Maximise resilience, minimise risk

Improve insureds' cyber defences, reducing claims and safeguarding your portfolio, all whilst offering first-class incident response.

Speak to the team

CyberCare Insurer

Cyber incident response & risk reduction for insurers

A virtuous cycle of optimised risk management and resilience

CyberCare Complete provides everything needed to protect insureds during a cyber incident while minimising future claims.

By optionally using credited units to deliver proactive risk management services, insurers can actively strengthen the resilience of their insureds, reducing risk across their portfolio.

This unique approach ensures that insurers not only provide outstanding incident response but also take control of risk mitigation, aligning with their strategic goals and reducing exposure across their book.

Complete

Full-spectrum service from a single provider

CyberCare Complete

Verify

Enhance visibility & control over problem cyber claims

CyberCare Verify

What insured clients can expect from the CyberCare Complete service.

Full-Spectrum Service from a single provider

The CyberCare Complete InsurTech model

Growth tools and risk assessment

Empower brokers and insureds with proactive resources that drive growth and minimise risk. From educational content to broker tools and in-depth risk assessments, CyberCare Complete provides the insights needed to understand and reduce vulnerabilities, helping insurers strengthen portfolios and improve insured resilience.

Post-binding value added services

Enhance the insured experience with comprehensive value-added services designed to prepare for and mitigate cyber threats. From onboarding tools like a welcome pack and CRMM monitoring to proactive measures like tech assimilation, staff training, and exercises, CyberCare Complete ensures insureds are ready before incidents occur—all supported by a 24/7 incident response hotline.

Incident response

When a claim occurs, CyberCare Complete provides insureds with expert guidance and recovery services to minimise impact and restore operations quickly. From digital investigations and legal/crisis PR support to specialist claims intelligence, this service ensures insurers and insureds are supported throughout the entire response process.

A thorough onboarding process is central to CyberCare Complete, ensuring insureds and STORM are fully prepared to respond quickly and effectively to any cyber incident.

This process includes critical services that seamlessly integrate STORM’s expertise with insureds’ operations, empowering them to act with confidence and resilience, whilst reducing claims exposure for insurers.

Welcome pack

Comprising a compendium of useful Cyber Incident Response materials including a CyberCare guide, checklists and playbooks for common incidents and first responder lanyards.

Board-level briefing & strategic assessment

One of our CIR experts will present the current state of cyber risk and explaining the best strategies to manage it effectively. We will also provide a complimentary voucher for a CyberSeven board-level assessment.

CIR Assimilation

Our CIR experts will undertake a rapid learning of technical & organisational controls to assist in optimised response.

Cyber risk assessment

Our highly-experienced risk assessment team will deliver our Cyber3: Rapid Risk Review, a comprehensive analysis of your exposures with practical recommendations for remediation.

Attack Surface Scanning

We will provide advanced attack surface analysis scanning of insureds external digital estate. We can also apply this analysis to insureds supply chain upon request.

Cyber incident exercising

Our CIE team will deliver a tailored tabletop drill using a realistic, business-aligned scenario to test response to an incident. Post-CIE reporting will make recommendations for improvement.

Comprehensive resilience and readiness

Through its strategic onboarding process, CyberCare Complete ensures insureds have a well-defined and tested cyber incident response plan, and optimised recovery times.

By establishing these critical elements in advance, insureds and the STORM team are fully aligned and ready to respond to any incident with minimal risk and maximum efficiency. CyberCare Complete enables insurers to support insureds not just in reacting to incidents, but in building resilience to thrive in an ever-evolving cyber threat landscape.

Speak to the team

As a UK NCSC CIR Assured Service Provider, STORM Guidance operate to the very highest standards of cyber incident response.

In the event of an incident, the STORM team is ready to support insureds, swiftly responding to mitigate damage and ensure a rapid recovery.

Coordination Support

Enhancing the effectiveness and efficiency of how an organisation responds to and manages cybersecurity incidents.

Digital Investigations

Delivering specialists in computer forensics, log and malware analysis, penetration testing and data mining.

Legal Advice

Providing guidance on contractual and regulatory issues to minimise legal risks and navigate liability issues.

Threat Actor Engagement

Providing experts in ransom negotiation, sanctions checks, cryptocurrency settlements and tracing.

Crisis PR Advice

Supporting potential or actual need for effective crisis communications and reputational risk management.

Systems Recovery

Expert advice and support to ensure critical systems and data are rapidly returned to business-as-usual.

To find out more about our cyber incident response:

Incident Response

We Believe in Resilience—And Back It with Response Discounts

Our CyberCare credit units reward insurers for proactive risk management, driving down costs as your insureds’ resilience improves.

This unique model reflects our confidence in the effectiveness of our proactive services to minimise the impact of cyber incidents, directly reducing loss ratios and boosting your profitability. It’s a win-win: stronger insureds, fewer claims, and greater financial gains for you.

Speak to the team

CyberCare Verify - Enhance visibility & control over problem cyber claims

CyberCare Verify is an additional service offered to insurers to give greater visibility and control over problem cyber claims.

Our cutting-edge solution ensures robust cyber incident response practices, identifies potential pitfalls, and minimises unnecessary losses.

The CyberCare Verify service analysis, reporting and briefings will enable businesses and their appointed professional advisors to make informed decisions about the impact, obligations, recovery and other options available to manage risk optimally in the aftermath of a cyber incident.

Identifying unnecessary loss

Rapid triage of incident with engagement of incumbent providers to confirm activities are proportionate and cost-justified.

Digital investigations review

Providing highly experienced and qualified digital investigators to identify where assigned CIR has not followed best-practice.

Revealing conflicts of interest

Highlighting when insureds may be exposed to heighted operational and liability risk and situations of profiteering or betterment.

Pre & post ransom negotiation reviews

Review negotiation transcripts, interview negotiators and provide a scientific report on effectiveness and loss analysis.

Confirming key controls status

Assimilation of security controls to understand point-of-compromise, effective containment and assurance of future resilience.

Determining effective systems recovery

Expert advice and support to confirm that recovery has been optimal so that critical systems and data are rapidly returned to business-as-usual.

Full-Spectrum Service

As a UK NCSC CIR Assured Service Provider, STORM Guidance operate to the very highest standards of cyber incident response.

The CyberCare Verify service confirms such standards have been delivered to our clients.

Speak to the team

Common problems solved

CyberCare Verify provides a full-spectrum cyber incident review service.

Here are the key problems that CyberCare Verify addresses.

By addressing these issues, CyberCare Verify plays a vital role in enhancing business resilience, ensuring clients are better equipped to manage and recover from cyber incidents effectively.

Let's talk

Speak to our CyberCare team today

The high demand for CIR has led some providers to hire very inexperienced staff. In one case we note a CIR Team Coordinator with less than 1 year CIR experience (at mid-2023). By contrast, STORM specialists have decades of CIR and fraud investigations experience and will help guide teams through the incident as well as collaborating with incumbent providers to return to business as usual with greater resilience to future attacks.
The rise in the number of cyber security incidents has driven a need for CIR providers but many do not have the capability to minimise losses and deliver a great service. Too many investigations, for example, fail to properly identify the initial point of compromise (root cause) of a cyber incident.
CIR services are increasingly a 'bolt-on' security offering from SOC and IT Service providers, who often have a conflict of interest as well as lack of dedicated experience. Our Verify service will help identify potential or actual conflicts of interest and explain how these can be alleviated.
Being fastidious is a pre-requisite for a high-quality CIR capability. This should not adversely affect time or cost. In our verification role, we have noted a significant lack of quality in investigative process, IT recovery and reporting, potentially missing key issues that could lead to downstream problems or claims.
Some CIR providers charge high hourly or fixed rates for comparatively little work. Others use antiquated, drawn-out processes, such as in data mining and poor ransom negotiation techniques which add unnecessary cost to cyber incidents. The Verify service will enable businesses to determine appropriate response times, minimising the impact of an incident, including financial losses, reputational damage, and regulatory penalties.
Cyber incidents are increasingly hybrid in nature, causing or being triggered by other events such as physical security events and damage. Complex supply chains mean that third parties are inextricably linked to most cyber incidents. The Verify service enables teams to understand how these additional factors will affect their management of risk both during, and after an incident.
Effective communication is crucial during a cyber incident. The Verify service enables the STORM team to work with businesses and assigned providers to test and refine communication protocols, ensuring that information flows efficiently between technical specialists, management, and external stakeholders.
Our Verify assignments often reveal previously unidentified technical vulnerabilities that could be exploited by attackers. Identifying and remedying these vulnerabilities before an actual attack occurs can strengthen security posture. Furthermore, our rapid analysis of 'Indicators of Compromise' that are often missed by other providers, enables us to quickly identify and eradicate exposure in the aftermath of an incident.
For organisations subject to regulatory requirements regarding cybersecurity, the Verify service will provide situational clarity to help ensure that businesses are compliant with relevant laws and regulations such as GDPR, DORA, PCI DSS and others. This can prevent legal issues and fines associated with non-compliance in the aftermath of an incident.
What will cyber insurance cover in the event of an incident? How will a policy respond? As the CIR firm of choice on many cyber insurer panels, our Verify service will enable teams to leverage the optimal benefits of cyber insurance coverage.
IT support companies & MSPs involved in the CIR process encourage their clients, as victims of cybercrime, to implement controls and systems which are not material to recovery to a position of resilience and business-as-usual. Our Verify service will help to identify such practices and sensitively assess the actual need for additional costs.
This highly specialised area has been particularly attractive to charlatans. Our experts, who have negotiated hundreds of ransoms (ransomware and K&R), authored and trained ransom negotiation best practice for the UN, have witnessed several poorly negotiated incidents and identified firms (and the legal panel providers) whose capability as ransom negotiators is, at the least, questionable and at worst risks costing insurers significant amounts in overblown settlement or costs from failed negotiations.
An assumed understanding of critical business systems and processes is often left unchallenged when a crisis occurs and a lack of experience can mean that key exposures are not identified and alerted.

Our Verify team will help decision-makers, at all levels, to see the wood for the trees when collaborating on impact reduction. This information can also help to inform any cyber insurance claim.

What are CyberCare units and how do they work?

CyberCare turns your investment in cyber claims into tangible protective enhancements, improving insureds resilience to cybercrime and ultimately reducing claims.

CyberCare Complete provides you with an investment that is not wasted through the optional use of credits earned during the claims cycle into proactive risk management activities. Find out how...

Understanding the value of CyberCare units

CyberCare Complete enables insurers to both purchase units for cyber incident response services and earn credited units for the proactive risk management services delivered to each insured.

These units can then be used in cyber claims for any specialism in any combination as follows:

Claims Manager: 1 unit per hour
CIR Coordinator: 1 unit per hour
Cyber Security Investigator (Case Lead): 1 unit per hour
Senior Legal Advisor: 1.5 units per hour
Legal Advisor: 1 unit per hour
Forensic/Testing Specialist: 1 unit per hour
Crisis PR Specialist: 1 unit per hour
IT Recovery Specialist: 1 unit per hour
Data Mining Specialist: 1 unit per hour
Ransom Negotiator: 1.5 units per hour
Surge Notification Support: 1 unit per hour
Trauma Counsellor (Victims of Crime): 1 unit per hour

The additional value of CyberCare units

Your investment means that CyberCare Units that are not needed for claims response are not wasted.

They can be used to drive a host of other valuable activities that you can deliver to your insured clients including:

Virtual CISO (vCISO) activities; just request our vCISO service proposal
Penetration testing and attack surface scanning (including on third-parties)
Additional cyber risk assessments or cyber incident exercises
Regular Threat Intelligence (TI) reports
Staff awareness campaigns (computer-based training)
Fraud prevention briefings
Contract review (AI-driven)
Data protection & privacy and other regulatory advice

Typically, unused CyberCare Units would be used towards the end of a subscription period although as long as the minimum balance is maintained they can be used at any time for any of the assignments above.

We respond to any cyber or fraud incident, globally

The team at STORM have considerable experience across the field.

CYBER INCIDENTS

Learn more about some of the more common incident types we respond to.

Contact the CyberCare team

If you would prefer to speak to the team, give us a call:

UK/Europe: +44-203-693-7480

Africa: +230-434-1277

USA: +1-703-232-9015

Your contact details will only be used in connection with this enquiry. Please read our Privacy Policy.