At 11pm on a Friday a regional distributor's systems go dark. By Saturday morning there is a ransom note, a breach coach on the phone, a forensics firm on the way and a question that has nothing to do with technology: can the carrier pay anything at all to the people behind this, and if so, out of which sublimit?
Cyber claims compress a month of ordinary claim handling into a weekend. This post follows one ransomware claim through InsightCW — the incident facts, the sublimits, the referral when a ransom is demanded without a clear sanctions check, the payment hold when the threat actor matches a sanctions list, the business-interruption waiting period and the notification costs. The company, the threat actor and the amounts are illustrative.
| Actors | Cyber claims specialist (owner), breach coach, forensics firm, claims manager, compliance, the insured's IT and legal leads |
|---|---|
| Trigger | A notice of a ransomware incident within hours of discovery |
| Line | Cyber: first-party response, extortion, business interruption, notification; third-party liability |
| Agents involved | Intake, coverage, reserving, fraud, correspondence, supervisor |
| Decisions and authority | Coverage per insuring agreement (specialist), any extortion payment (held by a payment control until compliance clears it), vendor spend inside authority |
| Systems touched | InsightUW (policy at the loss date: sublimits, waiting period, retention), InsightCede (reserve movements, large-loss notice) |
| Outcome | Response vendors engaged inside the policy's panel, no payment reaches a sanctioned party, sublimits tracked as they erode, business interruption measured from the right hour |
| What is measured | Hours to coverage acknowledgement, sublimit erosion visibility, payments held before release, notification cost against estimate |
Why cyber breaks ordinary claim handling
Three things make cyber different. The policy is a bundle of sublimits — extortion, notification, business interruption — that erode separately and can run out long before the aggregate. Time matters in hours: business interruption usually starts only after a waiting period measured from the outage. And money may be demanded by people the carrier is legally barred from paying.
discovered"] --> B["Calls and emails
all weekend"] B --> C["Ransom discussed
before sanctions
are checked"] C --> D["Vendors engaged
off-panel"] D --> E["Sublimit erosion
found at invoice time"] E --> F["BI measured from
the wrong hour"] style C fill:#fdecec,stroke:#e57373 style E fill:#fff4e2,stroke:#f4a03a
incident type, discovered,
records, breach coach,
forensics, threat actor"] B --> C["Rules: ransom without
sanctions check refers;
sanctions match holds
any payment"] C --> D["Coverage agent:
position per coverage,
sublimits from UW"] D --> E{"Specialist decides;
compliance clears
any hold"} E --> F["Sublimits eroded as
payments post; referral
when one is nearly gone"] style C fill:#efeafe,stroke:#7c6cf0 style E fill:#e8f8f4,stroke:#22c1a4,stroke-width:2px
Who talks to whom
Step by step
The policy at the loss date comes from InsightUW: the extortion, notification and business-interruption sublimits, the waiting period and the retention. The acknowledgement clock starts.
The cyber panel holds the line's own facts: incident type (ransomware, data breach, business email compromise, system failure), when it was discovered, records affected, the breach coach and forensics firm, notification jurisdictions and the cost estimate, the ransom demanded, the threat actor, the sanctions check (not run, clear, match), whether law enforcement was notified, the outage start and end, and each sublimit with what it has eroded.
CY_RANSOM_SANCTIONS fires: a ransom is demanded and the sanctions check is not clear. It is a coverage referral to the manager, and it is on the decision record before anyone talks about paying.
Extortion, response costs and business interruption each get a position, each citing the policy form and the sublimit from UW's answer. Extortion stays at reservation of rights while the sanctions question is open: the position can only move towards caution.
The cyber line lists the documents its file needs, including the notification population and the sanctions (OFAC) check. A missing one is a warning on the decision record, not a silent gap.
Compliance records the result on the line panel. If it is a match, any payment requested on this claim will be held.
CY_SANCTIONS_HOLD (the threat actor is on a sanctions list) parks any requested payment as on hold with its code and reason. The payment does not fail and does not go out; the claim's verdict becomes “hold” and the hold appears on the supervisor's queue.
CY_BI_WAITING refers a business-interruption claim whose outage sits inside the waiting period, so the BI loss is measured from the right hour.
As vendor invoices are paid, the notification sublimit erodes. CY_SUBLIMIT refers the file when a cyber sublimit is nearly exhausted — before the insured hears it from an invoice.
A held payment is not a failed payment
When a payment control holds a payment, the payment exists, its reason is on the file and the decision record carries a block hit. A supervisor or compliance releases it with a reason, after which it goes through authority like any other payment — or it stays held. What never happens is money moving first and the question being asked afterwards. The payment controls post covers the general case.
What the screens show
What the agents said, and what each answer rests on
| Agent | What it prepared | What it cites | Who decides |
|---|---|---|---|
| Intake | Notice complete; notification population document missing | Notice, the cyber line's required documents | Specialist |
| Coverage | Response costs covered; extortion reservation of rights pending sanctions; BI reservation of rights pending the waiting period | Policy forms, sublimits and waiting period from UW; the cyber facts | Specialist |
| Reserving | Reserve by component against each sublimit | Sublimits and erosion, vendor estimates | Within authority |
| Fraud | No indicators; nothing prepared | The fraud rules on the claim's facts | — |
| Supervisor | Brief for the ransom-and-sanctions referral | CY_RANSOM_SANCTIONS, the sanctions field, the demand | Claims manager |
Edge cases, and how authority stops them
| What happens | What InsightCW does |
|---|---|
| The sanctions check is never run | The referral stays open on the decision record and the extortion position cannot move past reservation of rights. |
| A payee name matches a sanctioned party | The general sanctions control (PAY_SANCTIONS) holds the payment too, on any line. |
| An agent at L3 requests a payment | The same controls run; an agent can never do what a person couldn't, and a held payment is held for an agent as for a person. |
| The model writes a sublimit figure | If the figure is not UW's sublimit or the recorded erosion, the model's text is thrown away. |
The decision record for this claim
On day 3, after the payment was held, the run read as follows. The verdict is hold: a held payment outranks every referral, so the claim's headline says so before anything else.
| Section | Hit | Outcome |
|---|---|---|
| Coverage | Response costs covered; extortion and business interruption under reservation of rights | warn |
| Line | CY_RANSOM_SANCTIONS: ransom demanded without a clear sanctions check | refer |
| Line | Required document missing: notification population | warn |
| Payment holds | CY_SANCTIONS_HOLD: threat actor on a sanctions list | block |
| Authority | Vendor spend inside the specialist's payment authority | pass |
| Clocks | Acknowledgement met; coverage decision due | warn |
Ask the copilot
| Ask the copilot | Lookups it calls | What the answer covers |
|---|---|---|
| “How much of each sublimit is left?” | policy_and_coverage, reserves_and_payments | Extortion, notification and BI sublimits with what each has eroded, from UW's answer and the line facts. |
| “Why is this payment held?” | reserves_and_payments, decision_record | The hold's code and reason and who can release it; a link to the payment. |
| “When does business interruption start counting?” | policy_and_coverage, claim_overview | The waiting period from UW and the outage start recorded on the line panel. |
Tuning it for your book
- The sanctions process. InsightCW holds the payment; your compliance process decides. Make sure compliance is on the hold's release path and has the role to release.
- The sublimit threshold.
CY_SUBLIMITrefers when a sublimit is nearly eroded; set “nearly” to what your cyber leads want to hear. - The vendor panel. Breach coaches and forensics firms are vendors with fee
schedules; their invoices are reviewed on
bill_reviewrules like any other.
On the desk
The facts a cyber claim turns on are on one panel; the rules refer or hold before money moves; the copilot answers sublimit questions with sources.
For claims IT
Cyber facts derive rule fields such as cy_ransom_demanded and cy_sanctions_cleared; the sanctions hold is a payment_control rule predicated on the line.
For claims leadership
The regulatory risk in cyber is paying the wrong party. The measure that matters is payments held before release, and zero payments to a sanctioned party.
Variations on this claim
A data breach with no extortion
No ransom, so no sanctions referral; the notification sublimit carries the claim. The facts that matter are the records affected, the notification jurisdictions and the cost estimate. A missing notification population is a warning on the decision record until it is on file.
Business email compromise
A fraudulent funds transfer is often a social-engineering or crime coverage question as much as a cyber one. The coverage agent cites the forms UW returns; if the policy's wording is the question, it lists it as an open question for the specialist.
A long outage
Business interruption is measured from the outage start, after the waiting period. The BI estimate and the BI sublimit sit on the panel side by side, and the sublimit rule refers when the erosion approaches the limit.
Rolling it out on your desk
- Compliance in the loop: give compliance the role that releases sanctions holds and put them on the referral path. Agree how a sanctions check result is recorded.
- Vendor panel: load breach coaches and forensics firms with fee schedules so their invoices are reviewed like any vendor's.
- Sublimits from UW: confirm the lookup returns each sublimit and the waiting period; the rules can only read what is there.
- Measure: hours to coverage acknowledgement, holds released versus left held, and notification cost against the estimate.
Questions we get asked
Does InsightCW screen against sanctions lists itself?
It holds a payment when the payee party is flagged or its name matches a sanctioned party or vendor, and the cyber rule holds when the recorded threat actor is on a list. Keeping the flags current is your screening process; InsightCW makes sure no payment moves past them.
Can an agent make an extortion payment?
An agent can request a payment only at L3 or above, the ceiling ships at L2, and the same payment controls hold an agent's request exactly as a person's. Releasing a hold is a person's action.
Can an auditor replay what happened?
Yes. Every Analyze, stage action and payment hold writes a run to the decision record, with the hits in order, the rule and facts behind each, and the verdict. Every agent step records its model, tokens, cost and confidence, and a Lense trace when tracing is configured.
Which model do the agents use, and what if it is unavailable?
By default the agent steps use Claude Haiku 5.5 through the platform's model client (on Bedrock where a region is configured), with a daily budget per agent; over budget, the fast model answers. If no model is configured, or a call fails, or the answer does not parse, the agents' rule-based findings stand and the step says the model did not run. Nothing in the claim waits on a model.
What the person still decides
- Whether any extortion payment is made, and only after compliance has cleared the sanctions question.
- The coverage position on each coverage line.
- Which vendors to engage and what spend to approve inside authority.
- Releasing a hold, with a reason that stays on the file.