"The controls don't pay the claim. The policy doesn't replace the controls."
— Insights from Eric Hernandez & Stephen Pine (Patterson & Associates) at the Richardson Chamber of Commerce Business Forward briefing.
When a cyber or AI incident hits a business, the loss is rarely just "the hacker." A single event immediately becomes an operations, cash-flow, legal, and reputation problem—simultaneously. Operations freeze during a system outage, money leaves via social engineering or wire fraud, forensics and breach counsel mobilize, and lost income compounds the damage while the business rebuilds.
1. What Is Driving Cyber Claims Today?
Email-based crime is the everyday threat, while ransomware remains the most expensive one. Recent Coalition claims data highlights where losses actually originate:
- 58% BEC & Funds Transfer Fraud: Over half of cyber incidents start with Business Email Compromise (BEC) and fraudulent wire instructions—proving the biggest cyber loss often starts with one inbox, not a server room.
- $269,000 Average Ransomware Loss: Driven by encryption, data exfiltration, forensic investigation, and extended operational downtime.
- 86% Refused to Pay: The vast majority of businesses in ransomware claims refused to pay the ransom—relying instead on verified backups, system restoration, and incident response coverage.
2. What a Cyber Policy Covers—And Where Owners Get Surprised
A well-structured cyber program is built around six core financial buckets: Incident Response (forensics, breach counsel, notification, credit monitoring), Business Interruption, Cyber Extortion, Cybercrime (social engineering & funds transfer fraud), Third-Party Liability & Regulatory Defense, and Data & System Restoration.
However, "we have cyber insurance" is not the same as "this exact loss is covered." Four common gaps catch business owners off guard at claim time:
- Voluntary Transfer & Callback Rules: Social engineering coverage often carries a lower sublimit (e.g., $100K–$250K) or requires pre-transfer phone verification to a known number before a dollar is paid.
- Downtime Waiting Periods: Business interruption hinges on the cause of the outage, how "computer systems" are defined, and hours-long waiting periods.
- Third-Party Vendor Outages: Contingent business interruption wording determines whether a cloud provider, SaaS platform, or managed service outage triggers coverage.
- Inaccurate Application Answers: Guessing "Yes" on your insurance application about Multi-Factor Authentication (MFA) when an admin or remote account was left unprotected can trigger coverage disputes when a claim occurs.
3. Underwriting Has Changed: Controls Drive Eligibility
Underwriters have shifted from asking "Do you want cyber coverage?" to "Show me how you control the risk." Today, carriers evaluate security posture as a binding condition of eligibility:
- Multi-Factor Authentication (MFA) enforced on all email, remote access (VPN/RDP), and privileged admin accounts.
- Endpoint Detection & Response (EDR) deployed across workstations and servers.
- Segmented, Tested Backups with proof of successful restoration.
- Email Filtering & Remote Access Hygiene to stop phishing and unauthorized entry before credentials are stolen.
4. The New Frontier: AI Risk & AI Liability
Whether your company uses customer service chatbots, AI-assisted project estimating, automated HR screening, or generative marketing tools, your business already carries AI exposure. Coverage can apply to an AI error even when no hacker is involved—the harm trigger is the AI output itself.
- Bad Advice & Negligent Misrepresentation: In a landmark tribunal ruling, Air Canada was held financially liable after its customer chatbot gave inaccurate bereavement-fare advice—proving companies cannot disclaim what their AI agents tell customers.
- Algorithmic Hiring & Bias ($365K EEOC Settlement): Automated screening software that filtered out older applicants resulted in an EEOC enforcement settlement, showing regulators hold employers accountable for automated decisions.
- IP, Privacy & Rework Losses: AI-generated marketing that infringes protected artwork, AI assistants that expose confidential client data, or faulty estimating models require careful review across E&O, Media, Cyber, and specialized AI Liability markets (such as Armilla/Lloyd's, CFC, Mayflower/Hadron, and Munich Re aiSure).
5. The Owner's 5-Point Cyber & AI Risk Review
You do not need to be the IT expert, but you do need to own the answers. Ask these five questions before your next renewal—not after the next incident:
- Know Your Policies: Which policies cover our cyber and AI risks, and what limits, sublimits, and retentions apply?
- Verify Your Controls: Can IT demonstrate our MFA controls are deployed everywhere required—and prove a successful backup restoration?
- Inventory Your AI Use: Which AI tools do we use, what data goes into them, and who is reviewing and accountable for the output?
- Define Your Incident Response: Who stops a faulty or compromised tool, preserves records, and calls the carrier's breach hotline immediately when wire fraud or ransomware strikes?
- Validate Your Applications: Do our insurance applications accurately describe our actual controls and current AI use—including recent changes?
Below are the active numbers for the current monthly game. Mark them off on your digital or paper card.
How to participate:
Our monthly numbers are emailed directly to our client list. If you don't have a card, click Play Bingo in our navigation bar to request your physical card, which will be personally delivered directly to your office.
Complete any 5-square straight line (vertical, horizontal, or diagonal) to hit "BINGO". Once you do, click the submit claim button to notify Eric Hernandez and claim your community prize!
A key to understanding your workers’ compensation premium is the experience modification factor, also known as your mod. Understanding your company’s mod and the variables used to calculate it helps you identify active ways to minimize your workers’ compensation costs.
Who calculates the mod factor?
Most states use the National Council on Compensation Insurance (NCCI) to collect data and calculate the experience modification factor. NCCI is a private corporation funded by member insurance companies.
How is a mod calculated?
The formula compares your company's actual payroll-adjusted losses to expected losses for businesses of the same size within your industry class code.
The rating system splits losses into primary losses (indicators of frequency, counted at full value) and excess losses (indicators of severity, weighted less). Since frequency is a stronger indicator of workplace risk, a business with ten $5,000 claims will have a worse mod than a business with one $50,000 claim.
How does it affect my premium?
- Debit Mod (Mod > 1.0): Your loss history is worse than average. A surcharge is added. For example, a 1.2 mod means you pay a 20% penalty surcharge on your premium.
- Credit Mod (Mod < 1.0): Your loss history is safer than average. You receive a discount. For example, a 0.8 mod means you receive a 20% discount on your premium.
The experience period typically includes loss data for 3 complete years, excluding the immediate past policy term. To analyze your experience mod worksheet and discover errors, contact Eric Hernandez for a full audit.
