The author expresses skepticism about the value of cyber insurance after engaging in a frustrating process with their carrier to establish a response plan. Despite purchasing the insurance for contractual reasons, the carrier showed little proactive interest in preparing the client for incidents. Challenges included delays in securing a non-disclosure agreement (NDA) and business associate agreement (BAA), inadequate onboarding support, and the need to manually remove former employees from communication channels. The author also questions the efficacy of cyber insurance, citing instances of low claims payouts and industry struggles to quantify cyber risk, suggesting some organizations might be better off investing in improved preventative controls rather than insurance premiums.
