Cyber insurance claims: pricing independent expert support

Two layers of cost in every cyber incident

The first layer is the incident response itself: breach coach, forensic investigators, notification services, call centres, public relations and sometimes ransom negotiators. When these are appointed from the insurer's panel with consent, their fees are generally charged against the policy limit and often paid directly by the insurer, subject to the retention.

The second layer is advice for the policyholder alone: an independent claims consultant, forensic accountant, public adjuster or coverage counsel who prepares and negotiates the claim, especially the business interruption and data restoration elements. This layer is usually not covered and is the subject of this page.

What the policyholder's expert does

The work typically covers analysis of the cyber wording and its sub-limits, quantification of income loss during the outage and any extended period, separation of restoration from betterment, review of panel invoices for scope, and preparation of a structured proof of loss. Negotiation with the insurer's adjuster or accountants follows, along with responses to coverage reservations.

Because cyber incidents evolve quickly, the expert often joins early and works alongside the breach response team, which means time spent in calls and meetings can be significant even before quantification starts.

Timing affects price. An adviser brought in on day one will spend time in crisis calls that a firm appointed after containment avoids, but early involvement can prevent costly mistakes, such as rebuilding systems before evidence of the outage's financial impact is captured or accepting a restoration period that is too short. The policyholder should decide consciously which model fits the incident.

• Coverage review of first-party and third-party sections
• Outage loss modelling and waiting period analysis
• Restoration versus betterment allocation
• Review of panel and vendor invoices
• Proof of loss and negotiation

Indicative amounts, to be checked with each expert.

Indicative fee bands for cyber claims

No official scale exists in the UK, US, Canada, Australia or Ireland for independent advisers on cyber claims. The table on this page gives an indicative order of magnitude observed on the market, not an official or legal tariff. Because many cyber specialists bill time rather than percentage, the table combines indicative percentages with a note on common alternatives.

Where a US public adjuster handles the business income element, state licensing rules and any statutory fee caps apply, so confirm those for the relevant state.

Hourly rates, retainers and success fees

Forensic accounting and claims consulting firms frequently work on hourly rates that vary by seniority, sometimes with an initial fixed-price assessment. This suits claims where the main need is quantification rather than a long negotiation. Monthly retainers are used on extended outages to secure a team.

Success-fee models, with a percentage of the recovery, appear mainly where the policyholder wants cost tied to outcome. The base matters: a percentage of the whole recovery, including panel costs paid directly, would be unusual and should be questioned; a percentage of the amounts the expert actually prepares and negotiates is more logical.

Taxes, minimums and pass-through costs

VAT in the UK and Ireland, GST in Australia and Canada, and local taxes elsewhere may apply to fees. Minimum engagement fees are common for time-based work. Costs of technical sub-consultants, such as independent IT forensics to test the panel's conclusions, are usually extra and should be estimated in advance.

What the cyber policy may reimburse

Some cyber wordings include a proof of loss preparation or claims preparation costs extension, typically with a modest sub-limit, covering accountants who assemble the business interruption claim at the insurer's request. A few policies are broader, but advocacy fees are rarely covered.

Panel vendor costs are generally within cover but erode the limit. A practical consequence is that large response bills can leave less room for business interruption and liability, which is one reason policyholders sometimes ask an independent expert to review panel invoices for reasonableness.

Retentions also shape the economics. A cyber policy may carry a monetary retention on response costs and a waiting period of eight, twelve or twenty-four hours on business interruption, depending on the insurer. Losses inside those thresholds stay with the business whatever the adviser does, so the fee should be compared with the recoverable portion only, not with the gross cost of the incident.

Cost by size of incident

For a contained phishing or email compromise incident with limited downtime and a claim of perhaps £30,000, independent support is often unnecessary; if used, a short fixed-fee review may cost a few thousand pounds. For a ransomware attack that halts operations for two weeks and produces a £500,000 claim, a combination of hourly fees and a modest success element can lead to a total in the order of 6% to 9% of the negotiated amount.

For a multi-million claim involving dependent business interruption and extensive data recreation, fees expressed as a percentage fall, but the absolute cost becomes significant and is usually managed through a budget, regular invoicing against estimates and a cap.

A sample calculation

Take a policyholder whose outage loss is first assessed at $700,000 by the insurer's accountant. An independent consultant billing around 220 hours at a blended rate of $300 would cost $66,000. If the final agreed figure is $950,000, the effective cost is about 7% of the settlement and about 26% of the uplift. These numbers are purely illustrative.

Selecting and instructing a cyber claims expert

Look for direct experience with cyber business interruption, the ability to read technical forensic findings and familiarity with the major cyber wordings. Ask for a budget, a staffing plan and a clear explanation of how the firm will coordinate with the breach coach without disrupting the response.

Be cautious of anyone guaranteeing a recovery or encouraging actions that breach policy conditions, such as engaging vendors without consent. The engagement letter should specify rates, estimate, cap, taxes, confidentiality and how privilege is preserved.

• Budget and staffing plan in writing
• Rates by grade and any success component
• Coordination with breach coach and panel
• Confidentiality and privilege arrangements
• Termination terms and fees on exit

In cyber claims, budget discipline matters as much as technical skill, so agree scope and cost before work begins. Further guidance on cyber losses is available on expertdassure.com.