Insights from the front lines of cybersecurity

What Your Cyber Insurer Will Ask For After a Security Incident (And Why Most Businesses Can't Answer)

Pillar: Insurance & Risk · Target read: 4–5 minutes

If you've renewed a cyber insurance policy in the last two years, you've probably noticed the application getting longer. Underwriters used to ask whether you had antivirus installed. Now they want to know about endpoint detection and response, log retention windows, incident response plans, and — increasingly — whether you can actually document what happened during a security event, not just whether you had one.

That last part is where most small and mid-sized businesses run into trouble, and it usually doesn't show up until the worst possible moment: after an incident, when a claims adjuster is asking questions you can't answer.

What insurers actually ask for

A typical post-incident claims review will ask for some combination of: a timeline of what happened and when it was discovered, evidence of what data or systems were accessed, proof that the threat was actually contained (not just that an alert fired), and log history covering a meaningful window before the incident — often 90 to 365 days, depending on the policy.

Here's the gap: most antivirus and basic EDR tools generate alerts, not narratives. An alert tells you something happened. It doesn't tell you what an attacker actually did once they were in, whether they moved to other systems, or whether the incident is actually over. If nobody was watching that alert in real time — which is common for businesses without a dedicated security team — you may not even know the timeline, let alone be able to document it.

Why 'we have antivirus' isn't the same as 'we can prove it'

Antivirus and even many EDR products are built to catch known threats and generate a log entry. They're not built to reconstruct a defensible account of an incident after the fact — that requires an investigation process, not just a detection tool. And investigation takes either a dedicated internal security team (rare for a 30-to-40-employee business) or a managed provider whose job is specifically to do that work and hand you the record.

This is also where log retention quietly becomes a liability. If your logs only go back 30 days and an incident is discovered two months after it started — which happens more often than people expect — the evidence an insurer wants may simply no longer exist. You can't retroactively create log history you didn't keep.

What to check before your next renewal

Ask your current provider three questions: How many days of log history do we actually retain? If something happened right now, who would notice, and how fast? If our insurer asked for a written account of an incident, could we produce one within a business day? If any of those answers make you uneasy, it's worth a conversation before renewal season, not during a claim.

This is exactly the gap Carbynix was built to close — every alert is investigated, not just forwarded, and every escalated case produces a signed, retained record built for the person who's going to ask you to prove it. If you want a plain read on where your own coverage stands, a Security Evidence Readiness Consultation is a free, no-pitch way to find out.

Outside Counsel Guidelines Are Changing: What Law Firms Need to Show Clients About Security

Pillar: Compliance & Audit Readiness — Law · Target read: 4 minutes

If your firm represents corporate clients, you've likely noticed Outside Counsel Guidelines (OCGs) getting more specific about data security over the past few renewal cycles. What used to be a paragraph about "reasonable safeguards" is increasingly a multi-page security exhibit with specific requirements: encryption standards, breach notification timelines, incident response documentation, sometimes even a right to audit.

Why this is happening now

Corporate legal departments have been burned by vendor and law firm breaches that exposed privileged client data, and cyber insurers underwriting those companies now push security expectations down through the supply chain — including outside counsel. A firm that can't answer a security questionnaire cleanly risks losing engagements to firms that can, regardless of legal quality.

The overlap with your professional obligations

This isn't only a client-relations issue. ABA Model Rule 1.6 and the related ethics opinions (Formal Opinion 477R and 483) already establish that lawyers must take reasonable efforts to protect client information and have a duty to notify clients of a data breach affecting their matters. A documented, monitored security posture is increasingly what "reasonable efforts" is expected to look like in practice — not just a policy on file, but a demonstrable one.

What clients and OCGs are actually asking for

Common asks include: how quickly you'd detect unauthorized access to a client matter, what your incident response process looks like, how long you retain security logs, and whether escalated incidents are reviewed by a qualified person rather than left to an automated tool. A firm without continuous monitoring or a documented investigation process typically can't answer these with more than "we'll look into it if something happens" — which is no longer a satisfying answer to a general counsel's security team.

Where this leaves smaller and boutique firms

You don't need an in-house security department to meet this bar — you need a partner whose entire job is producing the evidence trail OCGs now expect: continuous monitoring, human-reviewed investigations, and a signed record when something does happen. That's the layer Carbynix adds on top of whatever you already have. If a client's security exhibit has you wondering whether you could actually answer it today, a Security Evidence Readiness Consultation is a free way to find out before it comes up in a real renewal.