Trium Cyber launches True Transfer
27th October 2026New Lloyd's-backed solution partners with IRIDX, a HITRUST company, to use new standardized scoring to provide ring-fenced insurance limits for each critical vendor relationship
Trium Cyber launches True Transfer, giving enterprises dedicated cyber protection for vendor incidents instead of a share of their vendor's policy
Most enterprises assume that if a vendor suffers a cyber incident, the vendor's cyber insurance will cover the harm that follows. In most cases, it will not. A vendor's policy is built to protect the vendor, and its limit is typically shared across every customer that vendor serves. Trium Cyber today announced the launch of True Transfer, a supplemental cyber insurance solution that gives enterprises their own dedicated, ring-fenced limit for each critical vendor relationship, with information risk measured by IRIDX, an information risk ratings company.
As organizations rely on a growing number of third-party technology and service providers, vendor cyber risk has become one of the largest exposures enterprise risk managers are asked to manage, and one of the least visible. The standard safeguard is a contractual insurance requirement, confirmed by a certificate of insurance. But a certificate only confirms that a policy exists. It does not show whether that policy will respond to the enterprise's loss, or how many other customers are relying on the same limit. In a widespread event that affects many of a vendor's clients at once, a shared limit can be exhausted quickly, leaving affected organizations with little or no financial recourse.
Other areas of commercial risk solved a version of this problem long ago. In construction, a surety bond is issued for a specific project and protects that project's owner, regardless of what happens on the contractor's other jobs. True Transfer applies the same principle to cyber: protection that follows the relationship, not the vendor.
"Boards, auditors and risk committees are signing off on risk transfer programs that often don't transfer risk at all. That's the uncomfortable truth. A vendor's policy exists to protect the vendor, not every customer exposed to that vendor. Nobody would accept a surety bond shared with dozens of other projects, yet that is exactly what most enterprises accept in cyber today.”
-- Josh Ladeau, Managing Director, Strategic Initiatives, Trium Cyber
“True Transfer is designed from the enterprise's side of the relationship, giving organizations protection that is theirs alone instead of hoping someone else's insurance will be enough."
-- Amie Watson, Chief Underwriting Officer, Trium Cyber
How True Transfer works
True Transfer is structured as a master policy issued to the enterprise, at no premium cost to the enterprise. From there, coverage follows the enterprise's own risk decisions:
- Measure. The enterprise uses the IRIDX Score to measure residual information risk across third-party relationships. IRIDX's process evaluates assessments, certifications, questionnaires, telemetry and external signals to determine what each input demonstrates and how reliably it supports a risk determination.
- Select. Based on that measurement and its own risk tolerance, the enterprise decides which vendor relationships warrant dedicated protection.
- Endorse. The enterprise asks each selected vendor to purchase an endorsement onto its master policy. Each endorsement provides a dedicated, contract-specific limit for that relationship, ring-fenced from every other client the vendor serves.
- Respond. If a covered incident at an endorsed vendor causes the enterprise financial harm, True Transfer is designed to respond on a primary basis, before the enterprise's own cyber program is called on. Claims are handled directly with the enterprise and paid to the enterprise, not routed through the vendor.
True Transfer is available to all large segment entities and will be most appealing to those with large vendor reliance. Trium engages with the broker on behalf of their client to bind a master policy, with the rest of the process flow being automated, and with limits of up to $2.5m per endorsement on a policy and $5m for all contracts for a given vendor on one master policy. There is no relationship between master policies.
Key benefits of True Transfer
- No premium cost to the enterprise. The master policy carries no premium, and each vendor-specific endorsement is purchased by the vendor.
- Dedicated limits. Each endorsed vendor relationship has its own ring-fenced limit, so a covered incident affecting many of a vendor's customers does not dilute the enterprise's protection.
- Direct recovery. Covered losses are paid to the enterprise without the cost and delay of pursuing litigation against the vendor or its insurer.
- Protected vendor relationships. Because recovery does not depend on a claim against the vendor, enterprises can be made whole without damaging a commercial relationship they rely on.
- Standardized coverage. One set of coverage language applies across every endorsed vendor, replacing the work of interpreting many different vendor insurance arrangements.
- Greater predictability. The enterprise's own cyber program is no longer the first line of response to a vendor incident.
- Potential savings on core cyber programs. Because vendor-related losses are transferred to True Transfer, both the enterprise's and the vendor's own cyber insurance programs are insulated from those claims. That may put both parties in a stronger position to negotiate lower premiums on their main programs.
- Consistent risk measurement. The IRIDX Score provides a comparable measure of residual information risk across vendor relationships and explains key drivers. An evidence-confidence indicator helps distinguish control weaknesses from evidence gaps or uncertainty. IRFE estimates relationship-specific financial exposure before insurance or other recoveries.
Where risk measurement meets risk transfer
The partnership between Trium Cyber and IRIDX brings risk measurement and risk transfer together to support decisions about dedicated protection for specific vendor relationships. The IRIDX Score measures the information risk that remains, while IRFE estimates the related financial exposure before insurance or other recovery. Insurance determines who pays when the protection fails and provides financial protection for covered losses. These measures help enterprises determine how much exposure to retain or transfer. True Transfer uses the IRIDX Score to identify where dedicated coverage belongs, then places financial backing behind that decision.
"You cannot govern what you cannot consistently measure. The IRIDX Score and IRFE give organizations a common basis to compare residual risk, understand financial exposure and make informed decisions about what they reduce, retain or transfer. True Transfer brings dedicated financial protection into those decisions, creating a foundation for integrating risk measurement, financial exposure and insurance in a single process."
-- Daniel Nutkis, Founder and Executive Chairman of HITRUST and Founder of IRIDX
The launch reflects growing recognition that vendor contracts and insurance requirements alone cannot reliably transfer third-party cyber risk. By giving enterprises a dedicated mechanism for vendor-related exposures, True Transfer offers boards, auditors and risk committees a risk transfer program that does what its name says.
True Transfer is underwritten by Trium Cyber on behalf of Syndicate 1322 at Lloyd’s. Cover is subject to underwriting and the terms of the policy.
Find out more about True Transfer.
###
About Trium Cyber
Trium Cyber is a specialist cyber insurance underwriter and risk transfer provider based in the US and UK and operating globally. Writing on behalf of Trium Syndicate 1322 - the first monoline cyber syndicate to be approved by Lloyd's - Trium is backed by Pelican Ventures and third-party capital providers. Focused on advancing cyber resilience and enabling more effective risk transfer, Trium Cyber partners with brokers, enterprises and industry partners to deliver innovative insurance products for emerging cyber exposures, helping organizations address complex digital risks that traditional insurance structures may not adequately cover.
About IRIDX, a HITRUST Company
IRIDX, a HITRUST Company, is an information risk ratings company. IRIDX establishes and governs standardized methods for measuring residual information risk and estimating related financial exposure. Its measures support third-party information risk management, enterprise governance, benchmarking, insurance underwriting and risk transfer. Visit IRIDX.com.
Media contact
For media inquiries, or to arrange an interview with Amie Watson and Josh Ladeau, please contact Francesca Monti, Marketing Director, at francesca.monti@triumcyber.com.