The forensic side and the financial side, in one practice.
Most clients who reach us after a cyber incident discover the same gap.
Their homeowner policy has a small cyber rider with low limits and narrow trigger language.
Their umbrella policy treats cyber as out of scope.
The forensic investigation, the credit-bureau cleanup, the legal coordination, and the actual financial loss all fall outside coverage.
A personal cybersecurity insurance policy fills that gap, and it pairs naturally with the forensic work the practice already runs.
We can provide this coverage to clients through a vetted insurance partner.
We are not the underwriter.
We make the introduction, scope your coverage alongside the rest of your engagement, and stay in the loop when a claim opens.
You bind directly with the carrier.
We do not mark up premiums.
What a real personal cyber policy covers
- Identity theft insurance and restoration costs. Forensic investigation hours, credit-bureau coordination, legal fees, lost wages, and the document-replacement costs that come with a stolen identity. Coverage extends to family members on most policies.
- Cyber extortion and ransomware. Ransom payment reimbursement on covered events, professional negotiator fees, forensic recovery costs, and post-incident hardening. This is the rider standard homeowner policies almost always exclude.
- Social engineering and wire fraud. Reimbursement for funds lost to wire-fraud schemes, business-email-compromise variants, real-estate closing fraud, and trusted-impersonator scams. The most common claim category for HNW principals.
- Online reputation restoration. Costs to remove or suppress damaging online content, deepfake-takedown coordination, and PR crisis-response when a personal cyber incident becomes public.
- Cyberbullying and harassment response. Counseling costs, legal fees, and professional services to respond to coordinated harassment, doxxing, or stalking incidents. Increasingly relevant for executives, public figures, and survivors.
- Breach notification and regulatory expense. When personal data exposure triggers state breach-notification obligations, the policy covers the legal and notification costs the individual would otherwise pay out of pocket.
- Telehealth, remote work, and smart-home device coverage. Newer policies extend to compromised connected devices in the home, IoT-vector attacks, and remote-work account exposure that personal lines historically exclude.
How this pairs with the forensic side
The insurance covers the financial loss and incident-response cost.
The forensic side of the practice does the actual investigation, evidence preservation, and remediation, which is what most policies require to release a claim.
When a claim opens, the practice coordinates directly with the carrier, documents chain of custody on the recovered evidence, produces the forensic report the adjuster needs, and bills the work against the policy where applicable.
You get one practice running both halves of the response, not three vendors arguing in a Slack channel while a wire-transfer clock runs out.
The gap with a clock on it is usually the same one: a wire-fraud loss on a closing or business transfer that the homeowner and umbrella policies both exclude.
For principals and their families, this coverage is best scoped as one layer of the broader family-office protection stack rather than bought standalone.
Who this is for
- Individuals and families with active digital banking, online investing, smart-home automation, or in-flight real-estate transactions where wire-fraud exposure is real.
- Executives, public-facing professionals, journalists, attorneys, clinicians, and elected officials whose role attracts targeted attacks and reputation risk.
- High-net-worth principals, family-office members, and trustees with complex multi-account digital footprints, household staff with delegated access, and multi-jurisdiction exposure.
- Survivors of identity theft, romance-scam fraud, or stalking who want financial coverage layered on top of forensic investigation and want both halves running through one practice.
- Anyone who has already had one cyber incident and wants the financial cushion in place before a second one happens.
How to engage
- Free coverage gap review. 30 minutes, NDA-protected. We look at your existing homeowner and umbrella riders, your digital footprint, your wire-transfer activity, and your prior incident history. We tell you whether a standalone policy makes sense or whether your existing rider is sufficient.
- Partner introduction. If a standalone policy makes sense, we introduce you to the insurance partner. They scope coverage, quote premiums, and bind directly with you on their paper.
- Forensic engagement runs in parallel. Where applicable, we scope or continue your forensic and incident-response work with the policy in place. When a claim opens later, we coordinate with the carrier so the forensic side is admissible against the policy.
How we handle the insurance side
- Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
- We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
- No markup, no hidden commission. You bind directly with the carrier on their paper, at their price. We do not mark up premiums or take a commission you would not see. If your existing homeowner or umbrella rider already covers your risk, we tell you and skip the policy.
- A referral and coordination layer, not the underwriter. We are not a licensed insurance producer and we do not bind coverage ourselves; we make the introduction, scope the gap, and coordinate the forensic side when a claim opens. Our partner relationship is kept private, so we do not discuss specific carrier names publicly.
