Walk through the invoices after a breach, and you’ll see the forensics firm, the breach attorney, the notification vendor, and the PR team. Every one of them gets paid, and your cyber policy is why.
Now look for the line item covering the IT director who worked three straight weeks to keep the business running. There isn’t one.
A Ponemon Institute study found that 38% of security leaders considered leaving their jobs after a major breach. That aligns with the reality that the same few employees handle forensics, legal exposure, regulators, and system recovery on top of their regular work.
What You’re Really Buying
Strong incident response coverage brings a team that’s lined up before you need it, including a breach coach, outside forensics, legal counsel, and notification vendors. That’s different from a policy that only reimburses you after the fact.
Your IT lead ends up working next to people who handle breaches full time, which shortens the timeline and takes weight off the person who would otherwise carry it alone.
The Salaried Overtime Gap
Extra expense coverage reimburses costs beyond what you normally spend, so for hourly employees it can pick up overtime. A salaried paycheck is money you were already spending, so there’s nothing extra for the carrier to reimburse even when that person works eighty-hour weeks.
Every outside vendor has an invoice the carrier can pay against. Your IT director has a salary that was already on the books, which is exactly why nothing extra comes back to them.
Fixing It Before a Claim
Raise it with your broker during negotiation. On accounts with leverage, you can ask the carrier to amend the extra expense wording to include internal salaried employee time at a documented hourly rate, and adding that at binding beats arguing about it during a claim.
You can also put a written incident stipend in place for exempt staff. It sits entirely in your control and costs nothing until you use it.
Tell the Carrier, and Think About Who Else Knows
If you set up a stipend, disclose it to your carrier and underwriter rather than surprising them at claim time. A pre-documented program is easier to defend as a legitimate expense, and undisclosed compensation arrangements invite questions you don’t want during a claim.
Whether you announce it broadly to staff is a separate question worth thinking through. Any payment tied to breach hours creates an incentive problem, since you don’t want someone benefiting from a slower response or a longer incident.
The cleaner approach is to tie the stipend to resolution and containment milestones rather than hours logged. Your underwriter will likely have an opinion on the structure, which is another reason to bring it up early.
What I Look for in a Program
When I review a cyber program, I look past the limits and ask whether the policy takes real weight off the team or just pays out after the damage is done. You can usually tell the difference by whether the client’s best people are still there six months later.
If you want to go through what your policy provides during an incident, reach out and we’ll walk through it.
I am running a few minutes late; my previous meeting is running over.
About me: I’m Joe Erle, Cyber Group Practice Leader at C3 Risk & Insurance Services. c3insurance.com/cyber
Source: Ponemon Institute. Overtime treatment reflects general Fair Labor Standards Act rules for exempt employees and standard extra expense coverage structures. Coverage terms vary by carrier and policy; review your specific policy language with your broker.
