SCORE Session 2 — Cyber Insurance

Welcome everyone. It looks like we have about 24 people in our room today. Welcome Cyrus. Thank you, of course, for always being here for us in our series. I would love to see in the chat just a little check-in.

Where is everybody coming from? Where are you joining us from today? Yes, if you can hear me fine, it's always a pleasure to be here. My microphone check worked. Fantastic, Cyrus.

Thank you very much. And we see some folks coming from Michigan. Hi Tanya, Brenda from Cary. Is it Cary or Cary? I don't know if I know Cary, Illinois myself.

Chicago, hello from Mount Dora, Florida, Vernon Hills, Oak Park. That's my neck of the woods, NYC, some more Michigan people, and we see Libertyville, Illinois. So, we have almost 30 people in our chat, and we're 2 minutes after, so I'm going to go ahead and get us kicked off here with our webinar, and I really am excited to kick off our second session of the Data Defenders and SCORE Chicago Cybersecurity series. Today, we're going to be covering what cyber insurance actually does, what it doesn't cover, how underwriters evaluate your business, and how to align your with your incident response plan. So, if you were here for our first session, we talked about having a plan, and then today's question is, does your coverage match that plan?

My name is Stacie Porosky. I am on the SCORE event committee. I'll be your host for today along here with Mr. Cyrus Walker, who is the founder and CEO of Data Defenders, and Cyrus is the founder and CEO of Data Defenders. He is an internationally recognized and published expert on electronic voting security, and is an experienced cybersecurity industry executive.

Cyrus served as a subject matter expert in cyberterrorism and incident response management for the Cyber Defense Analysis Center at the University of Arkansas. He has trained over 5,000 federal, state, and local law enforcement professionals from numerous agencies across the United States. Before I turn it over to Cyrus, I just want to let you about SCORE and what we do. We have chapters all across the country. We are a nationwide network of nearly 8,000 volunteers.

We've been around for 60 years and we are a resource partner to the U.S. Small Business Administration. And what we do, what our purpose is, it's to help small businesses get off the ground and grow. It's truly as simple as that. All of us volunteer to be mentors.

We are here to help people achieve their vision of owning and operating small businesses. Our vision is that no one should be alone on this entrepreneurial journey and that everyone should have the resources that they need to thrive as a small business owner. Many SCORE mentors have been in business themselves as entrepreneurs and as corporate executives. And then many are retired and then some of us are still actively working. We all volunteer and give back our time and experience to help others just like you and get you started and off the ground.

And we do that in two ways. We have education like this webinar and we have mentorship. And that mentorship starts by going to www.score.org/chicago. I see some of us are not in the Chicago area and you do and would have a SCORE chapter close to you and you can certainly go to the main website to search for that mentor as well. And I the there's two ways that we mentor you and bring you this the success.

And I really want you to know that it could be one-on-one, it can be once a week, once a month. Our mentors really are there to help you through that process and being a small business person it's not easy and you're going to encounter those obstacles. One being our cybersecurity and Cyrus is here to help you with that. I'll be monitoring the chat and we will also conduct a Q&A at the end of the presentation where we can use that chat also and we can also unmute you, too. So, with that I'm going to turn it over to Cyrus Walker.

Welcome, Cyrus. Thank you. Well, good afternoon, everyone and thank you for joining us for session two of the SCORE Chicago Cybersecurity Series. Today we'll be talking about cyber insurance, what it is, and what it actually covers and what it doesn't, and why it has become a necessary part of running your business today. My goal is to make this a practical session and by the end of this session I want you to understand what risks small businesses actually face, how insurers evaluate your business, what can void a claim, and what steps you can take immediately to improve your protection and reduce your cost.

So, let's go ahead and get into it. For those of you that that haven't met me again, I'm Cyrus Walker, the founder and CEO of Data Defenders. I've spent 30 years working in cybersecurity, digital forensics, AI, network engineering, and technology leadership. I previously served as the department chair for the cybersecurity and computer forensics department at the City Colleges of Chicago and I've worked with organizations including the Department of Homeland Security on incident management initiatives. I'm a certified computer forensic examiner and I've been fortunate to contribute commentary and expertise across national media outlets over the years.

Most importantly for today's conversation I spent a great deal of time helping business owners respond to cyber incidents. And I can tell you from experience that financial that the financial side of recovery is often what determines whether a business survives or not. Where quick Where are we going with this series? This is session two part of a larger six-part cybersecurity series we're doing throughout 2026. Back in March, we covered incident response planning focusing on what to do after an attack occurs.

Today, we're focusing on cyber insurance and July we'll go deep into ransomware specifically how attacks happen how organizations respond and what recovery actually looks like. Later this year, we'll cover cybersecurity awareness, phishing and the human side of cyber risk. Each session builds on the last but today's presentation can absolutely stand on its own. Back in March, we talked about what to do when an attack happens. Today, I want to ask a different question.

If an attack happens tomorrow could your business recover? Most small businesses believe they are reasonably prepared but the numbers tell a very different story. A lot of businesses had some form of prevention plan but very few are truly confident they could respond effectively to a serious incident. Looking at some of the statistics 86% of businesses had a prevention plan only 23% were very confident that plan could actually work. Less than one in three small businesses carry insurance even among those already breached.

And even fewer carried dedicated cybersecurity coverage. At about 17%, that means businesses are operating with a dangerous assumption that their existing insurance will somehow protect them and in many cases, it won't. One of the biggest misconceptions we see is the coverage assumptions gap. Business owners pay insurance premiums every year, so naturally they're believing they are covered for major events. Then ransomware hits, they call their insurance company, and they discover their policy excludes cyber-related losses entirely.

Traditional business policies were designed for things like accidents, property damage, theft, and bodily injury. Not designed for ransomware, data breach, or network compromises. And because only a small percentage of businesses carry dedicated cyber insurance, most organizations are financially exposed without realizing it. The worst time to learn that your policy excludes cyber insurance is during the time of a crisis. How many of you currently have business insurance?

Most business owners do. You pay your premium every year, you renew your policy, and naturally assume that if something catastrophic happens, your insurance company will be there to help. That's a reasonable assumption, but when it comes to cyber attacks, it often is the wrong one. Here's the gap. Traditional business insurance policies were built to cover physical world risk, property damage, theft, accidents, and liability claims.

They were not designed to cover ransomware, data breaches, or the cost of recovering from a cyber attack. Yet, industry research shows that at least one in four small business owners incorrectly believes their existing policy covers those events. Then ransomware strikes, systems are locked, operations stop, and they discover that the coverage they thought they had does not exist. Meanwhile, only 17% of small businesses carry dedicated cyber insurance compared to 70 to 80% of large corporations. That means the vast majority of small businesses are financially exposed without realizing it.

The problem isn't just the attack itself. It's finding out on the worst day possible that you're responsible for every dollar of recovery costs. One of the biggest mistakes business owners make is believing that a cyber attack is something that only happens to large corporations. The reality is that small and family-owned businesses are increasingly becoming targets because attackers know they often have fewer resources, fewer security controls, and less ability to absorb a financial loss. The story on this slide is not about a Fortune 500 company.

It's about a family-owned business that has successfully operated for 158 years and employed hundreds of people. It had survived economic downturns, industry changes, and generations of leadership. What it could not survive was a ransomware attack. The attack itself began with something remarkably simple, a single compromised employee password. From that one point of entry, the attackers gained access to critical systems, encrypted essential business data, and destroyed backups.

Operations came to a halt. The company suddenly found itself unable to serve customers, manage, or conduct normal business activities. While technical breach was severe, the real damage came from the inability to recover quickly and absorb the financial impact that followed. This case is especially relevant today because many businesses are entering what experts call a transition window. Over the next decade, approximately 12 million baby boomer owned businesses will change ownership representing nearly 10 trillion dollars in assets.

During these transitions, new employees, family members, advisors, and vendors often gain access to systems and sensitive information. At the same time, owners are focused on succession planning or business sales. These periods create distractions and security gaps that cyber criminals actively seek to exploit. The lesson from this incident is not simply that cyber attacks happen, it's that recovery requires more than technology. It requires preparation, financial resilience, and the ability to continue operating after an attack occurs.

The company here did not fail because one password was compromised, it failed because there was insufficient protection in place to withstand the consequences that followed. For every business owner planning a transition, sale, or succession, this serves as a reminder that cybersecurity and cyber insurance are not just technology issues, they're business survival issues. Over the past several years, the cyber insurance market has undergone significant transformation following a wave of costly ransomware attacks and record-breaking cyber losses. Insurers dramatically increased premiums and tightened their underwriting standards as a result. The good news for business owners is that those premiums that have increased have begun to stabilize.

Today, the median annual premium for a business with fewer than 250 employees is approximately $1,740, down from more than $2,100 just a few years ago. At a glance, it appears that cyber insurance is becoming more affordable, and in many cases, it is. However, lower premiums do not mean easier access to coverage. Insurance carriers have fundamentally changed how they evaluate cyber risk. In the past, obtaining coverage often involved completing a simple application and checking a few boxes.

Today, underwriters expect organizations to demonstrate that critical security controls are actually in place. Requirements such as multi-factor authentication, endpoint detection and response, secure backups, patch management, incident response plans, and employee security awareness training have become the new baseline. Increasingly, insurers want evidence, not promises. At the same time, the regulatory environment continues to evolve. In 2025 alone, nearly 100 security-related bills were passed across a dozens of states.

Laws such as New York's Shield Act, California's Consumer Privacy Act, and Maryland's Online Data Privacy Act reflect a broader trend toward increased accountability for how organizations protect sensitive information. While there is still no universal requirement for businesses to carry cyber insurance, governments are making it clear that cybersecurity is no longer optional. Businesses that collect, store, and process customer data are expected to demonstrate reasonable security practices. Takeaway is that the window for obtaining affordable cyber insurance remains open, but it is narrowing. Carriers are lowering prices for organizations that can prove they are managing cyber risk effectively.

While making coverage more difficult and more expensive for those that cannot. The businesses that invest in security controls today are not only reducing their chances of a cyber incident, they're also positioning themselves for better coverage, lower premiums, and fewer obstacles during the underwriting process. In today's market, cyber insurance is no longer just something you buy, it's something that you must qualify for. One of the biggest sources of confusion in the cyber insurance market is that the term cyber insurance is often used to describe two very different types of coverage. The first is cyber liability insurance, which is designed for organizations that use technology in their daily operations, which today means virtually every business on this planet.

This policy helps cover costs associated with a cyber incident, including data breaches, ransomware attacks, business interruption, forensic investigation, legal expenses, and customer notification requirements. The second type of coverage is technology errors and omissions insurance, often called tech E&O. This policy is designed for businesses that provide technology products or services to others, such as software companies, managed service providers, consultants, and technology contractors. Rather than covering your own losses from cyber attacks, tech E&O protects your business when a client claims that their product, service, or professional advice caused them financial harm. It addresses claims involving service failures, software defects, professional errors, and network security incidents that impact third parties.

The distinction is more important because many businesses assume one policy automatically provides protection for all claims. In reality, they serve very different purposes. Most small businesses need cyber liability insurance because they store data, use technology, and face cyber threats every day. That develop, manage, or provide technology services to clients may need both cyber liability and tech E&O coverage. Understanding which risk you are trying to protect your business against is the first step toward purchasing the right protection.

When most business owners hear the term cyber insurance, they often assume it simply means coverage for a data breach. In reality, cyber liability policy is designed to address a wide range of financial and operational consequences that follow a cyber incident. The coverage is generally divided into two categories. First-party coverage, which protects your business directly, and third-party coverage, which protects you when others hold you responsible for damages resulting from an incident. First-party coverage focuses on helping your organization recover.

It may pay for forensic investigations to determine what happened, data recovery and restoration, breach notification expenses, crisis communication, business interruption losses, and even certain ransomware and extortion-related costs. In other words, first-party coverage is designed to help your business survive and resume operations after an attack. These are often the most immediate and visible costs organizations face following a cyber incident. Third-party coverage addresses the legal and regulatory consequences that can arise when customer, employee, or business partner information is compromised. This can include regulatory investigations, legal defense costs, settlements, privacy-related lawsuits, payment industry payment card industry claims, and other liability resulting from a breach.

Together, first and third-party protections form a foundation of a cyber liability policy. However, not all policies provide the same coverage, which is why it is critical to carefully review policy terms and exclusions before purchasing coverage. Two policies with similar premiums can provide very different levels of protection when an incident occurs. When people think of cyber insurance, they naturally focus on the financial losses that follow a breach. Things like legal costs, forensic investigations, business interruption, and recovery expenses.

Those are important, and many of those costs can be insured. What is often overlooked, however, is the damage that cannot be easily measured or reimbursed. One of the most important points about cyber insurance is understanding what it cannot fully replace. While a policy may help cover recovery costs, it cannot restore trust overnight. The statistics here are telling. 89% of small and medium-sized businesses that experienced a cyber breach reported reputational damage as well. 30% lost customers, 25% received negative social media reviews, and 29% reported difficulty winning new business after the incident.

Even more concerning, the average time required to fully recover a damaged reputation was 279 days, or more than 9 months. For family-owned businesses, these numbers take on an even greater significance. In many cases, the business owner's name, reputation, personal credibility are directly tied to the company. A cyber incident is not viewed simply as a technology failure. It becomes a public test of the owner's judgment and ability to protect customers.

A business may spend decades building trust within its community only to see that trust questioned after a single breach. As noted here, for family business, the name above the door is often the brand itself. The long-term impact can be substantial, according to the data. 47% of businesses that experienced a cyber incident reported challenges attracting new customers, up significantly from 20% the previous year. That trend suggests customers are becoming more aware of cybersecurity risk and are more selective about who they trust with their information. The lesson is clear.

Cyber insurance can help offset financial losses, but it cannot fully insure your reputation, your relationships, or your legacy. These assets must be protected through strong cybersecurity practices, effective incident response planning, and a commitment to maintaining customer trust before the incident even occurs. This is the input that matters the most for anyone who thinks they're already covered. Starting in 2014, the Insurance Services Office, the body that sets standard policy language, introduced mandatory endorsements that specifically remove cyber coverage from general liability or CGL and business owner policies BOP. These aren't technicalities buried in the fine print.

They are intentional, they are explicit, and the courts have consistently upheld them. If your BOP was written after 2014, assume cyber events are excluded, but don't assume, verify. Here are some examples of cases where courts have ruled against customers. EMOI versus Owners Insurance, Ohio 2022 was when this case occurred. EMOI Services was a medical software support company in Ohio that provided appointment scheduling, records management, and billing services for healthcare offices.

In 2019, the company suffered a ransomware attack after hackers gained access to its systems and encrypted critical files. The attackers demanded three Bitcoin, worth $35,000 at that time, in exchange for a decryption key. EMOI paid the ransom, recovered most of its systems, and then filed a claim with its business insurance, business owners insurance company. The insurer denied the claim, arguing that the company's policy only covered direct physical losses or damage to covered property. EMOI argued that the ransomware attack had effectively damaged the software because the system became unusable.

The dispute eventually reached the Ohio Supreme Court, and in late 2022, the Supreme Court ruled in favor of the insurer. The court concluded that software is intangible and does not have physical existence, meaning it cannot suffer physical damage under the language of the policy because the attack damaged data and software, but not the actual computer hardware. The court held that losses were not covered under the business owner's policy. The case became an important example in cyber insurance discussions because it reinforced a critical point for businesses. Traditional business insurance policies are often not designed to cover ransomware or cyber attacks.

Courts increasingly require businesses to carry dedicated cyber insurance if they want protection for digital incidents. Another case, Home Depot versus Steadfast, occurred last year. In 2014, Home Depot suffered one of the largest retail data breaches in US history after hackers stole payment card information for more than 50 million customers. Banks and financial institutions were forced to cancel and reissue millions of credit cards, reimburse fraudulent charges, and increase fraud monitoring. Home Depot ultimately paid about 170 million to settle the claims after exhausting the limits of its standalone cyber insurance policy.

Home Depot sought additional coverage under its traditional commercial general liability policies issued by Steadfast Insurance and others. The insurers denied the claim, arguing that the policies specifically excluded losses involving electronic data. Home Depot argued that the claims involved physical credit cards that had to be replaced, not just digital information. In 2025, the US Court of Appeals in the Sixth Circuit ruled in favor of the insurers. The court concluded that the losses arose from stolen electronic payment data, which fell squarely within the policies' electronic exclusions.

The case became an important example of how courts increasingly distinguish between traditional business insurance and dedicated cyber insurance coverage. Last case we'll look at National Ink versus State Auto, happened in 2020. National Ink and Stitch, a small Maryland embroidery company, suffered a ransomware attack in 2016 after malware infected its computer systems. The attack corrupted software and disrupted business operations forcing the company to spend thousands of dollars replacing servers, reinstalling software, restoring data and recovering its networks. When the company filed a claim under its business owner's policy, State Auto Insurance denied much of the coverage arguing that the software and electronic data were not considered physical damage.

In 2020, a federal court in Maryland largely sided with National Ink ruling that the ransomware attack caused a form of direct physical loss and or damage because the company's systems could no longer function normally without extensive restoration. The case became important because it showed that some older business policies could still provide limited cyber-related coverage. However, insurers later tightened policy language and exclusions specifically to prevent small or similar claims under traditional business owner policies in the future. One of the biggest changes in the cyber insurance market of the last few years is that carriers no longer view cybersecurity as a simple questionnaire. In the past, organizations could often obtain coverage by answering a series of application questions and checking a few boxes.

Today, cyber insurance has become a control-based contract. Insurers increasingly verify the security measures that applicants claim to have in place and that they expect those controls to be implemented, documented, and maintained. In many cases, the difference between a paid claim and a denied claim comes down to whether these baseline requirements were actually in place when an incident occurred. Five controls shown here have become the foundation of modern cyber underwriting. Multi-factor authentication, most of you have already heard of, is now considered mandatory virtually all users and systems.

Endpoint detection and response tools provide continuous monitoring for devices for malware and malicious activity. Carriers also expect organizations to maintain tested air-gapped or immutable backups that can survive a ransomware attack. Rapid patch management is equally important because unpatched vulnerabilities remain one of the most common ways attackers gain access to business networks. And in fact, outdated or unsupported systems have been linked to approximately 22% of denied insurance claims. The fifth requirement, a documented incident response plan, ties all the others together.

We covered incident response plan development in our March session. To look back at that session, you can visit Score's or Data Defenders YouTube channel for a detailed refresher. Please recall, however, from that session that insurers want evidence of an organization's ability to have those security controls in place. They also want a clear plan for responding when something goes wrong, and a written and tested incident response plan demonstrates preparedness, reduces risk, and can positively impact both underwriting decisions and premium costs. The takeaway is simple.

These controls no longer considered best practices or recommendations. For many carriers, they have become contractual conditions of coverage and the minimum requirements for obtaining cyber insurance at a reasonable cost. For those of you who attended our March session on incident response planning, I want to connect to that discussion directly to today's topic. At that time, we focused on operational readiness, how to detect an incident, contain the damage, recover systems, and learn from the event afterward. Many business owners don't realize it is that incident response plan is an extremely important security document.

It's also something insurance underwriters increasingly view as evidence that your organization is a lower risk customer. From an insurance perspective, a documented and tested incident response plan can have a direct financial impact. Organizations that can demonstrate a current incident response plan often qualify for faster underwriting, fewer policy exclusions, and in some cases premium reductions of 10 to 20%. By contrast, businesses that cannot show a documented IRP may face higher premiums, additional exclusions, and even difficulty obtaining coverage at all. Underwriters want to know if an incident occurs, your organization has a structured process in place for responding quickly and minimizing losses.

The key takeaway here is that preparedness has measurable business value. The work you put in to developing an incident response plan today is not simply about compliance or checking a security box. It is directly It is about directly affecting your insurability and the cost of your coverage. In today's cyber insurance market, carriers are looking for evidence that organizations are prepared to respond effectively when something goes wrong. A documented and tested IRP demonstrates that preparedness, making it one of the most valuable cybersecurity investments a small business can make.

One of the most encouraging developments in the cyber insurance market is that good cybersecurity practices can directly reduce your cost of coverage. Insurance carriers increasingly reward organizations that demonstrate strong security controls because those businesses are less likely to experience a cyber incident. The numbers here that we show illustrate that relationship clearly. Multi-factor authentication or MFA by itself can result in a premium discount of up to 18 to 22% from major carriers. Some studies show that organizations using MFA pay 20 to 40% less than similar businesses that do not have MFA in place.

Perhaps most importantly, MFA is estimated to prevent approximately 99% of account takeover attacks, making it one of the highest valued security investments a business can make. The savings becomes even more significant when organizations implement a full security program. Businesses that combine MFA, EDR, tested backups, employee security awareness training, and a document IRP often see premium reductions ranging from 20 to 50%. Some mature organizations may qualify reductions up to 60%. Considering that the median annual insurance premium for businesses with fewer than 250 employees is approximately $1,740, those savings can be substantial while simultaneously improving the organization's ability to prevent and respond to attacks.

The contrast becomes even clearer when we look at organizations that lack these controls. Businesses without cybersecurity safeguards often face higher premiums, more policy exclusions, and in some cases difficulty obtaining coverage at all. Even worse, if a claim is denied because required controls were not actually in place, the organization may be forced to absorb the full cost of the incident out of pocket. With the average small business breach costing anywhere from 25 to 250,000 dollars, the financial math becomes difficult to ignore. A relatively modest investment in security controls not only reduces risk, but also lowers insurance costs and improve the likelihood that coverage will be available when it is most needed.

One of the most important lessons about cyber insurance is that purchasing a policy does not automatically guarantee a claim will be paid. In fact, insurers deny claims for specific reasons that are often preventable. The first is application misrepresentation. In the Travelers versus ICS case, the company executive certified that multi-factor authentication had been deployed throughout the organization when it had not. When a cyber incident occurred, the insurer discovered the discrepancy and voided the policy from the inception, leaving the company with no coverage.

The lesson is simple. Every answer on an insurance application must be accurate and verifiable. The second major reason claims are denied is failure to maintain required security controls after the policy is issued. The city of Hamilton, Ontario, learned this lesson the hard way when a cyber claim was denied because a required MFA control had not been implemented despite being a policy requirement. The city ultimately absorbed more than $18 million in losses.

The third denial category involves excluded events. Some attacks such as nation-state cyber operations may fall under war exclusions. And we're certainly experiencing that today with what's going on between the US and Iran and even before that Russia and Ukraine. While business email compromise and social engineering fraud often requires separate endorsements. In fact, business email compromise and social engineering incidents account for roughly 60% of cyber insurance claims yet are frequently excluded from standard coverage.

The fourth and final category involves actions taken after an incident occurs. The statistics on this slide are particularly revealing. 17% of denied claims involved late notification to the insurer while 44% involved inadequate documentation. Many policies also require insurance to approve certain actions including ransomware negotiations and payments. If an organization pays a ransom without notifying its carrier or fails to document its response properly, coverage may be denied even though a valid policy was in place. The takeaway is that cyber insurance is not simply something you buy and file away.

It is an ongoing contractual relationship that requires accurate disclosures, maintained controls, awareness of exclusions, and disciplined incident response procedures if you expect a claim to be paid when you need it most. At the end of the day, cyber insurance is really a financial decision. And here we put that decision's perspective. When a cyber incident occurs, the cost add up extremely quickly. A business may face IT recovery expenses ranging from 10 to 50,000 dollars, legal and regulatory costs that can exceed a hundred thousand dollars or more, customer notification expenses, ransomware demands, and significant downtime losses that can range from eight to 74,000 dollars per day.

When all these factors are combined, the average uninsured cyber incident for a small business can easily cost from anywhere between 25,000 dollars to 250,000 or more. The statistics become even more sobering when we look at how these costs affect small businesses. According to the data shown here, one in five small businesses would be forced to close if a cyber incident cost them just 10,000 dollars. At a loss of 50,000 dollars, that number rises dramatically with 55% of small businesses reporting they would not survive the financial impact. These figures help explain why so many cyber incidents become business-ending events, not just because the attack itself was catastrophic, but because the organization lacked the financial resources to absorb the financial losses that follow.

Compare those numbers to the cost of coverage, the median annual insurance premium for businesses with fewer than 250 as we stated earlier is 1,740 dollars. And organizations with strong security controls may pay even as little as 1,000 to 1,500 dollars per year. Even businesses with weaker security postures often pay far less than the cost of a single incident. The math shown here tells a powerful story. A one cyber incident that can cost an equivalent of 15 to 150 years of insurance premiums.

Whether viewed as risk management, business continuity, or financial protection, the economic argument for cyber insurance is difficult to ignore. Far more tangible, businesses that no longer exist. These are not hypothetical examples of worst-case scenarios. They are real organizations that suffered ransomware attacks that ultimately closed their doors. According to the research cited here, approximately 60% of small businesses shut down permanently within 6 months of a serious cyber attack.

Behind this that statistic are employees, customers, families, business owners, and communities whose livelihoods have been significantly affected. Wood Ranch Medical was a small healthcare practice in Simi Valley, California, that became a widely cited example of how destructive ransomware can be for small businesses. In 2019, attackers infiltrated the clinic's systems and encrypted both electronic health records and its data backups. Without access to patient records, scheduling systems, billing information, or recoverable backups, the practice could no longer safely operate. Nearly 6,000 patients were affected as a result.

And after months of attempting to recover, Wood Ranch Medical announced it would permanently close in December 2019. The incident became an important cautionary example in cyber security discussions because it demonstrated that ransomware is not simply an IT issue. It can become a business ending event. The case highlighted the critical importance of secure backups, tested recovery plans, incident response preparation, and financial resilience through cyber insurance and continuity planning. Brookside ENT and Hearing Center, a small medical practice in Battle Creek, Michigan suffered a ransomware attack in 2019 as well that devastated the organization's operations.

Attackers gained access to the clinic systems and demanded approximately $6,500 in ransom. The practice refused to pay hoping to recover its systems independently. In response, the attackers permanently deleted patient records, appointment schedules, and critical operational data, leaving the clinic unable to continue functioning normally. Without access to its records or viable recovery path, Brookside ENT was forced to shut down permanently. The co-owners ultimately retired earlier than planned and patients lost continuity of care and access to historical medical information.

The incident became a widely referenced example of how even relatively small ransom demands can have catastrophic consequences for small businesses and health care providers that lack resilient backups, tested recovery procedures, and sufficient cyber preparedness. Lastly, the Heritage Company, a 61-year-old debt collection agency based in Arkansas, suffered ransomware attack in 2019 as well that crippled its operations during the holiday season. The attack disrupted the company's systems, halted normal business activities, and forced leadership into a desperate effort to restore operations. Although the company ultimately paid the ransom demand, its IT team was still unable to fully recover critical systems and business functions. As damage continued to mount, the company could no longer sustain itself, and just days before Christmas, approximately 300 employees were informed that they would lose their jobs.

Reports later surfaced that the CEO had personally covered employee wages for a period of time in an effort to keep the business afloat. The incident became a powerful example for how ransomware can destroy even long-established businesses, not only through technical disruption, but through the cascading financial and operational consequences that followed. One of the most overlooked consequences of cyberattacks is that the damage often extends far beyond the business itself. Many owners are saying that once a ransom is paid, the system is going to be restored and the incident will be over. Unfortunately, the data tells a very different story.

According to the study cited here, approximately 80% of organizations that paid the ransom were attacked again. Even more concerning, 68% of those repeat attacks occurred within 1 month of the original incident. And paying a ransom does not remove you from the attacker's radars. Matter of fact, it often places you back on the radar. The statistics become even more alarming when we look at who conducted these follow-up attacks. 42% of repeat incidents are carried out by entirely different attackers because victim information is frequently shared or sold within criminal networks.

In other words, paying a ransom may signal to others that you are willing to pay. This is why cybersecurity agencies around the world consistently warn that ransom payments do not guarantee recovery and may actually increase future risk. The decision to pay can feel like a way out of a crisis, but the data suggests it often creates new vulnerabilities rather than eliminating them. The personal consequences can be just as significant as the business impact. For sole proprietors and closely held businesses, companies and personal finances are often closely connected.

A breach may expose not only business records, but also social security numbers, tax information, banking details, and personal credit. 24% of breach victims experience identity theft in the following year. Unlike personal credit, business credit generally cannot be frozen. It can only be monitored. That reality makes preparation even more important. The cyber incident is not simply an operational event.

It can become a long-term personal financial issue that follow the follows an owner in long after the technical recovery has been complete. So far we've discussed the cost of cyber incidents, the consequences of inadequate coverage, and the challenges organizations often face after an attack. Let's shift a little bit and focus on something more encouraging. The measurable value of preparation. Data consistently shows that organizations that invest in cybersecurity before an incident experience significantly lower costs afterwards.

According to the research highlighted here, small businesses with an active incident response plan can reduce breach-related costs by approximately 50%. Organizations with managed security monitoring and response capabilities can reduce overall security-related costs by 50 to 70% compared to businesses that are unprepared. The reasons these savings occur are straightforward. Businesses with active monitoring can detect threats faster, and faster detection leads to faster containment. Noted here, organizations using active monitoring achieve threat detection speeds that are up to 96% faster.

While businesses with tested incident response plans experience 75% more effective crisis response. Every hour an attacker remains undetected increases potential damage, recovery costs, and business disruption. By reducing detection and response times, organizations significantly limit the scope and cost of the incident before a major crisis occurs. The broader principle at work is that every layer of preparedness strengthens the next. A managed security operations center helps identify threats quickly.

A tested incident response plan helps contain and recover from those threats efficiently. Cyber insurance provides financial protection for the risk that remains. Together, these layers transform unpredictable cyber losses into manageable business risk. Faster containment leads to lower recovery costs. Lower recovery costs leads to smaller insurance claims.

And smaller insurance claims helps keeps future premiums under control. The organizations that consistently recover best from cyber incidents are not necessarily ones that avoid attacks. They're the ones that are prepared for them before they happen. As we conclude today's session, I want to leave you with a simple idea. Before you decide what insurance cyber insurance to buy, you need to understand what you're actually insuring.

Cyber insurance is often more effective when it is built on a clear understanding of your risk. The goal is not simply to purchase a policy, it's to make informed decisions that protect your business financially and operationally when an incident occurs. The first action item is to review your current business owner policies or general liability policy. Don't look at the declarations page, look at the cyber exclusions, electronic data exclusions, and endorsements such as the CG 2106 and BP 1504. Many business owners are surprised to learn that cyber insurance are specifically excluded from their existing coverage.

If you're unsure what your policy covers, call your broker and ask a direct question. If my business is hit with ransomware tomorrow, am I covered? The second action item is to document your current security controls. Can you demonstrate that you have multi-factor authentication enabled, tested backups, a documented incident response plan in place? If not, those gaps should become your immediate priorities before applying for coverage.

The third action item is to speak with an independent broker who specializes in cyber insurance. Cyber coverage has become a highly specialized field, and the policy that is right for your business may not be offered by the same agent who handles your property or liability insurance. Obtain quotes from multiple carriers, review the applications and the questions carefully, and make sure every response can be supported by documentation. Businesses that obtain the best coverage and the best pricing are usually the ones that approach this process deliberately. They understand their risk and can demonstrate that they have taken reasonable steps to manage them.

So, as we wrap up here, moving to Q&A, in March we offered some resources that you can get access to help you in your preparation. The cyber incident management plan template that we prepared for small businesses, you can go to our site and download that template and use it to quickly craft your incident response plan. You can also go to the NAIC Consumer Resource Center for information on cyber insurance frameworks, as well as to the FTC business guidance site. Next session is on July 23rd. We're going to go deeper into ransomware.

We talked a lot about that today. Not as an abstract threat, but as specific financial operational reality that small businesses face. We'll look at what it costs, what the decisions to pay or not to pay actually means, and why the coverage decisions you make before an attack determines whether you'll survive one. It's free and it's online as well as this one. If you found today's session valuable, share it with another small business owner who should be in the room.

Quickly, to help us to improve this series, we are open for questions. We want to ask you to take 2 minutes to fill out our survey, our session survey, which you'll see the QR code on the next slide. It's anonymous. It's only five questions. And it will help us to understand the needs that we can incorporate into further series or the components of this series.

Here's the QR code that you can take a quick picture of. And I believe SCORE will send that out to all the attendees of this session today. And with that, we can go into the Q&A. Are there any questions about what we covered today, or even the last session that we covered in March? Awesome.

Cyrus, I can help you out with that a little bit. I see some questions here. If I scroll back, from Brenda out there, do you recommend a particular endpoint scanner, like a Falcon or a Sentinel One, etc. Stacie, can you repeat that question? Sure.

It is, do you recommend a particular endpoint scanner? A Falcon, Sentinel One, something like that. No, we are we're tending to be technology agnostic. It really depends on your technology environment. Anything from Microsoft's MDR to I believe you're talking about CrowdStrike's CrowdStrike.

Falcon media 71, those are all pretty good EDR solutions. And there are many more on the market. So, Juniper, Cisco, they all offer EDR applications. It just depends on the complexity of your environment, your ability to manage it, cuz it's one thing to install it, it's another thing to manage it. And then the cost.

What is your budget allow for you? If you, for instance, have Microsoft 365, you more than likely get MDR as a part of that. So, if cost is an issue for you might want to consider using the Microsoft variant. Otherwise, any of those software solutions are just as good. Awesome, thank you.

A lot of feedback and just an excellent presentation, so helpful and just a really important. And somebody even said like just didn't realize how important this topic was. So, thank you so much for sharing all of these great resources and information. We are at the top of our hour. I can stay on for a couple minutes if Cyrus can and that you had a question in the Q&A.

We can go over those and maybe take 5 minutes to do that. So, otherwise, if you're going to pop off, I did mention in the chat that you will be receiving all of these resources with the in the email that you registered today registered with today. You'll receive a recording recorded version of this along with the deck presentation and of course that QR code to give your feedback directly to Cyrus and team. So, I'll just jump into a quick question from Bo. And how is the cyber insurance policy covered for AI and agentic AI for small business websites and related online services?

So, AI is so new insurance companies have not yet caught up to the nuances of issues that occur or the risk that exists with AI. What I would If you are concerned about risk, make sure that you document response activities in your incident response plan that shows that you've identified those risks and that you're putting in place to deal with any risk that might come up as a result of the use of AI. But right now, insurance companies have not caught up in the language and of course when they do catch up, it's more than likely going to be them excluding this or that because of the risk associated with AI. Thanks for sharing that and having such relevant information available. There was definitely an AI interest out there in our questions.

The next question comes from Angie. I am an e-commerce business. How do I make sure my site and hosting company has MFA in place along with the EDR plus IRP plus backup Cyrus suggested for lower premiums. The question might be answered Okay, got it. No, that's just like Was it answered?

Was it not answered? I'm not sure, but essentially, how do I make sure my site and company my site and hosting company has the MFA in place? So, Angie, what you're talking about is vendor risk management and we're going to talk a little bit about that in one of our other series. And basically what that is you preparing a list of these types of questions and sending it to your vendor who provides your hosting solutions. They should be able to effectively respond to the questions that you have in that that that risk questionnaire that highlights things like, do you have any EDR or an IRP in place?

What do your backups look like? How are you protecting my business? Most technology companies understand vendor risk management and are prepared for it. They might even have some of that information on their websites in an FAQ portion of their website, but if they don't, just simply call up the business rep that you dealt with in setting up your site or call technical support to ask them these questions and they should be able to guide you to a place where they've already provided these answers. But if it's not explicitly put in your solution, if you for instance haven't bought an EDR or backup solution, then you'll need to have that conversation with them in order to determine what they do in order to protect your business relationship with them.

Thank you for that. As you chat through this, I'm just looking at some questions and some things trying to navigate here. With the 1 minute, I'm going to stop us here if that's okay with everyone. I do see one question in here that says, which policy is for data recovery and which policy is for monetary damages? Is there one policy that includes coverage for both?

Yeah, so as we talked about the cyber liability and the tech E&O it depends on what your business is. The cyber liability piece would cover both data recovery and the What was this What was the second part of that question? It was I do sorry. Is there one policy that includes coverage for both? Yes.

So, your cyber liability would include coverage for both. But again, it depends on what your business is. If you are a technology provider way, we are, we have both cyber liability and tech E&O in place to cover us both in our service delivery and in our use our own use of technology. But the cyber liability policy should cover both of those. Perfect.

Thank you so much, Cyrus. I am just putting in my email address in the chat. I noticed that some people were interested in the March session and receiving that recording. So, I can certainly forward that out if you shoot me an email and I know I got an email address from someone already. So, that's fantastic and I'm certain that a lot of the answers to your questions are available in the resources that Cyrus shared, particularly some of those end resources with those specific websites and obviously at Data Defenders.

So, I am going to conclude this session today and we look forward real quick. Look at Yes. I see a question here. Someone did go to the resource page. The incident response plan template is in the white paper section of the resource page.

IRP and white papers. I'll just make a note of that in the chat here. So, if somebody's on and they can see it. Perfect. Thanks for responding to that so quickly, too.

Yes. Thank you, Cyrus. Thank you, everyone. I appreciate the time. Please sign up for Cyrus's next sessions.

You will see the announcement both through Cyrus's channels and of course SCORE sends out all of those amazing webinars that we have available. So, sign up and if you shoot me an email, I'll get you the old ones and I hope everyone enjoys the rest of their day. Thank you so much for joining and this will conclude the session. Thanks again. Thanks, Cyrus.

You're welcome. Bye.