A clinical lab’s information system is encrypted on a Friday night. Patient data has been copied out, there is a ransom demand, and in the confusion a fraudulent funds transfer goes through. Everyone reaches for the cyber policy. The cyber policy is the right first call — but it is not the only one.
A cyber incident is often several losses at once, and the client’s program usually has more than one policy that can answer. This post follows an illustrative ransomware claim (an invented client, Bluefin Diagnostics Labs, and invented carriers) through InsightAdvocate: the other policies that may respond, a carrier missing its clocks, a forensic report the client owes, and what the client is told.
| Actors | Claims advocate, account executive, practice leader, the client’s IT and finance leads, the forensic firm |
|---|---|
| Trigger | Notice given to the cyber carrier; Analyze |
| Lines | Cyber (primary), crime and property (other lines the facts bring in) |
| Agents involved | Other-insurance finder, proof-of-loss coordinator, carrier SLA monitor, client update writer, loss-trend analyst, supervisor |
| Decisions and authority | Putting the claim to the crime and property policies, the escalation and the client update (advocate); sign-off on breached clocks and the floor gap (practice leader) |
| Outcome | Two more policies on notice, the carrier escalated, the client told what it owes and when |
| What is measured | Policies found beyond the first, days to notice on each, carrier clocks met |
Facts bring in lines
The other-insurance finder does not guess. The coverage engine keeps a small, readable map from loss facts to lines: a ransomware incident goes to cyber first; a fraudulent funds transfer can be a crime-policy loss (computer or funds-transfer fraud); lost income from the damage is a property time-element loss; personal data exposed brings in cyber. The client’s program is then searched for in-force policies on those lines.
time element"] CY --> ON["On the claim"] CR --> MAY["May also respond:
notice prepared"] PR --> MAY style MAY fill:#fff4e2,stroke:#f4a03a
Six decisions are prepared: put the claim to two more policies (a crime policy and a property policy with another carrier), ask the client for the forensic firm’s preliminary report (owed by the client, now late), escalate the cyber carrier after three commitments were breached, send the client a status update, brief the placement team because the client renews in 40 days, and the practice leader’s sign-off on two controls.
Step by step
Encryption of the lab information system, data exfiltration, a ransom demand and a fraudulent transfer.
Given on time; the carrier acknowledges.
Crime (a fraudulent funds transfer) and property (lost income from the damage). Both notices prepared.
Three of the carrier’s commitments breached; the escalation to its claims supervisor drafted.
The forensic firm’s preliminary report, due October 28, is late. The request to the client drafted.
Five-year loss ratio 59%, last three years 64%; the client renews in 40 days. Brief prepared for placement.
SLA_BREACHES and SETTLEMENT_GAP refer to the practice leader.
Accepts the notices, the escalation and the update (dry runs today); the practice leader signs off.
What the agents prepared
| Agent | What it prepared | What it cites | Who decides |
|---|---|---|---|
| Other-insurance finder | Put the claim to the crime and property policies | The loss facts and the program | Advocate |
| Proof-of-loss coordinator | Ask the client for the forensic report | The document request and its due date | Advocate |
| Carrier SLA monitor | Escalate the cyber carrier | Service-agreement clocks and the ladder | Advocate |
| Client update writer | Status update | The stage and the engines’ figures | Advocate |
| Loss-trend analyst | Brief the placement team | Five years of loss runs | Account executive |
| Supervisor agent | Practice leader sign-off: two controls | Published claim controls | Practice leader |
Edge cases
| What happens | What InsightAdvocate does |
|---|---|
| The crime policy excludes social engineering | When its carrier answers, the position is read against that wording like any other. |
| The ransom is paid | A loss-schedule line under the extortion category; a sublimit on it is checked against what it is applied to. |
| Two policies respond to the same loss | Both stay on the claim; other-insurance wording between them is a question for the advocate and counsel, not the engine. |
The decision record for this claim
| Section | Hit | Outcome |
|---|---|---|
| Claim control | SLA_BREACHES: two or more carrier clocks breached | refer |
| Claim control | SETTLEMENT_GAP: the carrier is more than 25% below the floor | refer |
Questions we get asked
Does the finder read every policy word for word?
No. It maps loss facts to lines and searches the client’s in-force program. Whether a specific policy responds is decided once its carrier answers and the coverage engine reads that answer.
Is the breach coach or forensic firm managed here?
No. InsightAdvocate tracks what the client owes the carrier and when; vendors are the client’s and the carrier’s.
Illustrative: the client, carriers and figures are invented. Regulatory timelines in the product are illustrative models, not legal advice.
