Your vendors' cyber insurance wasn't built to protect you.
True Transfer is a new approach to vendor cyber risk. It gives your most critical vendor relationships their own dedicated cyber insurance limit so that when a vendor experiences a cyber incident, your business has its own limit to claim against, subject to policy terms, rather than relying on the vendor’s shared policy or your organization’s own cyber policy.
PROBLEM
Vendor risk management measures risk. It doesn't transfer it.
Large enterprises invest heavily in third-party cyber risk management programs, largely following the same process: tier the vendor based on risk assessments, require cyber insurance, collect certificates of insurance, and verify limits. It's a way of verifying which vendors might be risky but it can’t tell you what that risk could cost you.
We’ve identified three gaps that stand out during the vendor assessment process:
- A certificate is not coverage. It confirms a policy exists. It does not show what is excluded or whether the policy will respond to your loss. Read our article explaining this further.
- The limit is shared. A vendor's policy has one limit for all of its customers. In a widespread incident, early claims can use it up before yours is paid.
- The policy is built around the vendor. A vendor’s cyber policy is written around the vendor: its own breach costs erode the same limit as your claim. When a vendor incident harms you, the costs can fall on your own cyber program.
Our paper The hidden weakness in third-party cyber risk transfer goes into each of these three key gaps in greater detail, setting out what the current situation is and the impact this has for enterprises and their vendor ecosystem.
Who is covered when a vendor fails?
A vendor's certificate of insurance confirms one thing: that a policy exists. It doesn't confirm the policy will respond to the way your organization needs should it be harmed. It doesn't reveal what's excluded. And it almost never reveals the detail that matters most - how many other companies are already relying on that shared, identical limit.
| Incident | Policy designed to cover it |
| A cyber incident at your organization | Your cyber policy |
| A cyber incident at your vendor that affects the vendor | Your vendor's cyber policy |
| A cyber incident at your vendor that harms your organization | ? |
If you can't answer the third row with the same confidence as the first two, that's not a hypothetical gap. It's the exposure sitting inside your vendor ecosystem right now.
Most vendor cyber policies are shared resources of one aggregate limit. When a vendor is hit, you’re competing with all of its clients for the same cyber limit, whether that's ten, one hundred or a thousand - and the vendor claims from it first. In a contained incident, that might not surface as a problem. In a systemic one - a supply chain compromise, a widescale ransomware event - early claimants can exhaust the limit, and you discover for the first time that the protection you thought you had was never dedicated to you.
SOLUTION
True Transfer: dedicated protection for each critical vendor
True Transfer is a cyber insurance solution built from the enterprise’s side of the vendor relationship, underwritten by Trium Cyber on behalf of Syndicate 1322 at Lloyd’s. It is designed to move vendor-specific cyber risk out of your primary cyber insurance program and gives it its own dedicated limit on a True Transfer master policy.
Partnering with IRIDX, a HITRUST company, takes vendor risk management further by measuring the residual information risk each vendor presents to you, and the financial exposure behind it, as one standardized score.
That score is what True Transfer is built on. It tells you which vendors need their own protection and sets the price of each one. Each chosen vendor pays the premium for a limit no client of theirs can touch. Only you can claim, and it is paid directly to you.
True Transfer does not replace your cyber insurance, and it does not require vendors to increase their own cyber limits. It is designed to help keep your primary cyber limits intact while preserving your vendor relationships.
One platform to measure the risk. One policy to transfer it.
HOW IT WORKS
- 1Score. IRIDX measures the information and cyber security risk each vendor presents to you, and the financial exposure behind it. Every vendor gets one standardized score, so you can accurately compare risk across your whole vendor ecosystem.
- 2Choose. Use the IRIDX Score and your own risk tolerance to decide which vendors need their own coverage. You protect the relationships that matter most, rather than every vendor at once.
- 3Protect. Your organization binds a True Transfer master policy with no premium payable by your organization and no underwriting of your organization's own security posture. Each vendor you choose then pays for its own dedicated limit on that policy at the point of contracting, priced using its IRIDX Score.
- 4Claim. If that vendor causes a covered loss, you claim against your dedicated limit. No other client can touch it, the vendor’s own losses never draw on it, and the claim is settled between you and Trium Cyber, and paid directly to you.
BENEFITS
- A limit that is yours alone. You no longer share your vendor's aggregate limit with all of its other clients. You have your own dedicated, ring-fenced limit to rely on.
- Designed to protect your primary cyber program. Covered vendor incidents are paid from dedicated limits, subject to policy terms, rather than from your own program.
- You pay for the risk you choose to transfer. Premium is set for each vendor relationship, not across your whole vendor base.
- Claims come to you. Payment goes to your organization, not through the vendor.
- You can see what is covered. You get a clear view of which vendor risk you have transferred and which you still hold.
Find out which of your vendor relationships need dedicated protection
Speak with our team today about protecting your critical vendor relationships with True Transfer.
FAQ Frequently asked questions about True Transfer and Trium Cyber
How much will a True Transfer policy cost my organization?
There is no premium payable by your organization. The premium for each vendor endorsement is paid by the vendor, including taxes and fees, at the point of contracting. Paying the premium gives the vendor no rights under the policy.
How much will it cost my vendor?
Several variables set the premium for a vendor contract endorsement. They include the vendor’s IRIDX Score, a core rating factor, the contract value, the endorsement limit purchased, and other factors.
Can I purchase a True Transfer policy from Trium Cyber or IRIDX directly?
No. True Transfer is placed with Trium Cyber through your insurance broker and AmWins, the licensed excess and surplus lines wholesale broker on every True Transfer placement. IRIDX is not a licensed insurance broker.
Who is insured, and who gets paid?
Your organization is the only insured and the only payee. The vendor is neither.
I already require vendors to carry cyber insurance. Why isn’t that enough?
A vendor’s cyber certificate does not work the way its professional liability certificate does. First, the vendor’s own breach costs (response, notification, forensics, lost income) erode the same limit you are relying on, and the vendor will often be a claimant on its own policy alongside you. Second, a serious cyber event hits every client of that vendor at once and can exhaust the limit. The limit on the certificate was never dedicated to you.
What underwriting does my organization need to go through to bind a True Transfer policy?
There is no application and no underwriting of your organization’s own security posture. Standard policy conditions still apply. True Transfer benefits only you, but it is triggered only by your vendor’s act, error or omission causing a security or privacy event, never by your own. The vendor contract is the rated unit, priced at the point of contracting using the vendor’s IRIDX Score, among other factors.
How is the limit structured?
Each vendor contract carries its own ring-fenced sublimit on your master policy. It is never drawn on by the vendor’s own losses and never shared with the vendor’s other clients.
Who is IRIDX?
IRIDX, a HITRUST Company, is an information risk ratings company that develops and governs standardized methods and measures for residual information risk and related financial exposure. Its measures support third-party information risk management, enterprise governance, benchmarking, insurance underwriting and risk transfer. Visit IRIDX.com.
How do IRIDX and True Transfer fit together?
They are complementary. IRIDX measures the residual information risk a vendor presents to you and produces a Score. True Transfer, a policy underwritten by Trium Cyber on behalf of Syndicate 1322 at Lloyd’s, transfers that risk. IRIDX does not sell, broker or underwrite insurance.
How do I learn more about a True Transfer policy?
Ask your insurance broker to contact Trium Cyber, or email truetransfer@triumcyber.com for the attention of Amie Watson, Chief Underwriting Officer.
Disclaimer
True Transfer is underwritten by Trium Cyber on behalf of Syndicate 1322 at Lloyd's, and is available only through licensed insurance brokers via Amwins, a licensed surplus lines broker. Coverage is provided on a non-admitted basis, is not protected by state insurance guaranty funds, and may not be available in all jurisdictions. This page is a summary only. Coverage is subject to the terms, conditions, limits and exclusions of the policy as issued.