Hunton Insurance Recovery Blog

When a cyber incident occurs and the insurer pays out the claim, they often face the frustrating reality that pursuing the actual criminals – the threat actors – for indemnification is virtually impossible. Thus, insurers are now turning to subrogation claims against the very cybersecurity vendors entrusted by policyholders to protect their systems. Indeed, insurers are increasingly examining whether outsourced cybersecurity providers may have breached their contractual obligations or failed to deliver adequate protection, leading to the loss. This shift means policyholders may find their cybersecurity vendors facing legal action from their own insurer, creating a new layer of risk in vendor relationships.