Skim time: 6 minutes · Listening time: 6 minutes. Prefer to listen? Flip reads this week’s Brief here.

---

If you and I were chopping it up this week, here's what I'd bring up.

First, cyber. The headline is that policies jumped by a third. But nearly two-thirds of them are endorsements that average about $80.

$80!

I don't care how many of those got sold. I want to know what one pays when your controller sends a wire to a fraudster.

Second, a New York bad faith case every insurance operator should read. The policyholder claims $1.56 million. The insurer agrees to $246,718. The judge says how they handled the claim can be its own lawsuit, liability policy or not. Twenty days later, they settle, and I haven't seen anybody mention that part.

If your position letter is basically your consultant's report with your logo on it, read this one.

Third, Boeing. Insurers paid $237.5 million on one oversight suit, and a Delaware court tossed the next one in August. Neither was about AI. But it's the same duty. So who owns AI at your company, and can you prove it?

Same story all three times. Having the paper is the easy part!

---

How to check your cyber cover when nearly two-thirds of policies carry almost no premium

Nearly two-thirds of U.S. cyber policies now bring in about 4% of the premium.

The National Association of Insurance Commissioners (NAIC), the state commissioners' standard-setting body, published its annual cyber report last month. Domestic insurers wrote $7.46 billion in 2025, nearly triple 2020. Policies in force rose 33% to 5.84 million, mostly on endorsements, cyber bolted onto another commercial policy.

Those rose 53.8%, against 13.6% for primary policies.

Domestic market, 2025	Share of policies	Share of premium	Premium per policy (our arithmetic)	Loss ratio
Endorsement	62.8%	3.9%	about $80	19.1%
Primary	35.9%	63.7%	about $2,300	57%
Excess	1.4%	32.5%	about $30,000	52%

The report calls this "bundling modest amounts of cyber protection into other commercial lines."

The industry loss ratio rose to 53% from 48.7% while rates fell for eight straight quarters through Q1 2026, the latest data in the report. The endorsement ratio nearly doubled to 19.1%, and NAIC doesn't say why. That can mean a healthy book, or cover that pays little when it's used.

An $80 average doesn't tell you your limit, so read yours.

(sources: NAIC, Report on the Cybersecurity Insurance Market; Insurance Business)

So what?

Endorsement or standalone, find out what it pays. Modest may be fine, depending on your biggest loss. Set the wording against three numbers:

1. Your largest wire. Perry & Perry Builders sent $874,864 to a fraudster and collected $250,000 under one cyber crime sublimit. Find your limit for money your staff is tricked into sending.
2. Your ransomware bill. Coalition's data, cited by NAIC, puts the average claim at $269,000. CiCi Enterprises had a $3 million limit, was paid $250,000 under a sublimit, and went to federal court for the rest. Check any sublimit, and whether an endorsement shares the host policy's limit.
3. Your key vendor's outage. Check whether the cover needs a security failure or also pays on a plain system failure. CrowdStrike's 2024 outage came from a defective update, and Parametrix estimated only 10% to 20% of $5.4 billion in Fortune 500 losses was recoverable through cyber policies.

If you're a regional mutual writing these, run the math. As an illustration, 10,000 endorsements at $80 bring in $800,000. At a $100,000 limit, a vendor outage reaching 2% of them at full limit costs $20 million, about 25 years of that premium. Set your modeled loss, net of reinsurance, against surplus. If you're an MGA, check the cyber limit your carrier agreement requires against what you hold.

Here's our own book as of this week, which isn't the whole market. One insurer's renewal came in with the premium up about half as much as its revenue, on the same terms. A first-time buyer we took to 12 insurers paid about $1,500 more than a $1 million quote for three times the limit, and its cyber crime limit is still $250,000. A small account's automatic renewal quote came in up about 10%, so soft doesn't mean every price falls.

Ask your board: What would our cyber pay on the loss we worry about most, what's the limit, and can we prove every security answer on our application?

Then there's what happens after the claim goes in.

---

How to keep a claim file from becoming its own lawsuit after an insurer agrees to $246,718 on a $1.56 million claim

Renergy asked its insurer for about $1.56 million after a pollution incident, the insurer agreed to pay $246,718, and Renergy says the way the claim was handled left liens on its property and cost it chances to sell.

On May 1, a federal magistrate judge in New York let Renergy add a bad faith claim against Mt. Hawley Insurance Company under an environmental liability policy. Renergy alleges Mt. Hawley adopted a consultant's findings without enough independent analysis, sent duplicative document requests and shifted coverage positions after years of claim activity. None of that has been proven.

Mt. Hawley argued New York confines these claims to first-party cover. Judge Katharine Parker disagreed: "New York recognizes bad faith claims handling regardless of whether the claim involves first-party or third-party liability coverage." She relied on a 2024 appellate decision, Rockefeller University v. Aetna, and kept the bad faith claim separate from the contract claim, because one turns on the denial and the other on the handling.

Keep it in proportion. This is a pleading ruling from a federal magistrate judge, it doesn't bind New York's state courts, and she notes these claims are still "narrowly recognized." Conclusory complaints still get dismissed, and the opinion cites examples.

Twenty days after the ruling, the parties told the court they had settled, and the orders we read don't give the terms.

(sources: Renergy v. Mt. Hawley, opinion and order; order on the notice of settlement; Insurance Journal)

The LION Lens

What's at issue	Where it meets your program	Ask now
A consultant's findings adopted without your own analysis	Insurer E&O and the vendor contract	Who signs the decision, and who pays if the outside review is the problem?
Vendor liens, penalties and lost sales	ECO/XPL: bad-faith damages and judgments above limits	Does our wording reach consequential damages from claim handling, or only a failed settlement and an excess verdict?
A model in the consultant's seat (our extension, not in this case)	Insurer E&O, ECO/XPL and the vendor contract	Who reviews what the tool produces, and would the file show it?

So what?

For carriers, this moves part of the exposure from the money to the process. On this judge's reading, a New York liability carrier can't count on the policy type to end a bad faith claim, and other states' rules vary. Whether the denial was right is the contract claim, and how you got there is the other one.

A specific complaint about late fees, liens and lost sales can get past the pleadings, and then the claim notes get read. Using a consultant isn't the problem. Adopting the findings without your own analysis is the allegation.

If you're a regional mutual, check whether your insurance company professional liability (ICPL) and ECO/XPL wording responds to this damage, on every layer, and whether your treaties' ECO clause follows. Wording varies, so don't assume it does.

If you're an MGA with claims authority, ask who answers for the handling and whose policy responds, which is close to where our E&O series starts Wednesday. If you're the policyholder, tell the insurer in writing what the delay is costing you while it's happening, and keep the lien and penalty notices.

We can't say the ruling drove the settlement, we don't know the number, and a settlement isn't an admission. But the commentary we read doesn't mention it, and the opinion is still being cited.

The LION POV

Here's what we're raising with clients who write or handle claims:

• Own the conclusion. Good is a file showing the examiner's reasoning on each disputed item, with rules from counsel on what goes in the notes. The tell: the position letter reads like the consultant's summary.
• Ask once, and say why. Good is a log tying each document request to an open coverage question. The tell: the same request, a third time, from a new examiner.
• Date every change of position. Good is a letter naming the new fact that changed it. The tell: a new ground for denial, years in, with no explanation.

Ask your board: Would our last contested claim file show our own reasoning, who reviews those files before they become suits, and does our cover reach the damages a policyholder would claim?

A board's own file gets read the same way.

---

How to build your board's AI file when one oversight suit cost Boeing's insurers $237.5 million and the next got tossed

Boeing has now faced two board oversight suits: insurers paid $237.5 million to settle the first, and a Delaware court threw out the second in August despite 95 pages of alleged red flags.

Neither suit was about AI, but nothing in oversight law carves AI out. Caremark, the 1996 Delaware decision behind most of these claims, requires bad faith: no reporting system at all, or one directors consciously failed to monitor, including by ignoring red flags. In an October 15 Bloomberg Law commentary, Rehan Hasan of Omnus Law applies that to AI and says no Delaware court has yet decided an AI oversight case.

A May analysis in Law360 said the same, and we found none this week.

"Delegating oversight to a vendor doesn't transfer the underlying duty," he writes, an argument and not yet a holding. He wants a current list of material AI systems with owners and risk ratings, "a reasonable 60- to 90-day ask" of management, which is his suggestion and not a legal deadline.

These suits are hard to win, and the August Boeing dismissal turned on a pleading rule. But Marchand v. Barnhill, the Blue Bell case, survived a motion to dismiss, on a board with no board-level monitoring of its central risk.

A board that can show a working system, and what it did with what came up the line, is better placed than one that can't.

(sources: Bloomberg Law; In re The Boeing Co., Del. Ch.; D&O Diary)

So what?

The money question is the settlement. Delaware law lets a corporation pay expenses in a derivative suit, one brought on the company's behalf, but doesn't list settlements or judgments. It does let the company buy insurance for them. A settlement is Side A's job: cover for directors and officers when the company can't or legally may not pay.

Caremark is a bad-faith claim, and a final bad-faith ruling could trigger a conduct exclusion, depending on its wording. Check that it applies only after a final, non-appealable ruling. Then read your D&O (directors and officers) for AI wording, on every layer. As of late October, the financial institution renewals we're placing haven't carried AI-specific exclusions, which is our book, not the whole market.

Structure matters. A Delaware LLC can cut back these duties in its operating agreement, though not the implied covenant of good faith, so an MGA should read its own and name who owns AI. A mutual has no stockholders, but a receiver can pursue directors. For insurers, the NAIC's AI bulletin, guidance adopted in 29 jurisdictions, expects senior management accountable to the board.

Build the inventory to include AI inside vendor tools and agents that act on their own, and keep the record consistent. In August, a Delaware court quoted a board's AI transcript, which told a different story than its minutes. Ask your general counsel how to run this, including privilege.

Ask your board: If a shareholder asked what we knew about our AI risks and what we did about them, what would our records show, and does that match what we told our underwriters?

---

The Bottom Line

More policies, a paid claim, an AI vendor. None of that tells you what happens when somebody tests it.

Start with the document you already own: the endorsement wording, the last contested claim file, the AI inventory. Read each one against what you actually do, and record what you decided with your counsel and broker. Cyber rates have been soft through the latest data, so start that wording conversation first.

Three for your board on Monday

1. The market. What would our cyber pay, and do we know the limit?
2. The claim file. Would our last contested file show our own reasoning?
3. The AI file. What would our records show about our AI risks, and who owns them?

Put 150 days before your next renewal on the calendar for the wording conversation.

---

ICYMI: On Wednesday I told this list we're starting a series: twelve Wednesdays on your own E&O, starting November 11. In my experience, two insurers can look identical on the binder and behave nothing alike once a claim gets expensive.

---

Thank you for reading today's edition.

Want to share it? Copy the link below:

https://lionspecialty.kit.com/posts/your-cyber-says-yes-three-numbers-show-what-it-would-actually-pay

And if this was forwarded to you, subscribe here.

Stay Covered Everybody,

-FLIP

P.S. Want us to read your cyber endorsement, your D&O and your E&O against this week's questions before your next renewal? Reach out for a confidential conversation: book a time or reply to this email.

P.P.S. Nothing in this briefing constitutes legal advice. These are the opinions of the founder, and coverage is always subject to the terms of each policy. It's market intelligence designed to help you ask better questions of your advisors and make sharper decisions at your next insurance renewal.

---

You're receiving this because you subscribed to the LION Specialty Boardroom Brief.
Unsubscribe  ·  Update your preferences
Forwarded this, or unsubscribed by mistake? Subscribe here.