board member emails, and website defacement.

Construction companies are increasingly targeted for wire fraud because of the large dollar amounts moving between owners, GCs, and subcontractors. A spoofed email redirecting a $500,000 draw payment is a real and common scenario. Cyber coverage for construction needs to specifically include funds transfer fraud and social engineering with limits that match the size of your typical payment flows.

Every cyber placement starts with understanding how your business actually uses technology, stores data, and handles payments. We don’t send you a generic application and hope for the best. The process works like this:

1. Risk assessment: We look at your data types, your vendor ecosystem, your payment processes, and your current security posture. Not to audit your IT, but to understand what the carriers will ask and what coverage you actually need.
2. Coverage design: We identify what coverage lines you need (first-party, third-party, regulatory, business interruption, social engineering) and what limits are appropriate for your revenue, your data volume, and your industry’s regulatory environment.
3. Market submission: We submit to carriers that are currently competitive in your industry class. Cyber market appetite shifts faster than almost any other line. A carrier that was aggressive on healthcare last quarter may have pulled back this quarter. We track the shifts.
4. Policy review: Before binding, we read the actual policy form. Not the coverage summary, not the broker letter. The form. That’s where the exclusions, sublimits, and coverage triggers live.

Every cyber placement gets principal-level attention. This is one of the lines where broker expertise directly affects whether the policy pays when you need it to.

Send us your current cyber policy or call 914-361-9854. We’ll tell you what it covers, what it doesn’t, and what it should.