Can We Insure This?

“Can we insure this?” has two meanings. At the transactional level, an organization wants to know whether an insurer will accept a risk and on what terms. At the organizational level, Patrick M. Hayes uses the question to examine whether the business understands the risk it is asking another party to insure. That means understanding the technology, security controls, supporting evidence, business dependencies, recovery capability and potential financial consequences behind an application. The question is broader than the title of a book: it connects Patrick’s writing, practical application guidance and instructor-led learning around cyber insurance readiness. Obtaining a policy is not the end state. The organization still needs to know how it would operate through disruption, how meaningful activity would recover and which financial consequences it deliberately retains or transfers.

An application translates technical and operating conditions into representations about risk. Questions about MFA, endpoint security, backups, vulnerability management and incident response may look simple; the environment behind them often is not.

• What are we actually being asked?
• Who knows the answer?
• How was the answer verified?
• What evidence supports it?
• Does the control apply everywhere the answer implies?
• What happens if the control fails anyway?

Understanding the question matters more than checking a box. The answer needs to reflect the business as it operates—not a purchase, assumption or intended future state.

The goal is not to answer “yes.” The goal is to answer accurately.

An insurance application is not simply a cybersecurity checklist. Its answers are representations used as part of an underwriting decision. A control can exist somewhere without being deployed, configured or enforced across the environment the answer implies.

Insurers ask questions differently and use different processes. Understand what the particular question represents, identify qualifications and verify the actual answer before submitting it.

The Workshop distinguishes whether a control exists, whether it operates as a requirement, which scope it covers and whether evidence supports the representation. A written policy and an enforced operating control are not the same.

Exists

The control has been implemented somewhere in the environment.

Enforced

The control is required and operates, rather than being optional or only written into a policy.

Scoped

Its reach matches the users, systems and access paths described by the question.

Evidenced

Reliable records or testing support the answer and its relevant scope at the time it is given.

Underwriting evidence expectations vary among insurers.

The first Workshop block moves beyond the assets and controls to the consequence for the business when technology, security or an operating dependency fails.

• What business capability depends on the technology?
• What happens when it becomes unavailable?
• Who is affected?
• What obligations emerge?
• How long can the business tolerate disruption?
• What does the interruption cost?

Cyber insurance cannot be understood solely as a cybersecurity purchase. The technology matters because of the business activity, obligations and value that depend on it.

The Workshop’s Follow the Loss exercise traces how a technical event moves through the organization into operational disruption and financial consequence. A service becoming unavailable can interrupt customer delivery, affect contractual obligations and create recovery expenses or lost revenue.

The point is to follow the consequence beyond the security boundary: which activity stops, who depends on it, what it takes to restart and what the interruption costs. This is an established exercise, not a newly branded sequence or a universal interpretation of insured loss.

A successful insurance claim does not automatically mean successful business recovery. Insurance may provide financial capacity and response resources for certain covered losses; the business still needs the operational capability to resume meaningful activity.

Technical restoration

Returning infrastructure, systems, applications and data to operation.

Business recovery

Restoring the ability to serve customers, generate revenue, meet obligations and continue creating value. People, providers and processes may constrain that recovery even after systems return.

Security influences risk. Recovery influences consequence. Insurance provides financial capacity for certain covered consequences. Business survivability depends on how those capabilities work together when disruption occurs.

Underwriting and controls can improve insurability while substantial dependencies and recovery risks remain. A policy neither eliminates those risks nor guarantees recovery.

Finding a gap is useful when it leads to a deliberate next step. The existing 90-Day Readiness Action Plan connects Workshop findings to priorities such as:

• Answers requiring verification
• Controls requiring validation
• Known gaps
• Recovery assumptions requiring testing
• Evidence requiring improvement
• Business dependencies requiring further analysis

Sensitive organizational evidence belongs in the organization’s approved systems. This public page does not collect application responses, evidence or business data.

Cybersecurity explains controls and technical exposure. Operations understands business dependencies and recovery. Finance considers tolerance and financial consequence. Brokers and insurers bring insurance expertise. Leadership needs to understand the combined business decision.

No discipline is subordinate to another, and no one perspective provides the entire answer.

Brokers may encounter clients who do not fully understand technical underwriting questions. Patrick’s work bridges the language of insurance, cybersecurity and the business by helping clients identify who knows an answer and what supports it.

It complements rather than replaces licensed insurance advice. Brokers help clients navigate the application and transaction; knowledgeable client teams validate their operating and technical representations.

Insurers differ in underwriting questions, evidence expectations, control requirements, appetite, pricing, limits, retentions, exclusions, coverage and processes.

Patrick’s commentary on Coalition or another carrier illustrates that insurer’s approach. It must not be treated as the way every cyber insurer evaluates risk.

Cyber risk crosses security, technology, operations, governance, finance, recovery and insurance. No single discipline owns the entire consequence. Can We Insure This? is a practical example of the broader problem addressed by Integrated Assurance®—while remaining its own recognizable body of work.

Patrick M. Hayes is the author of Can We Insure This? and Integrated Assurance: Unified Risk Strategy. He writes and teaches about cybersecurity, cyber insurance, enterprise risk, recovery and business survivability.