Cyber Continuity and Enterprise Risk for a Mutual Property Insurer
Claims kept moving through a simulated ransomware attack during a hurricane surge, and cyber risk now reports to the board against a stated appetite.
Client name withheld by agreement- Client
- Mutual property and casualty insurer, $2.8B in written premium
- Region
- Hartford, Connecticut
- Year
- 2024
- Duration
- 13 weeks
- Scope
- 27 critical processes · combined hurricane and ransomware scenario · board risk appetite
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A mutual property and casualty insurer writes homeowners and small commercial policies along the Atlantic coast. Its continuity plans handled storms well, because storms are its business, but they assumed the claims system would be available while adjusters worked the surge.
State insurance data security requirements and its reinsurers’ questionnaires asked the same question: how would the company pay claims if a cyber event struck during a catastrophe, and who would make the calls?
What we did
The approach, step by step.
- 01
Processes tested against the calendar
We analyzed 27 critical processes, from first notice of loss and adjuster dispatch to claim payments and regulatory filings, against how many days each could be paused.
- 02
Fallback claims operation designed
A minimum claims operation using a separately hosted intake form, pre-authorized payment limits and offline adjuster workflows was built and timed with the claims team.
- 03
Risk appetite written for cyber
The board approved cyber risk appetite statements with measurable tolerances, and the enterprise risk register now reports against them every quarter.
- 04
Combined scenario exercised
Executives and directors worked through ransomware striking two days after hurricane landfall, including reinsurer notice, regulator contact and claim payment decisions.
Outcomes
What changed, in numbers.
- 27
- critical processes with tested fallbacks
- 72 hrs
- of claims intake proven without core systems
- 6
- cyber risk tolerances approved by the board
- 100%
- of exercise decisions assigned to a named owner
We plan for hurricanes every year. This was the first time we planned for a hurricane and an attacker at once.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Edison, New Jersey · 6 weeks
Offensive Security & Resilience · 2025Online Ordering and Pickup Penetration Test for a Regional Grocery ChainA flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
-
Albany, New York · 16 weeks
Offensive Security & Resilience · 2024Ransomware Resilience for a Gas and Electric Distribution UtilityIdentity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
-
Stamford, Connecticut · 28 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.