Four tests for fixing third-party cyber risk transfer
22nd October 2026Higher limits and better certificates don’t change how vendor cyber insurance works
Spend enough time on this problem and it stops being hard to describe. A certificate of insurance confirms that a policy exists and says nothing about whether it will respond. The vendors carrying the most exposure are often the ones nobody tiers as risky. And behind each of them typically sits one aggregate limit, shared by every client the vendor serves. That structure was inherited from lines of insurance where it works because the conditions around it hold. In cyber, those conditions don’t.
Describing the gap is the easy part. The harder question, and the one that matters to anyone responsible for this exposure, is what would have to be true for a vendor relationship to be protected rather than simply documented.
Why the obvious responses fall short
Three responses are the obvious ones, and each is worth doing.
- Require higher limits. A larger shared limit is still shared, and it is tested the same way when an incident reaches many clients at once.
- Ask for better certificates. More detail on exclusions and scope gives a clearer view of the arrangement, but a clearer view of a shared limit does not make it a dedicated one.
- Do more diligence. Sharper TPRM review helps teams ask better questions. It cannot reveal how many other companies rely on the same limit, because the certificate was never built to say.
None of these is wrong. Each improves the arrangement without changing what it is.
Four tests
If the structure is the problem, a fix has to change the structure. The standard can be put this way: a vendor relationship is genuinely protected only if the answer to each of these questions is yes.
- Is the limit yours? Protection should attach to one relationship, the way a surety bond attaches to one contract and mortgage insurance to one loan. The question risk managers rarely get to ask, how many other companies are relying on this limit, should have a simple answer: none.
- Do the terms hold still? No enterprise can audit thousands of vendor policies against every plausible loss. The consistency has to live in the instrument itself, so that protection reads the same way whichever carrier wrote the vendor’s policy.
- Can recovery avoid a lawsuit? If payment depends on pursuing the vendor, the vendor’s insurer, or both, protection arrives on litigation’s timetable rather than the incident’s. The exposed party needs a direct path to recovery.
- Does security count? Today, a vendor with strong controls and a vendor with weak ones can hand over the same certificate. Risk transfer that reflects how well a vendor’s controls are actually assured would reward the vendors doing the work instead of treating them as interchangeable.
Why this is harder to build than to describe
Each test is easy to state. Passing all four together is harder, and the reason is worth understanding.
Dedicating protection to a single relationship means pricing that relationship, not the vendor’s entire book of business. That calls for a consistent, comparable read on the vendor’s security posture at the point where the enterprise relies on it. The evidence available for that today is a mix of questionnaires, attestations and certifications, each useful, none designed to be compared with the others. It is difficult to price what cannot be compared.
That is a solvable problem. It is also one we have been working on, and there is more to say about it soon.
The test to run now
Until then, there is a simple exercise that costs nothing. Take the next certificate of insurance that lands on your desk and run it against those four questions. The answers will show how much of the protection you thought you had was ever meant to be yours.
The full report sets out the analysis behind all of this. Read it here.
Disclaimer
This content is intended for general informational purposes only and does not constitute legal, regulatory, financial, or insurance advice. It should not be relied upon as a substitute for professional counsel. While efforts have been made to ensure the accuracy of the information presented, no representation or warranty is made as to its completeness or applicability to any specific situation. Readers should consult their own advisors regarding their particular circumstances.