Most companies' first instinct after a security incident is to call their IT person or their MSP. That's understandable. Something technical broke and you want a technical person to fix it.
But in most cases, the first call should be to your cyber insurance carrier.
This applies whether the incident is a stolen laptop with active sessions to sensitive systems, a ransomware attack encrypting your servers, a business email compromise with fraudulent wire transfer instructions, a data breach exposing customer information, an employee reporting that their credentials were compromised, or any other event where data, systems, or money may be at risk.
The order of your first three calls matters more than most companies realize. Getting it right can save you tens of thousands of dollars and significantly improve the outcome. Getting it wrong can void your coverage, increase your liability, and turn a manageable incident into a crisis.
Why insurance first
Your cyber insurance carrier provides more than financial reimbursement after the fact. When you open a claim, they activate a response ecosystem that typically includes:
Breach counsel. An attorney who specializes in data breach response. They provide legal guidance on your obligations, manage privilege over the investigation (so your findings are protected from discovery in future litigation), advise on notification requirements, and coordinate with regulators if necessary. This is not your corporate lawyer. This is a specialist who handles breaches regularly and knows the specific requirements in every jurisdiction.
A forensics firm. A digital forensics team that investigates what happened, determines how the attacker got in, assesses the scope of the compromise (what data was accessed, what systems were affected, how long the attacker was in the environment), and provides a detailed report of findings. This is critical for understanding the incident, meeting legal obligations, and preventing recurrence.
Notification services. If the incident involves personal data and triggers notification requirements (HIPAA, state breach notification laws, GDPR), the carrier's team handles the logistics: drafting notification letters, managing mailing or email delivery, setting up call centers for affected individuals, and coordinating credit monitoring services.
Crisis communications support. Guidance on what to say publicly, when to say it, and how to communicate with customers, partners, employees, and media. Getting communications wrong during a breach can be more damaging than the breach itself.
All of these services are typically covered under your policy. The carrier has pre-negotiated rates with approved vendors, established relationships, and a playbook they've executed hundreds of times.
What happens when you don't call them first
I've seen companies spend $80,000 or more out of pocket on breach response because nobody thought to call the insurance carrier until week three. By then, the damage was compounded in several ways.
Unapproved vendors. The company hired its own forensics firm without checking whether the carrier approved them. The carrier refused to cover the cost because the firm wasn't on their approved panel. $40,000 in forensics fees came out of the company's pocket.
Privilege waiver. The company started the investigation without involving breach counsel. The forensic findings weren't protected by attorney-client privilege. When a class-action lawsuit followed the breach, the company's own investigation report became evidence against them.
Premature public statements. Without legal guidance, the company issued a public statement acknowledging the breach before the scope was understood. The statement contained inaccuracies that had to be corrected later, damaging credibility and providing ammunition for plaintiffs' attorneys.
Missed policy provisions. The company's policy required notification to the carrier within 72 hours of discovering the incident. They notified at day 21. The carrier didn't deny the claim outright, but they pushed back on coverage for costs incurred before notification, and the late notice complicated the claims process significantly.
Duplicate work. The company's IT team spent 80 hours trying to investigate the incident on their own before bringing in professionals. Most of that work had to be redone by the forensics firm because the IT team's investigation, while well-intentioned, didn't follow forensic best practices and some evidence was inadvertently modified.
The right order
Call 1: Cyber insurance carrier. Open the claim. Get the claims number and the name of your claims adjuster. They'll activate the response team and connect you with breach counsel and forensics.
Call 2: Your security advisor or vCISO. They can help coordinate the technical response, work with the forensics firm, manage the timeline, and serve as a bridge between your team and the carrier's resources.
Call 3: Your IT team or MSP. They'll handle the immediate technical containment: isolating affected systems, resetting credentials, revoking access, and preserving evidence for the forensics team.
Notice that IT isn't off the hook. They're essential for containment and recovery. But they're call 3, not call 1, because the carrier and the security advisor set the strategy that the IT team executes.
What to do right now, before an incident happens
- Find your policy. Locate it, save it somewhere accessible, and know which document is the actual policy (not just the proposal or the certificate of insurance).
- Find the claims number. Write it down. Put it in your incident response plan, on a card in your wallet, or wherever leadership can access it at 2am on a Saturday.
- Know the notification window. Most policies require notifying the carrier within 24, 48, or 72 hours of discovering an incident. Set it as a hard constraint in your IR plan.
- Know the approved vendor panel. Get the carrier's list of approved forensics firms and breach counsel in advance. If your preferred advisor isn't on it, talk to the carrier about adding them before an incident occurs.
- Update your incident response plan. List the insurance carrier as the first external call, with the policy number, claims phone number, notification window, and broker or agent name.
- Brief your leadership team. Make sure the CEO, CTO, and anyone likely to be involved in incident response knows the protocol: call the carrier first, don't make public statements without legal guidance, and don't start investigating without coordinating with the forensics team.
If you don't have cyber insurance
Get it. This week.
Policies for small companies (under 100 employees, under $50M in revenue) typically cost $2,000 to $5,000 per year. The coverage is worth multiples of that in a single incident.
Most applications will ask about your security controls: MFA, endpoint protection, backups, email security, access management. Having these controls in place before you apply gets you better coverage at a lower premium. Not having them may result in higher premiums, coverage exclusions, or denial.
If you've been breached before and you don't have insurance, the cost of forensics ($50,000 to $200,000), legal counsel ($20,000 to $100,000+), notification services ($5 to $20 per affected individual), credit monitoring ($10 to $30 per individual for 12 months), and potential regulatory fines makes the $3,000 annual premium look like the best investment you never made.
The bottom line
The IT person fixes the system. The insurance carrier manages the crisis. Both matter. The order matters more.
When something goes wrong, the decisions made in the first few hours determine the trajectory of the entire response. The right first call activates a team that's done this hundreds of times, protects your legal position, and ensures costs are covered. The wrong first call wastes time, wastes money, and creates exposure that didn't need to exist.
Save the claims number. Update your IR plan. Brief your team. And if you don't have cyber insurance, stop reading and go get a quote.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.