Fragmented Cyber Risk Transfer Is Changing Board Oversight

LeadershipLeadership StrategiesFragmented Cyber Risk Transfer Is Changing Board OversightByHeather Wishart-Smith,Contributor.Forbes contributors publish independent expert analyses and insights. Heather Wishart-Smith is a board director who covers innovation.Follow AuthorMay 11, 2026, 04:44pm EDT--:-- / --:--This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.Cyber risk transfer is fragmented across overlapping policies, exclusions and emerging protections.gettyCyber risk transfer used to be relatively straightforward: purchase insurance, review the limits and assume the organization had shifted a meaningful portion of its exposure. That assumption no longer holds. Today, cyber risk transfer is fragmented across overlapping policies, exclusions and emerging protections – many of which only apply if organizations can demonstrate how they responded during an incident.For boards, that shift is significant. Cyber risk transfer is no longer just about coverage. It is about whether that coverage will hold up under testing, and whether the organization can prove it acted appropriately under pressure.Cyber Risk Transfer Is No Longer a Single PolicySteven Schwartz, co-founder & general partner, FireTower Risk SolutionsSteven SchwartzA decade ago, cyber insurance was often treated as a comprehensive solution. Steven Schwartz, co-founder and general partner at FireTower Risk Solutions, explained how the market has shifted away from a single, all-encompassing policy. “Carriers priced for losses that they can model – extortion, business interruption and privacy notifications,” he said. “The losses that actually hurt companies, though, were outside that model.” The shift has resulted in a layered system of cyber insurance, directors and officers (D&O) coverage and more targeted protections, each addressing different aspects of risk, but not always working together. “Where companies ultimately get hurt is when they have...