Skim time: 7 minutes · Listening time: 6 minutes. Prefer to listen? Flip reads this week’s Brief here.

---

This week, the software behind a big chunk of the internet needed an emergency fix.

That includes a lot of insurer, MGA and insurtech websites. PHP is a three-letter acronym nobody had heard of a week ago. Now we all know way too much about it.

We also found out hackers had stolen a key to a backup tool that a lot of IT firms use.

They tried it on more than 2,250 organizations’ Microsoft 365 systems. And most of the companies caught up in either one never picked that software. Somebody else did: their web firm, their IT provider.

When European governments start pulling their own websites offline, a lot of people in our industry will go straight to systemic risk.

One flaw, thousands of policyholders, all at once. That conversation matters, especially for carriers writing cyber. But I think this week shows it’s more basic than that.

A lot of your security is now run by people you didn’t hire, on platforms you didn’t pick. The tech, the payments, the vendor contracts and the insurance can each sit with a different person. And nobody owns the loss in between. You can outsource the work. You can’t outsource the loss.

So every story this week comes back to two questions: who let them in, and who pays? The “who pays” part is harder than it sounds. Depending on the wording, a hack or a stolen wire could land in your cyber policy, your crime policy or your FI (financial institution) bond. Or in the gap between them. Better to find out now than after the money’s gone!

• The choices you didn’t make. A flaw in PHP and a stolen vendor key.
• The report. Insurance regulators’ new cyber report, and the fraud CEOs fear most.
• The drill. How to practice the loss, not just the hack.

---

How to find the outside choices that left you exposed this week

Two of this week’s biggest cyber stories started with choices most companies never made.

PHP is software used by WordPress and many other websites. It runs behind the scenes, helping sites process logins, forms and payments. On October 21, its developers released emergency fixes for two critical flaws that could let attackers run their own code on affected servers without logging in. Details had leaked a day early, and government agencies in the Netherlands, Finland and Austria took sites offline as a precaution.

When it issued its warning that day, CISA, the federal cyber defense agency, said it had not observed the flaws being exploited. Amazon’s threat team has since reported that attackers are exploiting them widely, and says it spotted one attempt on October 17, four days before the fix. How many attempts succeeded isn’t known.

ConnectWise, one of the largest software suppliers to outside IT firms, runs a backup tool for Microsoft 365. Attackers stole the tool’s own key and used it to try to get into more than 2,250 organizations’ Microsoft 365 systems, which hold email, files and chats. Microsoft, which disclosed its findings on October 21, blames a group it calls China state-aligned. ConnectWise suspended the affected services after detecting suspicious activity and is restoring them in stages.

In both cases the decision sat with someone else: a web firm picked PHP, and an IT provider picked the backup tool and gave it the keys.

(sources: ABC News, October 21, 2026, on CISA’s statement and Amazon’s findings; Illumio; BleepingComputer, October 20 and 21, 2026; Pasquale Pillitteri, October 21, 2026; Microsoft Threat Intelligence via Cybersecurity Dive, October 22, 2026; TechCrunch, October 22, 2026; ConnectWise Trust Center)

So what?

Picture an MGA (managing general agent, writing business on a carrier’s paper) whose website and email are both run by outside firms. Nobody at the MGA has thought about either since the day they signed.

This week asks three questions of it:

1. Where are we exposed? Ask your web firm and IT provider: do we run PHP anywhere, and when did the fix go in? Which outside tools can reach our Microsoft 365? Get the answers in writing.
2. Is a clock running? Some policies shift more of the loss back to you when known software flaws stay unpatched. Chubb’s neglected software endorsement, for example, describes a 45-day grace period for flaws published in the government’s vulnerability database, followed by increasing risk-sharing. Check whether your policy has this kind of wording, and what starts the clock.
3. Will the vendor pay? Read your contracts with those firms. Do they make the vendor pay if its choice causes your loss, and does the vendor carry insurance big enough to back that up?

Ask your board: Which outside firms make security choices for us, and what happens if one of those choices fails?

The NAIC’s new report shows how common this has become, and where the money goes next.

(source: Chubb, Cyber COPE, on the neglected software exploit endorsement)

---

How to read the NAIC’s cyber report: the gap is on page 16

The NAIC’s new report brings together insurance-market data and outside research on how cyber losses are changing.

The National Association of Insurance Commissioners (NAIC) is the standard-setting body run by the state insurance commissioners, so your own regulator is reading this report. It came out October 20. Three of its figures stand out, each from a different source. Verizon’s breach data shows nearly half of breaches now involve an outside party (48%). Insurance-market data shows the industry’s cyber loss ratio at its highest since the COVID-era ransomware spike, even as prices fell for two straight years. And Chubb’s own claims data shows its average claim for companies with $1 billion or more in revenue roughly doubled in a year, to about $4.4 million.

Page 16 is the page a board should read. It sets three findings next to each other:

• CEOs now rank cyber fraud first, ahead of ransomware, in the World Economic Forum’s survey of executives. 73% said they or a business leader they know was hit by it in 2025.
• CISOs (chief information security officers) still rank ransomware first, with supply chain problems second.
• Standard cyber policies often exclude or sharply limit fraud losses like these, and rely on a separate crime policy to respond.

The report calls that last point “a structural gap.” It also describes what the fraud looks like now: one criminal fakes the caller ID while another runs a deepfake voice, so an employee hears “the CEO” asking for a wire.

The cyber program is built around the CISO’s list, and the CEO’s fear runs through a different policy.

(sources: NAIC, Report on the Cybersecurity Insurance Market, 2025 reporting year, October 2026, pages 9, 10, 13 and 16, citing AM Best, Chubb’s 2026 cyber claims report, Verizon’s 2026 Data Breach Investigations Report and Debevoise; World Economic Forum, Global Cybersecurity Outlook 2026, January 12, 2026)

The LION Lens

Use this as the checklist for a side-by-side review of your policies, not as an answer sheet. Social engineering cover means cover for money an employee is tricked into sending.

Scenario	Coverage to check	Question to resolve
A fake CEO call prompts a wire	Social engineering provisions across crime, cyber and any FI bond	What limit and verification conditions apply?
A vendor’s payment instructions change	Social engineering and related fraud provisions	What verification does the wording require?
Instructions arrive from a hacked mailbox	Computer fraud, funds transfer fraud and social engineering provisions	Does the wording treat a hacked system differently from a payment our employee approved?
An employee knowingly takes part	Employee theft or dishonesty provisions	Which conduct, which employees and what discovery deadlines apply?

So what?

Two weeks ago we asked you to check whether your crime and cyber policies each carry social engineering cover, and which one pays first. The NAIC has now put the same gap in a report written for regulators.

The hard part is how the money leaves. An employee may approve the payment without knowing the instructions are fake. That distinction can matter when the insurer decides which coverage applies, because some provisions are written for someone getting into your systems without permission and others for an employee who was fooled.

The gap lasts because two people own the two policies. The CISO fills out the cyber application and owns the response plan. The crime policy or FI bond often renews on a different date and sits with the CFO. For a regional mutual, that can mean two renewals, two sets of definitions and nobody whose job is the space between them.

That crime policy also runs on its own clock. Many crime forms require notice as soon as possible and a sworn proof of loss within a set window, often 120 days. In Gray & Associates v. Travelers, a federal court in Maryland held an insured to its policy’s deadline, and an employee theft went unpaid.

A softening market is the time to fix it, because carriers competing on price will talk about wording.

The LION POV

Here’s how we’re advising clients to close the gap this renewal:

• Read both policies on one page. Good is one sheet that answers each question in the table for your own cyber, crime and FI bond wording. The tell: cyber and crime reviewed by different people in different months.
• Check your vendors’ paper. Good is a contract that makes your web firm and IT provider pay for losses they cause, backed by their own insurance, with proof on file. The tell: a contract nobody has read since it was signed.
• Name an owner for the gap. Good is one person accountable for coordinating the review, the notice and the claim across both policies. The tell: the answer depends on who you ask.

Ask your board: If our CEO’s biggest fear comes true tomorrow, which policy responds, and how much?

The fastest way to find out is to practice it.

(source: Wiley on Gray & Associates, LLC v. Travelers Casualty & Surety Co. of America (D. Md. 2008); ISO commercial crime conditions)

---

How to practice the loss, not just the hack

Most cyber drills end when the hacker is out, but a fraud loss ends when the money is gone.

Look at who’s usually in the room: the CISO, IT, legal, communications. Treasury often isn’t, and neither are the outside firms that run your systems or whoever owns the crime policy.

The response plan sends everything to the cyber insurer’s breach coach (the law firm a cyber insurer assigns to run the response). That works for a break-in. It leaves a wire fraud loss with no owner for the steps that decide whether the crime policy pays.

The bank’s clock is faster still. The FBI’s Recovery Asset Team, the unit that works with banks to freeze stolen wires, took on 3,900 cases in 2025 with about $1.16 billion at stake and froze $679 million. Its advice is to call your bank immediately and report it to the FBI, whatever the amount.

A company can handle the technical side perfectly and still lose the claim on paperwork.

(source: FBI IC3 2025 Internet Crime Report, pages 17 and 18)

So what?

Picture an insurtech running this year’s drill with the money left in. Four steps do it:

1. A vendor emails new bank details for a $1.8 million invoice. Who checks, and against which number?
2. The wire left two hours ago. Who calls the bank, who reports it to the FBI, and who tells which insurer?
3. The email came from the vendor’s real, hacked account. Who calls the vendor, and whose insurance responds?
4. Your IT provider says one of its tools was the way in. Who on its side picks up the phone, and what does your contract say?

Three changes make it work. Put the CFO or treasurer, the crime policy’s owner, your broker and your key vendors’ contacts in the room. Write the first hour on one page treasury can find at 6 p.m. on a Friday. And give each deadline a named owner.

Ask your board: When did we last practice a fraud loss all the way to the insurance claim?

---

The Bottom Line

This week showed how much of your security sits with other people: the firm that built your website, the provider that runs your systems, the vendor whose emails your team trusts.

So find out who pays before you need to. Know where you’re exposed and who fixes it. Know which of your policies would respond to a hacked system and which to a tricked employee, and where the gap between them is. Know what your vendors’ contracts and insurance will cover.

Then tell your underwriters what you’ve done. In a softening market, that’s something to negotiate with.

Three for your board on Monday

1. Find the outside choices. Which outside firms make security decisions for us, do we run PHP anywhere, and when was it fixed?
2. Name the paying policy. If a fake vendor email moves $2 million tomorrow, which of our policies responds, and how much?
3. Check the vendor’s paper. If a vendor’s tool or software is the way in, do its contract and insurance cover our loss?

If nobody owns the answer, name the owner before the next renewal, and practice the response before the next wire.

---

ICYMI: Two weeks ago we mapped Cybersecurity Awareness Month to your crime, cyber and D&O policies, including how to size a social engineering limit to your largest wire. Read it here.

---

Thank you for reading today’s edition.

Want to share it? Copy the link below:

https://lionspecialty.kit.com/posts/software-behind-much-of-the-web-needed-an-emergency-fix-a-vendor-s-stolen-key-was-tried-on-2-250-microsoft-365-systems-and-your-tabletop-skips-the-money

And if this was forwarded to you, subscribe here.

Stay Covered Everybody,

-FLIP

P.S. Want us to read your cyber policy, crime policy and key vendor contracts side by side before your next renewal? Reach out for a confidential conversation: book a time or reply to this email.

P.P.S. Nothing in this briefing constitutes legal advice. These are the opinions of the founder, and coverage is always subject to the terms of each policy. It’s market intelligence designed to help you ask better questions of your advisors and make sharper decisions at your next insurance renewal.

---

You're receiving this because you subscribed to the LION Specialty Boardroom Brief.
Unsubscribe  ·  Update your preferences
Forwarded this, or unsubscribed by mistake? Subscribe here.