Speaker 1 (00:02) and everybody. Speaker 5 (00:04) you Speaker 2 (00:05) I'm going to introduce our moderator. Sandy Prudy-Garra, she is a season insurance leader with over 20 years of underwriting experience, specializing in financial lines including cyber and tech E &O management liability and professional liability. She has held senior roles at Hiscoc, AIG, and AFE, earning a strong reputation across the West Coast market. In her current role at Charpentry, Sandy leads a lot of the company's tech and cyber underwriting practice on a national scale. She is known for building high performing teams, driving profitable growth, and leading innovative market response initiatives in competitive environments. holds a BS in Management from Golden Gate University and is recognized for her blend of industry expertise and thought leadership. The floor is yours. I'm from Parametric, business interruption, and talking best of care here to my heart. We have a very diverse group of panelists here to talk about business interruption. As we know, cyber business interruption has become more prevalent, and right now is trending towards one of the biggest payout when you're talking about the cyber incident. Show of hands here, how many people have been through a business interruption loss? Speaker 1 (01:32) you Speaker 2 (01:34) And how many of it was related to cyber? Awesome. So for those of you who haven't been through the business interruption, loss, and how that all plays out, we're here to have some takeaways for the audience and some education process on how that all works. But we're going to start from the very beginning. And that's talking about the misconception of cyber. So Joanne, I will have the panelists actually introduce themselves. So Katherine. Hi. My name is Katherine Lai. I am the head of cyber claims and incident management at Tokyo Marines, HCC, a cyber professional alliance group. It's great to be here. It's great to see so many of you. Speaker 1 (02:16) Hi, I'm Scott Doss. I'm co-chair of the Insurance Recovery Practice at Barnes and Thornburg, where we represent corporate policyholders, corporate insurance individuals, directors and officers in insurance matters, where we are helping them to explain why coverage is owed. And I switched into this practice area back in 2001, and I was in this... skunk on the fortune of carpet party. Thanks for having me. Hi, I'm Josh Foley. I'm the president and captain of the Department of J.S. Health. I'm a senior vice president. And I have experience with side flames. Yeah, we assist carriers in the review of side claims and that. Speaker 2 (03:11) I'm the property BI leader within our cyber solutions practice. Came from 30 plus years in the property world. Business interruption is a true passion of mine and I love the variances and nuances and the differences between. We'll talk through that a lot today but hopefully we'll also misunderstandings that are out there around business interruption as a whole when it comes to cyber. Yeah, I almost forgot to introduce my panelists. I was so excited to get into these topics. But yes, Joanne, thank you so much. We'll start with you. In terms of common misconception, and we're going to give each panelist their perspective, because again, we have a very diverse background in terms of their experience. So Joanne, as a broker, I'll start with you. What are the common misconceptions about business interruption? Thanks, Sandy. think that the biggest one we can start with is just from a buyer's perspective, many insurers anticipate that business interruption recovery under cyber will be comparable to what they're accustomed to from a property point. And I think that's been one of the biggest challenges we have as a group to be able to manage expectations. So what does that mean? When you think about it from a coverage standpoint, there's under property physical damage and you have your lost revenue plus continuing expenses. to extra expense throughout the duration of the time it takes to rebuild the bricks and mortar. When you think about from a cyber perspective, it's very different. know, the nuances of cyber and the triggers around cyber and the coverage grants afforded vary by everyone you meet with. The market is a home does not have a standard approach to the valuation of business interruption, meaning how will it be calculated? There's a difference around period of restoration. What is that length of time? Under property, again, you don't have a set typically period of restoration. You have until you're completely restored. So from a buyer's perspective, they come into a side of the world for business interruption and have a limited period of restoration that can range from 30 to 180 days. In some cases, you may have three under 65 days. Under property there's also extended period of indemnity where you actually have once your systems are restored or in the case of property the properties have been replaced or repaired then you're to have an additional period of time. So they're coming the buyers are coming from a world of anticipating similar comparable coverage for the length of time that they would under a coverage that they had where they feel it's the same. Candidly it's our jobs educate what's different. Let's look about the triggers under the waiting period. Is it a qualifying period? Do they have the SIR calling after that? Or is it truly no coverage for that first eight, 10, 12 hours, whatever form policy? Again, the inconsistencies of policy language for cyber creates challenges for the buyers. And I'll pause there because I know my panelists have a lot of opinions on this as well, but just from a holistic standpoint, it's a good idea. I think what you touched upon, though, is really important with a thought on this. is that they may have experienced something in a totally different line of business. And so yeah, it's different in cyber, but the answers are there, meaning that if they read the policy, the answers are there. So one of the misconceptions I get is we get insurers that say, oh, well, this is income loss. it's like, but look at what income loss has defined us. And in their head, they're thinking, every bit of profit, everything that I have, get to kind of double down. Speaker 1 (06:17) you Speaker 2 (06:42) saying no is actually your net loss. And so I think that is when you're talking about those kind of misconceptions it's not fully reading a policy to understand so that we're all speaking the same language. I think that's where misconceptions arise from is because we need to make sure that we're all speaking the same right from the same diction right shall we say or just looking at the policy organs. So that's one of the big misconceptions. ⁓ that an insurance sees it as ⁓ they don't have a responsibility to also try to limit the loss, right? But the driver is to always, as all of us are trying to do on an everyday basis, is we're not trying to step into loss and make things worse, right? We're all trying to make things better. So too should the company, right? Let's make sure that they are trying to limit any more harm that's coming their way. Scott. Speaker 1 (07:36) If I may, one of the things that Joanne mentioned was property versus cyber. And a huge challenge is with a property loss, you so frequently have the ability to show pictures and show the physical changes. And so for example, if your production line burned down because your faculty burned show a picture, here's the half step we're taking to be able to reproduce this elsewhere, another way, another fashion. You can show a picture of that and show the adjustment and explain, look that line is still down, that line is still ashes on the ground, this is what we're doing, try to fill in and do a cathode sink and continue. as a cyber is extremely difficult to make that same presentation. Because you can say, yes, we did implement a new network. We have done the following things, but it's not operating the way that it used to. And we all, every single day, operate and use computers to get through the entire day. We all know what it's like when our computers are not functioning the way they're supposed to. But making the explanation of, yes, we did restore the system to a degree, It's still not functioning. It's huge challenge for us, presenting how the loss is continuing. Speaker 2 (08:49) Yeah. you Speaker 4 (09:03) Thank Speaker 2 (09:04) That's a great point when you look at it from period of restoration. How is that defined? Is it systems restoration or is it business operations? And what's the difference? And again, we see such varying language throughout the industry. It's tough to help explain that upfront, particularly if you have a buyer that's contemplating a change in their primary insurer. You really, really have to make sure they understand the impact of that to avoid the pitfalls because some of the challenges I think we all see is the buyer's perspective of business interruption being that greatest pain point at the time of loss. And we'll talk through how we avoid some of that through proactive approaches. But I just wanted to clarify that from. Yes, no, thank you, Joanne. Josh, from the accounting of Royzick and County perspective. Literally, the comment just can't. Speaker 1 (09:55) What we've seen and in my experience it's being sure whether they're not experiencing the claims process or there's maybe their first claim. They'll submit a claim and not consider the actual loss sustained. So in the policy you'll see it'll state loss net profit and continuing expenses or loss net profit plus continued expenses and the... So we've gotten a lot of clients where it's just their continued labor throughout the clean process. Not actual labor, just their continued labor because it was sitting around ⁓ unproductive, but they had no loss of sales. there was no actual loss of standing, but they feel like they could have sent their labor home. reimbursement for the late. It's understanding, because they see it in the policy, but they just don't think, ignore the part of it that's actually lost. Speaker 2 (10:57) Yeah, and I think one of the challenges is that our policy has evolved over the years on a cyber front, especially around business interruption. So with that, I'm going to segue over to just the evolution of our policies and why that is causing a lot of confusion of what's covered, period restoration and all of that. So in terms of the evolution, can you provide your perspective? You touched on it little bit about property and cyber. Can you just elaborate? to when cyber started, obviously it was privacy related. You fast forward to where we've grown in terms of ransomware triggering business interruption losses. The focus from the industry, both from an exposure standpoint and claims, candidly has grown to cover business interruption. So again, the nuances of what that means and what we've seen particularly in a hardening market to a softening market, that breadth of coverage that's now available. When you think about what used to be dependent business interruption, It was very specific to IT providers. Then you had non-service IT providers. Now we do a full supply chain for the incoming. What about the outgoing? What about the customers on the other end? cyber breach compromising business interruption to our insurers. There's a growing need to cover it across both sides. At the same time, we want to make sure the industry as a whole stays profitable. And how do you get the underwriting information that you need to effectively understand the risk that you would be assuming if you did that breadth of cover? So there's a lot of nuances. Again, from the buyer's perspective, while we sit here from cyber and understand that evolution, from the buyer's perspective, many of them are frustrated that what they feel is either a reduction in cover for what they feel should be a norm and a lot of that ties into basic coverages around extra expense. In property, expenses to reduce your business interruption loss are included within your business interruption calculation. True expenses above your normal operating costs is how extra expense is defined in the property world. So when you shift to a cyber claim and you're now going to limit the recovery under a, whether it's a forensic accountant doing the work or what the client is submitting as well they feel is a BI loss and now it's either going to be sub-limited. Again, some of these coverages have grown from sub-limits to full coverage today. Again, we can't ignore the fact that that is increasing the exposure on the underwriting side. So what's needed to help you get comfortable with the risk that we can usually work together to serve our clients. just while you were saying all this, remember being 2016 at a cyber event in San Francisco, and I remember watching a panel, and someone in the audience asked, they're like, what do feel about being up? And the person retorted, it's like, haven't paid yet. Which is kind of not really funny now. ⁓ But they also were then talking about ransom, and I can remember when Speaker 5 (13:53) Do you want to? Speaker 2 (14:04) and we were paying these cute little payments of $2,000. And I was like, aw, that's cute. And I'd love to be able to go back to that. And I'd love to be able to go back to the days where we were questioning whether this insurance that we were providing was ever going to pay. I think it's shown again that seeing with everybody in this room that's practicing cyber, the policies work, right? What we're selling does work, which is great. We've seen it grow from just being true business interruption to having contingent business interruption to then being dependent business interruption. And now we're getting pushed for non-IT business interruption. And some on this panel have suggested. that we should now do consumer business interruption. I'm in place, so I don't want to see it, but I'm sure my underwriters will be offering that soon. But so these are, this is like the progression because we're now seeing it works. And so anytime that I then hear from an insurer that's like, hey, you know, does this even cover anything? I'm like, are you kidding me? Like from 2016 to now, it's really been progressive. And it's responding, right? We're responding to what insurances, what brokers, what our clients need. these companies recover because before they weren't recovering. So we've given this great insurance. It'll be interesting to see where it goes now and then it'll be interesting to also see as the market hardens how it swings back. We're also gonna be seeing, I think, with that whole issue of business interruption, you spoke about sublimits, that possibly new, not new industries, industries that have now been serious targets might have stronger sublimits on it. But I think we're also going to be aiming even harder to technology. To saying, okay, if you're answering your application, saying that you have the appropriate technology enforced and implemented, then yes, we can give you the full limits. If not, then we really need to be talking about subliminal coverage. That again, then puts the onus back on the insurer to be like, I'm going be a responsible person in this community and make sure that I have the appropriate technology and protections in place. Speaker 1 (16:24) you this goes to, there's also a question from the audience, we'll tie them together, was, the industry standardize the definition of restored operations for business? I think that's the underwriters to how you all want to distinguish your policies. if you've read one cyber insurance policy, you've read one cyber insurance policy. And to that point about how things have evolved, we are seeing different policy language in terms of the period of restoration of what's being looked at. Some carriers are writing forms where it turns on the... systems are restored and it's very specific to say computer system. particular language chosen and there are others that say business operations are restored. Again, very particular language and I'm told time and time again when can be... contract language is important and it controls and also told by courts that every word has a specific meaning and you wouldn't, within the same words it have different meanings. And so if we have some form saying that it's when the computer systems are restored and some form saying when a business operations the interruption is no longer taking place, obviously paraphrasing, then they obviously should have different meanings such that the ending of the interruption business operations should be the impact on the business overall and not the date that the systems are restored. And yet, and yet I have a job some days because I'm told that. business operations being interrupted or impacted is the equivalent to the systems being restored. Instead they'll say, well your system was only down for three days. And so therefore your period of restoration is three days, regardless of policy language saying interruption to business operations overall. And so what I see from insurance is, invariably they are saying our systems may have been restored or maybe we got the ransom key after three days and then we start the process of restoration and for those, well they all have the mindset of gosh utility, business is no longer interrupted, impacted, etc. then I'm making a claim for business income loss is extra expense. Sometimes they have to be told for the language where it says the date of computer system restoration that it ends then, and others have to have advocacy done on their behalf to explain that the period of time that the business is interrupted is the period of time for a period of restoration. ⁓ Some friends and accountants agree with that. I'll finish the sentence there. Speaker 2 (19:41) What's left of the machine? Speaker 1 (19:44) So, she put in the spot. As far as that, we take directions from the camera. I think the most important thing for us is to communicate with the carrier. Speaker 2 (19:48) No. Speaker 1 (20:02) For example, as I said before, if we see, if we look at a claim and we see that it doesn't appear as a loss of sales, but they're claiming continued expenses, it's important to tell the carrier, not immediately, but right away. So we don't need to insure that two weeks, three weeks, a month of asking for other documentation, only if it doesn't be told that they don't have a covered loss. ⁓ As far as evolution over time, as the ⁓ policies change, you just have to learn what to ask for, get the right information with the timeline thing. So we can lay out a timeline and put the costs in buckets for the carrier to look at. And just help the carrier and the insurer work together because it's their business partnership. Yeah, that's it. think it's just communication. Speaker 2 (21:02) Yeah, Joanne, you mentioned in your perspective, from the broker front, in terms of communication, how does that all look like? Communication is key and around business interruption we find that lack of communication is what causes a lot of the angst in the settlement for negotiation of the claim. Business interruption is a hole when you look at it from understanding exposures upfront to what's actually happening at time of loss to what that yield will be on a group of loss to the actual outcome of payment. And you Josh mention they're going to follow what the carrier is doing. The insured often at times is going to hire their own forensic accounting firm. they approach that will vary depending on the industry. So it's really important that there's communication with the insurer to understand how beneficial it is to them to loop in the carrier at the onset. You know, we understand when you talk about cyber, the criticality to any client is to get up and running. They're not going to necessarily focus on business interruption from the onset. You're going be dealing with a potential ransom where you're going to be looking at systems compromised. How do we keep business running? they're going to do everything they can and at times use their own staff to be able to effectively minimize the hours it would take to bring in a third party to do that. So is that payroll contemplated? Should it be covered? expensive than to bring in an outside party. These are all conversations that could be happening through effective communication and candidly they don't. In some cases they do. Every one of us that have lived through a claim has seen different responses there. So from my perspective, if you work with the clients proactively to say, when you're doing your tabletop exercises, it's important to understand how you're going to handle a business interruption claim. Who are you going to bring in? And let's do that dry run. Let's set up the journal entries to track all expenses. Let's do everything we can to effectively have those captured at the onset so then you can start those buckets of where might be contentious for actual coverage versus what's going to be covered. So from my perspective communication is key. The group of questions, we are going to address them and I will ⁓ go ahead and address one only because it's relevant to what we're discussing right now. recently we've been seeing VI claims taking longer and... Speaker 1 (23:10) you Speaker 2 (23:24) to settle between the insurer and insurer. What are some of the reasons for this delay? I mean, can jump in here. Obviously, general question. I can't say from the question, know, who's taking, why it's taking on this example of what people are seeing. One, the lack of communication, lack of preparation. So I'm not going to dive into communication. That's not beautifully, but lack of preparation. so insurer may say to insurer, hey, right in the beginning, this is what to expect. Are you experiencing BI? The insurer can respond, no. And then six months later, all of sudden they're like, ⁓ by the way, we had a BI thing. said, hey, by the way, I know you're doing this, OK, anything we can help you during the process of rebuilding, you need to have outsource outside support. Is there a less expensive way? Can we hire someone to start tracking these things for you, right? All of those types of things. So we can get caught behind because we didn't know even though we asked. Another place is that often, I'm trying to read that, not providing. Speaker 3 (24:35) . Speaker 2 (24:36) So we have a situation where Josh is pinch hitting because another panelist had lost her voice. So now she's holding up signs to say, and remember. Speaker 1 (24:47) I'm just reading all this. Speaker 3 (24:48) Thank Speaker 2 (24:50) correct and not providing documentation. So someone may say, ⁓ all I'm recovering is my payroll. And you're like, yeah, but we need to see your sales. And we also need to see these elements because we need to see the net, right? We need to show that it was a net loss. wasn't just, right? Or they'll just show sales, but then they won't show the payroll. But they were like, I let go of six people during this time here because we didn't need them and we just shipped out direct. Right, so we need to have that information. And I think those are the things that tend to slow it down because then we have to go back and ask. And they'll say, well, I've you everything. And it's like, I understand, but we need to see this too. But I'm not trying to recover on that. And it's like, we're just trying to do everything the policy is providing you. And it's not, you know, it's not marksmanship. It's not, we're not playing chess. We're just trying to have an open communication. So I think that's really what tends to slow these types of things down. So I think early communication right away saying, this is BI. side is when we do offer a forensic accountant reaching out and saying hey we'd the forensic accountant to speak to you so that you can understand how they are going to be tabulating this net loss right because they may say wait in my industry though we do it this way okay great or their forensic accountant can go and speak and they can both agree on how they'll be tabulating so we're not tabulating one way and tabulating another way and then having to negotiate. So I think those are some places that we're losing time. And I think that's a... is quite an undertaking from the insurer perspective in gathering all of the necessary documents. So from a forensic account perspective, what are you guys looking for and what are some of the critical documents that will help you? Speaker 1 (26:46) Well, now we've changed based on the company. But the general documents would be in a short loss, if it's a week or two weeks, you want to see definitely weekly sales, not daily sales. If it's a long loss, you may want to see daily and weekly to the start and end of it. then you want to see profit and loss statements. Is those cash in the detail expense diamond off the basis? You want to know that they're on the referral basis in that cash. Then payroll records and you know if it's know production company there would be. There was some time you did that more than a Yeah, it really depends on Like a convenience store or restaurant would just have daily sales. Speaker 2 (27:43) you for, right? We want to see where your standards were. We want to see then afterwards your recovery, right? Was there a time period? Yes, you were down through that time period, but then did you have a rebound time period? So we'll go a few months after to be able to say, oh wow, you recovered this year. Or again, depending on the industry, are we seeing seasonality, right? Did you happen to be in a dip because no one's buying X at that time period? And so it's actually a natural dip. that we're seeing, not a cliff because of the event. ⁓ Or there's all those types of different aspects that we would like to be able to see. I'm trying to think of other things that, again, changes my industry. Speaker 1 (28:26) I just have one more thing too that we're seeing in cyber times actually move their time periods. Customer contracts where like, you know, they'd have a cyber event and you'd be down for let's say like two weeks, let's just say a month. They lose like, they lose a bit on jobs or you know. You know, that contract wouldn't translate into driving for another 12 months, which is outside. So that's been an issue. Sometimes that helps, that can help them, but you're just looking at a few sales and you're not really getting the full picture. But if they can give you details, like, this is a customer that we actually lost sales to. Speaker 2 (29:10) Amen. I think that's one of the differences when you look at the challenge of that painful messaging because candidly from the insurance perspective they lost that opportunity directly tied to the cyber breach. So why are they penalized over a period of restoration? From a broker perspective we need to fix that wording because the intent of if you want to make a hole and if they lost that opportunity that's a lost sale granted it wouldn't have happened to materialize but it's captured in that time frame and that's that's kind of a miss. Speaker 1 (29:43) you Speaker 2 (29:44) between, misconception between parties. Do you hear of anything like... Speaker 1 (30:00) Why is this so difficult? Always. Why is this so difficult? Why are they asking so much? I've given them this information. Why is this taking so long? sometimes, if it's the spot where, let me say this as a preface, I don't usually get brought in where everything's going great. So if everyone's got a plane that's going swimmingly well and we're getting along and the carrier's. Speaker 3 (30:01) you Speaker 1 (30:28) making partial payments as things are happening, then great, I don't give a ball to those matters. But the ones where they go sideways and the payments are taking a very long time and the carrier is asking for endless information, that's where it gets painful and that's where it gets difficult. When there are situations where they insure has provided the information directly and through their own forensic accountants. It's very painful. Catherine and I have never had a situation where we worked together that I know of, obviously she's doing everything right. But if the, if the carrier brings in outside counsel to, in their own forensic accounting and things are taking a very long time and there's already been a full forensic accounting report done and the policy lawyer says why is this taking so long and why are they asking for this and why is this worse than my nightmare IRS audit and so why is this not happening and again a challenge in the cyber context is don't have the ability to point to the factory that is just ashes. and say, we're continuing to try this. And everyone's scrambling around to try to get the company back up and running. so, again, 1,000 claims get handled appropriately or close enough for horseshoes and hand grenades. Great, I don't get involved. That's 1,000 and first, where it's endless questioning, it's endless asking for information, it's endless double checking, triple checking. That's where I have clients that get to the point of exasperation and try to figure out. why is this happening the way that it's happening? And oddly enough, it tends to be the spot where somebody personality-wise rubbed somebody else personality-wise the wrong way. And now we're in a corporate situation where we're dealing with that. And then there's a level of distrust on both sides. And if I may, there's a question about navigating the VI plane, you've got multiple forensic accountants brought in by multiple. I'm recommended, but as a policyholder, absolutely not. As a policyholder, I have been in that exact situation. I've been in a situation where a policyholder brings in a forensic accounting firm, I'll put it this way, that has a relationship with that arena room, and so a trusted business partner. situation where one carrier agrees to pay out, I've been in a situation where a carrier brings in their own forensic accounting firm and they pay out, and I've been in a situation where other carriers bring in their own forensic accounting firms and they don't want to pay out. And everybody's different numbers. And so then explain that to the insurer. How can it be that there are different numbers? Is it based upon an interpretation of policy language? Is it based upon... I don't think had enough information, even though these two or three others did. And there are multiple other situations. was a matter that was in Maryland where there again, were multiple forensic accounting. where the insured brought in an accounting firm that's well-liked, well-trusted in this room, and then still questions. So how, as the insured, do present a claim in that situation where it's, hey, our loss was X millions of dollars here, but over here, well, you don't have any loss at all, or no loss reaches our position. And is it a policy language, is it an accounting question, or is it something else? Speaker 4 (34:09) Thank you. Speaker 2 (34:10) There's two people that really need to leadership in that moment. One, the primary carrier needs to be openly communicating with everyone in the tower and saying, this is what we're doing, we're hiring some friends accounting. Hey, does everybody want to join to the party? Because I think that is extremely helpful. to the insurer. Second, I also do think that the broker should see this or the claims group within a bird bridge house to say, hey, wait a minute, we know that this is going to be a tower loss or it's going to bird up through the layers. We need to all bring all the carriers together at this point in time so that we can maybe agree so that you all have one forensic accountant and we have one. I've seen it done, I've seen it done successfully. I've also seen it done the other way. And so I hate it if I'm up on the tower and my team's on the tower and someone in the primary is like, oh yeah, we just paid because we got a forensic accountant, we had a million, we knew it was gonna be gone, so we just paid anyway. And it's like, you're really setting everyone else up for failure. And then again, just don't scramble. Maybe reach out and say, hey, does everyone want to come in? And this ties very specifically back into communication and back into the evolution of the market. It's very common today, at least on the large corporate accounts that I own represents that we're adding that name forensic accounting firm through the tower. You have that free degree and then you don't have the fight. We will still have a negotiation between obviously the forensic accounting firm on behalf of the carriers versus the one that the insurers themselves hire. But that's okay, that's natural business and retroflames process. ⁓ with it with one versus multiple layers in each market using their own firm, starting that process over from scratch each and every layer is a painful delay that really is not necessary. I actually like this question here, there's like does the accountant make insurers the accountant of the week, insurers very afraid of forensic accountants? I would love to That would be great out there, taking a team, shooting everything up, and doing really good work. I think the credits of the audience, there's a question that are coming in. know it's been a flow of our agenda, so keep the questions coming. ⁓ Speaker 1 (36:31) of ⁓ Speaker 2 (36:39) you Thank you so much. So streamlining and communications are very important to the process. In terms of, Josh I'll bounce this to you, in terms of the lost revenue, delayed revenue, I just want to go back to that really quickly because that is really part of the discussion. Speaker 5 (36:49) Thank Speaker 2 (37:06) feel like that is a highly misceived point when we're talking about business and what option claims. Can you just tell us a little bit more about that? Speaker 1 (37:15) As in, like what I said about the lost bids or the contracts. Speaker 2 (37:20) Yes, like delayed reprimanding versus actual loss. Speaker 1 (37:23) Yeah, so, it's just say construction company or a general contractor, you know, they'll submit bids and then they'll have, um, you know, a bid win percentage, you know, and they get like 60 % of their bids. So, let's just say a claim comes in and it's for a week, it's five hour average for a week and then they lost the ability to bid on jobs and they're normal. So the period of interruption would be that week of the service average. But that bid wouldn't be awarded maybe for another three months. And then the project wouldn't start for another maybe a year after that. So the actual revenue that they lose is in the future. They're working on jobs that they bid for. Speaker 2 (38:25) And I think it's not going to be true that they lost the opportunity to bid and the window closed. So it's not delayed revenue, it's lost revenue. These are the kind of things that you're going to get into. we jokingly had a debate prior to, so we wanted to embarrass each other on stage. But I think it's healthy for you to see that these are common things that will happen. Speaker 1 (38:50) Yeah, think the argument would be, and this may not be the case with some companies because they've at a high level of job they can, but the argument would be in the time between that job is going to be awarded or performed, they could bid on another job. If you were in the spot, I take something that's here and dear to all of you, if you were in the spot, you're insured. And I can't imagine an insurance company ever selling an insurance company. It did. It did. And you as an underwriter were unable to quote new opportunities and bring that money in for two weeks. you managed to quote and then sell everything that had been in your desk prior to the interruption, and then two weeks you were completely dark, and then you went back on with your life, you wouldn't say, well that's fine, there's no loss there, I didn't lose anything, there was two weeks, because I finally, after the interruption ended, I turned back to what was sitting on my desk, and I... managed to sell those policies. But during the two weeks of those darn events, it's as if I lost nothing. Because I did all of the work, did all of the jobs, and was able to complete the placement of all the purchases, all the policies that I wanted to have purchased during the prior time. No, you lost two weeks of opportunity. Maybe there was a situation where a forensic accounting firm has said, yes, if you completed all of the things that were on your desk prior to the event, and then you took on new work after the event, then you had no losses because you operate on a contract-based basis. ⁓ I would never tell you about a real scenario. But those are sorts of things where you can see back and forth in terms of the forensic accounting firm where... And if you are in a situation where, for example, everyone's all over the laws, what controls, and New York law seems to be the one that everybody loves, there is New York authority talking about, in a business interruption context, if you lose the opportunity to generate revenue during the period of downtime, you can still recover from the lost revenue, even if it's outside the period of restoration. So it ⁓ is a challenging spot to have that conversation to represent the insurer and the insurer to you is, what for this loss? What for this event? What I've had this loss, how things would have gone forward otherwise? It's not always the same mindset on. Speaker 2 (41:32) in the claims world. What's your view on the labor body? So uncertain. In certain industries, you can see that they will have had a dip down and then a bone back up. There's certain industries where there's no need to see to it. So obviously, with a hospital, if someone's coming in for an appendectomy, it's not something they're going to make up later. Someone's going to wait for that emergency procedure. They're going to go somewhere else. Say a car is going in for an oil change, but they're like, hey, we're down. Can you come in two weeks instead? And they're like, yeah. problem. Same with your dentist, right? If you're going in for an emergent root canal, obviously you might go see someone else. But if you're going in for a cleaning, three weeks later it's going to be fine. So you're going to see that dip, but then that actual recovery. So it's going to depend on the industry. ⁓ However, do take exception to the, I could put out all these bids, and then the insurer being like, I would have won them all. It's like, really? You would have won every single bid? So there has to be a way that we're able to say, okay, which ones could you have won, which ones would you have won, which ones would you never have won? And if they were like, well, I would have just underbid every single one, it's like, well, again, we in because not everybody takes the lowest bidder at all times. ⁓ very industry dependent, ⁓ again it takes that open communication where you're saying hey look we're looking at this and this is why. ⁓ I don't advocate for letting the forensic accountant only be the mouthpiece. I think that the claims department needs to be able to say and speak with confidence as to why they're asking for something, what they're looking for, and how the policy wording goes forward. Because if you can put that, let's be honest, it's a service. you put that forward, someone's going to then trust you more, right? And say, okay, thank you. Thank you for having that discussion with me. that's again how we avoid. Speaker 1 (43:48) I'll see you in a moment. ⁓ Speaker 2 (43:51) But that's how you avoid the problems that you can run into. So I'd say that's where the recovery exists and how to avoid some of those issues. Explain what you're looking for. I think. was nice. should win when this one comes. I think that piece is going to be very readable. It's going to be the thinking of the insured versus the claims and forensic accounting. You can also have an amazing, that we've seen, listen, anybody in this room that's in cyber, everybody here can say they've always seen something crazy. It's like, I've never seen this before. Like you've seen situations where you have an insured who has a completely full stopper. So during the course of the event. Speaker 1 (44:39) you Speaker 2 (44:40) They just burned everything. They were like, we just shipped out everything that was in our warehouse and the whatever. So they didn't have any loss. But then soon after they burned through everything in the warehouse. Now it's like now they don't have anything because now they have to rebuild all of that. again, open communication, working with your broker, being like, this is how we think we should handle this. Because we're always going to run into something that's new and novel and that we haven't seen before. But the only way to do it is to rely on your wording and openly communicate about it. And you do it on onset. Collaboration and the team will be most effective. ⁓ And then in terms of the I'm sure this will be something that now I'll be working on We do see the mistake as a coverage being offered. We do. It's absolutely, we also are seeing not just sublimates but endorsements to pay for the forensic accountant of choice up to a certain amount. These are all, these are great ideas that work in certain markets. In the smaller markets sometimes not needed as much but it's possible. Speaker 1 (46:18) you Speaker 2 (46:19) I think you raise a great perspective when you think about small market versus large risk. Those needs are very, very different. At the same time, why not consider something like that? From a broker perspective coming out of a property world that covered a lot of this routine, totally respect it as a different risk for cyber. At the same time, we can't lose sight of the fact that cyber is aggregated. It's not a per occurrence limit. You're protected with that and you're talking about one insuring agreement around a sub-limit of most coverage deployed being at five or 10 million compared to the significantly higher limits that your brothers and sisters are doing on the other side of the house. So when I look at cost of capital and profitability, at across the board. And I struggle candidly with some of the limitations that currently exist in cyber, but I do think as the cyber industry continues to evolve, we're going to find better clarity between products because at the end of the day, it's a reflection. And if you look at a risk manager that's not happy on a claim settlement, we all know they have very long memories, and now it's the market that they don't want to consider based on this event. Not dissimilar to those that won't consider a cyber market because of a bad DNO situation. What we don't want to do is have cyber limited opportunity for the growth of any one of our companies. What the cost of preparing it is that could you slide that into extra expense of saying hey look, so that we didn't miss a bid and we didn't lose the opportunity. We worked with an outside resource that helped us prepare this bid. So again, knowing your was like, but we're offering that kind of cover already there. So you don't need that, but you need to be aware of what your policy says. And if you question, right, that's where claims can be like, well, yeah, you know what, this is something we can actually help you with. We can help connect you to someone that can help you help prevent that loss, right? So again, just back to just ask. And again, I love that perspective because from a buyer, if you think about it, business interruption coverage, what's the intent? You want to make your client home again. They should not get a lottery and be greater than where they were, had they not got the loss. But they shouldn't be losing significantly less than where they would have been either. And again, that communication is key to avoid those kinds of perceptions. But you get into a lot of that, it becomes very confrontational if they don't understand the process and they don't understand the words that get them to the recovery they're entitled to under their own policy. So it would be great to have, like I would welcome that kind of question, as soon as they look Speaker 1 (48:45) you Speaker 2 (48:51) How can I do this? Like how can I? I know your hair's on fire during a cyber event. Your broker, right, your great successful broker is gonna be like, hey look, these are things that they're gonna be running into. And so there is cover there. And reach out to your carrier because we want to make sure that insurance works. This industry doesn't work unless we do make it work. So Scott, once it does get to your world in terms of... biggest pitfall happens when it gets to you is that lack of communication. Speaker 1 (49:28) does it come to you most of time? Most of the time it comes to me when everything's gone sideways. The matter is I have do the most work. Everything's gone totally sideways. Do to get a lack of communication or? situation. If someone's made an internal determination that, we just don't believe this reaches our layer, we don't believe this is part of it, don't believe their losses are what they are, and then asks endless questions and endlessly takes time to, I suppose, internally. to other forensic accountants, multiple forensic accountants, multiple attorneys. Why is it happening? Well, again, if they've internally decided that they don't want to pay, and they're not going to come out and say it flat out, well then that's, there's a level of exasperation is going to mash up the policy of the reciters. They think, you're asking for this information, I'll give it to them. But that's more of an outlier even from my point of view. A lot of times there is, so substantially, the You all are professionals and this is what you do. And claims people are professionals and this is you do. And friends and accountants are professionals and this is what they do. And I suspect and I've seen it, companies that go through this, it's almost always their first time in an event of this nature at all. And they're confused and their company's been shut down. And imagine, I know it's trite, but imagine coming in on or being told on a Friday night, everything is shut down. The company you cannot do it, you can't check your email. can't do all the things you do to run things. And everyone's struggling now to figure out what do we do? Again, it sounds super trite because we've all been doing this for a very long time. But for them, it's the first time. And then trying to figure out how do I work with the insurance carrier? How do I make this happen? I would love to be in the spot, well maybe my accounting department would not, but everyone's like Catherine, and everyone's like, hey, let's work together, let's be reasonable, and let's figure this out. And there's a thoughtful conversation to get to the place where this is your actual loss, and I understand your business, and I want to help you, then I almost would never be able to come in on these situations. But if it's a circumstance where outside counsel is brought in, and they view their role. as an advocate for their client and not for necessarily even in the view of what is going to get the most coverage or not even in the end, what's gonna get the most coverage and you can get to the place where it's the policy holder 100 % back. Again, that's where the level of exasperation starts to hockey stick up. The first ransomware matter I worked on. a circumstance where it was a London market carrier and they brought in outside counsel and that outside counsel spoke outside insurance counsel language and the policyholder of Silicon Valley startup did not speak insurance speak at all. and they threw their hands in there and they brought me in. And actually that claim worked out very smoothly and didn't take tons of time because I was able to translate Silicon Valley into the Sharon Steak and vice versa. that's what you hope for situations like that where it takes translation, it takes working through the situation and explain why things are being asked for and understanding what can be shown to get the carrier where they need to be. And in the... perfect world there is a thoughtful explanation as to why these things need to be obtained and what information is needed and why. if it's a situation to say, look, I need the following things. I know you think it's ridiculous and I know that we all understand it, but I need the following things because, and maybe that's something more people are more willing to say, a regulator might look at my files and I need to have this, or somebody else might look at it. Sometimes there are things which insurance affiscates no. Maybe the primary carrier's wondering if the excess carriers will gnash their teeth because the limits were paid out and they want to make certain that they're completely that one on that front. That the X is carried. Why don't you paint that out? That's ridiculous because X, Y, and Z. Or maybe there are other things that the secrets that we're wanting to know about, like, well, I want to mention names and things, but there are things that happen where if the policy would feel, listen, need to speak up. And I'm doing this because then it's a much, much easier conversation and I get brought on fewer times than those things. Speaker 2 (54:11) No, thank you so much. We do have a little bit of time left and I do want to get to questions. But what I'm hearing from the panel is that we can all take part in improving the communication process. We're all trying to collaborate and resolve the issue and claim. I thought we were going to get through the session without talking about AI. So I think the question was around artificial intelligence and how we're utilizing that in terms of clean handling process. Anybody want to take that on? On the clean handling process side? Speaker 1 (54:40) Touching her. Speaker 5 (54:41) that. Speaker 2 (54:59) We're still, it's still burgeoning, like, of how we will use this technology successfully on the client side. I don't believe you. I am really customer driven. I'm customer service driven. And I think that AI, at this point in time, interrupts that interface and would cause more problems. with the insurance instead of them being able to pick up the phone and say, look, do I think there's technology solutions to make the process easier in the BI realm? Absolutely. When we start looking at the single point of failures where we get lots of claims at one time, there are ways that claims teams can be handling. We've had some really great successes on those types of things with VI losses where we've used dashboards where the insurer can put all the documents in for review versus then coming to a claims person who then shifts them off to somebody else, right, which costs more to live. So single streaming. But I just don't think that AI is there yet to be able to intercept on the claims side for VI. experience and that customer service. These individuals, these companies are experiencing the worst day of their lives for their companies ⁓ and we are there to make it so that we can help them rebuild and build something better so that they can keep going and participate in our economy. So I see us holding a very strong purpose and I don't want to lose that. to shape the business in a rush tomorrow. Speaker 1 (56:43) you think there's a possibility or there's a formula out there where it would work for those interruptions calculations. If you isolate every variable, that impact. put it all in the database and teach the computer how to. lot, but the actual calculation work, I think it depends on the insurer, because if it's a bigger insurer with a... That's one thing, but if it's a panel... and then you cover them in and tell them that they're, amount that they claim is cut in half, and it's an AI program, you know, maybe a little difficult. You guys have a- Speaker 2 (57:51) you Thank I do want to address one thing though that came in earlier. I do want to circle back because Catherine, you did mention really quickly about the third party vendors and how we're reviewing their technology. Can you just elaborate on that from the carrier side? Are you guys utilizing or leveraging any technologies? As an industry, I know in other carriers you're using third party vendors, we have our own internal. to what technologies are being used and what securities and controls they have in place. This also comes in handy, obviously, when you're receiving alerts, alerts mean policy and saying, look, we noticed that you use this technology and you should be patching. So that is something that your carrier should be providing as an upfront service. You should know about those types of things. Are they truthful pen tests? No. Right, the traditional pen test of. 15 years ago, ⁓ is it really happening to ensure except for very, very large companies? ⁓ But yes, carriers are and have homegrown solutions to be able to tell what technology is being used and what controls are in place. Does it replace the application? No. So having accurate information. Speaker 1 (59:20) you Speaker 2 (59:24) communication upfront at that moment in just working with in terms of collaboration and this is team of ex-archivist brokers, the carrier for resident accountants. Hopefully Scott doesn't need to get into the client situation too often, but really that's a takeaway that I'm hearing from the panelists in terms of how to move things along in business interruption and how we can all improve the process. Thank you so much everybody for your time and we are here to talk very much. Thank you. ⁓ Speaker 5 (59:58) Thank you. Thank Speaker 2 (1:00:03) You like the feet, just one.