The Chronicles of Cyber Insurance: Separating Fact from Fiction in Cyber Risk

Kelly McGuinness of CFC, Canada's largest cyber insurer, sets out to debunk misconceptions about cyber insurance from the underwriting side. She admits the industry often fixates on checklist questions such as end-of-life software or MFA coverage instead of understanding real cyber hygiene, and that policy wording varies so much between carriers that comparing coverage is genuinely hard. She traces the market from early third-party-liability buyers, through the COVID-driven hard market when ransomware losses spiked, to today's broader, more competitively priced coverage. She breaks down first-party coverage (incident costs, business interruption, ransom payment and negotiation, funds-transfer fraud) and third-party coverage (privacy liability, regulatory fines, PCI DSS penalties, media liability), and shares CFC's own claims data: theft of funds is the most frequent claim type, while ransomware, though less frequent, causes the most severe losses. She describes CFC's proactive scanning service, which flagged a Commvault zero-day to affected clients before it was exploited, and closes on the gap between the 61 percent of Canadian SMEs that have faced an attack and the roughly 10 percent that carry standalone cyber coverage, taking audience questions on underwriting verification, pricing and how CFC works exclusively through brokers.