When a company files a prospectus to go public in any APAC market, the document becomes a liability instrument the moment regulators receive it. Directors who sign off on that prospectus assume personal liability for every statement in it. Whether you’re listing in Hong Kong, Singapore, or elsewhere in Asia-Pacific, this isn’t corporate liability. This is individual exposure that can attach to directors’ personal assets, regardless of their role or seniority on the board.

The Prospectus Creates Statutory Liability for Individual Directors Across APAC

A prospectus is more than marketing material. Across APAC markets, statutory frameworks create binding liability for individuals who authorise prospectus disclosures.

In Hong Kong, Section 40 of the Companies (Winding Up and Miscellaneous Provisions) Ordinance establishes civil liability for directors, promoters, and anyone who authorised the issue of a prospectus. In Singapore, the Securities and Futures Act imposes similar personal liability on directors for prospectus misstatements. Across APAC, the pattern is consistent: statutory frameworks place liability directly on individuals.

This liability is strict. Investors who subscribed for shares based on an untrue statement in the prospectus can recover losses directly from named individuals. The statute doesn’t require investors to prove negligence or intent. It doesn’t require proof that the director personally knew the statement was false. If the statement was untrue, and an investor relied on it, the director faces civil liability across APAC jurisdictions.

The scope is broad. The prospectus includes not just the formal offering document filed with the Securities and Futures Commission (SFC), but also supplementary information, amendments, and any documents incorporated by reference. Every statement in these documents becomes a director’s personal exposure.

Criminal Liability Extends Beyond Civil Claims Across APAC

Civil liability is only the first layer. Across APAC, statutory frameworks create criminal exposure for prospectus misstatements. In Hong Kong, Section 40A of the Companies Ordinance creates criminal liability. In Singapore, Section 340 of the Securities and Futures Act establishes similar criminal exposure. This is criminal liability—not just money damages, but potential criminal prosecution.

The civil-criminal distinction is critical. Civil liability is often strict (no proof of intent required). Criminal liability typically requires knowledge or recklessness, but the penalties are steeper. Directors can face criminal fines and imprisonment for fraudulent prospectus disclosures across APAC markets.

Most private-company D&O policies were never designed to cover criminal defence costs. When criminal exposure emerges, directors discover that their insurance doesn’t extend to legal defence in regulatory investigations or criminal proceedings. This gap becomes acute when regulatory investigations follow a prospectus dispute.

Cross-Border Prospectus Liability Across APAC

Directors of companies listing across multiple APAC markets face layered liability across jurisdictions. A company listing in Hong Kong via Section 342E of the Companies Ordinance faces Hong Kong prospectus liability. A company simultaneously or subsequently listing in Singapore faces liability under the Singapore Securities and Futures Act. Companies listing across APAC markets accumulate prospectus liability in each jurisdiction.

This matters because directors often assume that prospectus liability attaches only to the jurisdiction where the IPO occurs. APAC market reality is different. A director of an Indonesian, Thai, or Malaysian company listing on the Hong Kong Stock Exchange faces Hong Kong prospectus liability even if the director is not resident in Hong Kong and the company is incorporated abroad. Similarly, a Singapore company listing in Hong Kong faces both Singapore and Hong Kong prospectus liability simultaneously.

Roadshow Statements Create Undocumented Liability Across APAC

The formal prospectus is filed and documented. Roadshow presentations are not. Yet across APAC, securities laws and listing rules treat roadshow statements as part of the offering record. Hong Kong’s Listing Rules and Singapore’s listing requirements both recognize roadshow materials as part of the disclosure process.

When executives present to institutional investors before an IPO, they make claims about business performance, market opportunity, competitive position, and financial projections. These oral statements form investor expectations. When investors later subscribe based on prospectus disclosures, they rely on consistency between what was said in the roadshow and what appears in the prospectus across all APAC markets where the company is listing.

If there’s a discrepancy, or if roadshow claims diverge from prospectus language, directors face liability for the roadshow statements even though they sit outside the formal prospectus. Roadshow materials—slide decks, notes, recordings—become evidence in litigation. What was said informally becomes part of the liability record formally.

Pre-IPO Communications Sit in the Offering Record Across APAC

Roadshow presentations aren’t the only pre-IPO communications that create liability. Analyst briefings, pre-IPO investor presentations, management meetings with underwriters, and even guidance given to major investors can form part of the offering record across APAC.

Under Hong Kong’s Securities and Futures Ordinance and Singapore’s Securities and Futures Act, liability attaches to any statement a director made in connection with the offering, not just statements in the prospectus itself. This extends liability backward to everything said during the IPO process and forward to statements made after listing if they’re connected to prospectus disclosures. APAC regulators treat the entire offering communication record—not just the formal prospectus—as the basis for director liability.

Directors face a paradox: the prospectus must be comprehensive to satisfy regulators, yet it can’t contain all the nuance and context directors want to communicate. Statements made outside the prospectus to flesh out context or address investor concerns create liability if they later diverge from prospectus language or if investors claim those outside statements affected their investment decision.

Forward-Looking Statements Create Ongoing Exposure

Prospectus liability doesn’t end when the prospectus is filed. Forward-looking statements—projections, guidance, and forecasts—create liability that extends well past the IPO.

When directors include revenue projections, earnings guidance, or market growth assumptions in the prospectus, those projections become the benchmark against which future performance is measured. If actual results diverge significantly from prospectus projections, investors can claim they were misled by forward-looking statements.

This exposure extends across years. A projection made in the prospectus can become the subject of litigation three years later, when actual performance falls short. The statute of limitations for Section 40 claims is typically long enough to accommodate this lag. Directors need to anticipate that prospectus projections will be scrutinised against actual results for years after the IPO.

Independent Directors Carry Equal Statutory Liability

A common misconception is that independent directors carry less liability than executives. The statute says otherwise. Section 40 applies equally to all directors who authorized the prospectus, regardless of whether they’re independent, non-executive, or executive.

This matters because it means independent directors can’t rely on the assumption that executives bore responsibility for the prospectus. Each director who signed off on the prospectus—or whose board approval was required for the prospectus—faces personal liability. Independent directors, audit committee chairs, and even newer board members can be named as defendants in prospectus litigation.

The exposure is uniform across the board. This is why a properly designed D&O programme has to provide Side A coverage (individual director protection) that protects all directors equally, not just the executives.

The Role of Reasonable Grounds Defence

Section 40A creates an exception: criminal liability only applies if a director made an untrue statement “without reasonable grounds to believe it true.” This “reasonable grounds” defence is the only statutory escape hatch from criminal exposure.

But the defence is narrow and fact-intensive. It requires that a director conducted reasonable due diligence, had credible information supporting the statement, and actually believed the statement was true. In practice, this defence is difficult to sustain without documented evidence of the director’s investigation and the basis for their belief.

Demonstrating reasonable grounds requires contemporaneous documentation—emails, due diligence reports, legal opinions, financial audit work papers, market research, and management representations. Without this documentation, a director’s claim to have had reasonable grounds collapses. With it, the defence has teeth.

This is why prospectus due diligence processes matter so much. They create the documentary evidence that can later support a reasonable grounds defence if liability questions emerge.

D&O Insurance Has to Respond to Statutory Liability

Private-company D&O policies focus on operational claims: employment disputes, product liability, contract breaches. Prospectus liability is categorically different. It’s statutory liability that attaches the moment the prospectus is filed.

A properly structured D&O programme for an IPO has to include coverage that explicitly addresses prospectus liability. This means:

First, statutory liability coverage that responds to Section 40 civil claims by investors. This coverage has to be broad enough to cover not just the formal prospectus, but all communications that form part of the offering record (roadshow materials, analyst briefings, pre-IPO presentations).

Second, criminal defence coverage that addresses Section 40A exposure and regulatory investigation costs. Most private-company policies exclude or sub-limit criminal defence. At IPO, this becomes a critical gap.

Third, Side A coverage that protects individual directors when the company’s interests diverge from theirs. In a prospectus claim, company and individual directors can be on opposite sides. Side A is the only coverage layer that protects directors independently of the company.

Fourth, sufficient limits to address the scale of prospectus claims. Investor class actions arising from prospectus misstatements can settle in the tens or hundreds of millions. Inadequate limits leave directors personally exposed for the shortfall.

Prospectus Liability Begins the Moment the Document Is Filed

IPO liability doesn’t start at trading commencement or at the close of the offering. It starts the moment the prospectus is filed with regulators. From that moment forward, every statement in the prospectus creates potential director liability.

This timing matters for insurance placement. D&O coverage has to be in place before the prospectus is filed, not after. Insurance purchased after filing leaves directors unprotected for the initial exposure period. Some claims arise immediately—from investors who read the prospectus and invest based on statements later shown to be false. Coverage gaps in the initial period leave directors bearing this early exposure personally.

Moreover, the prospectus filing date typically occurs months before the IPO actually closes. This extended period—from prospectus filing through trading commencement—is when most of the investor acquisition happens. It’s also when most prospectus-related disputes emerge if there are issues with prospectus accuracy or completeness.

The First Three Years Post-IPO Are the Highest-Risk Period

Prospectus claims cluster in the years immediately after an IPO. Stock volatility is high in early trading. Investor expectations are fresh from the prospectus disclosures. When stock prices decline or company performance misses guidance, investor litigation follows within months or a few years.

This means directors face the highest prospectus liability exposure in the first three years after going public. This is when regulatory investigations are most likely to commence. This is when shareholder derivative actions targeting prospectus representations are most likely to be filed. This is when forensic questions about prospectus accuracy are most acutely litigated.

A defensible D&O programme has to prioritise coverage in this window. Claims-made policies have to be carefully structured to ensure continuous coverage through this period. Tail coverage or extended reporting period endorsements have to be considered to protect directors for claims arising from the prospectus but reported after the initial D&O policy period ends.

Building a Defensible D&O Programme Around Prospectus Liability

Understanding prospectus liability is the foundation of a defensible D&O programme for IPO. The liability is personal, it’s statutory, and it’s immediate. It attaches to directors individually, it doesn’t require proof of negligence, and it begins the moment the prospectus is filed.

Directors who understand this exposure can take steps to minimise it: rigorous due diligence on every prospectus statement, documented reasonable grounds for forward-looking projections, careful alignment between roadshow materials and prospectus language, and insurance coverage that actually responds to statutory prospectus liability.

The prospectus isn’t just an offering document. For directors, it’s a personal liability instrument. The D&O programme has to be built on that foundation.

Three developments this week highlight how quickly the nature of technology risk is changing.

🔴 AI & Cyber | The exploit window is shrinking
OpenAI says its forthcoming Astra model has become the first classified at its “Critical” cybersecurity threshold, identifying unknown vulnerabilities and building working exploit chains in testing.
Read More

🟠 Fintech & Payments | Transaction authority becomes the attack surface
Google has detailed attacks against banks and payment providers aimed at core payment infrastructure and authenticated transaction credentials.
Read More

🟡 Digital Assets | Stablecoin resilience moves beyond reserves
Singapore has proposed legislation covering stablecoin reserves, redemption, stress testing, and cross-border issuance.
Read More

Continuum View
Emerging risk is moving from access to action. The question: what is the most consequential action a technology, credential, or person is authorised to take, and what prevents one failure from allowing it?

IPO day transforms director liability. Directors who sign the prospectus assume statutory and civil liability personally. Public disclosure obligations—quarterly filings, earnings guidance, regulatory updates—carry personal exposure. Stock price movements trigger shareholder claims naming them as defendants. Meanwhile, the private-company D&O insurance policy, built to protect against operational claims, fails to contemplate this exposure category.

D&O Insurance Becomes Essential at Listing

Most companies treat D&O insurance as a renewal item, something the broker handles on an annual cycle. However, IPO changes that entirely. D&O insurance becomes a placement document, sitting alongside the prospectus and underwriter agreements as a core piece of the IPO structure.

The reason is straightforward: going public creates new director liability that didn’t exist as a private company. Consequently, the D&O policy must protect against this new exposure. Otherwise, directors absorb the risk personally.

Most companies attempt to layer IPO-specific coverage onto their existing private-company policy through endorsements and side letters. Unfortunately, this approach fails because private-company wordings were never designed to contemplate securities claims. Bolt-on coverage creates gaps, sub-limits, and conflicts that expose directors exactly when they need protection most.

The Prospectus Creates Statutory and Civil Director Liability

The prospectus is the liability document of the IPO. Every statement in it carries personal exposure for the directors who sign off on its accuracy.

In Hong Kong, the Companies (WUMP) Ordinance imposes dual liability for prospectus misstatements. Section 40 establishes civil liability on directors for untrue statements in the prospectus, creating exposure to shareholder claims for losses incurred based on prospectus reliance. Section 40A further establishes criminal liability for knowingly including untrue statements.

This dual regime matters significantly because it expands exposure beyond the traditional insurance coverage model. D&O insurance typically covers civil claims. Criminal liability, by contrast, sits in a different category entirely—and most private-company policies were never drafted to include criminal defense costs.

Moreover, the prospectus exposes directors to underwriter liability. Underwriters conduct due diligence on prospectus disclosures. When that diligence identifies issues, underwriter disputes and indemnification claims follow—and those disputes often name individual directors, not just the company.

Critically, this exposure begins the moment the prospectus is filed. It doesn’t wait for closing or trading to commence. Directors face liability from filing day forward.

Post-Listing Disclosure Obligations Attach Personally

IPO liability doesn’t end with the prospectus. Instead, it accelerates.

Going public imposes continuous disclosure obligations on directors. They face personal exposure for quarterly earnings announcements, annual financial reporting, regulatory filings, and forward-looking guidance given to the market. Each disclosure carries potential liability to investors who rely on inaccurate statements.

Public disclosure liability differs fundamentally from prospectus liability. Prospectus liability is a one-time event. Public disclosure liability, by contrast, is recurring—quarterly, annually, whenever material information must be disclosed. It persists for as long as the company remains listed.

Under Hong Kong’s Securities and Futures Ordinance and the Listing Rules, directors bear responsibility for the accuracy of continuous disclosure. Failure to disclose material information creates regulatory exposure and shareholder liability. Additionally, misleading guidance in earnings calls creates reliance claims, and forward-looking statements that don’t materialize trigger securities litigation.

The cumulative effect is substantial: directors carry ongoing personal exposure for every material disclosure the company makes. This exposure class barely exists for private companies. Yet for public companies, it becomes a permanent liability category.

Securities Claims Are A New Loss Type

Private companies face operational claims: employment disputes, product liability, contract breaches, regulatory investigations. Standard commercial insurance and D&O policies built around operational risk typically cover these claims.

Public companies face securities claims—a different liability category entirely. Securities class actions are triggered by stock price movements and name directors as individual defendants. Moreover, these actions involve regulatory investigations by the SEC or equivalent authorities and carry reputational costs that far exceed the financial settlement.

Securities claims are not optional exposure for public companies. Rather, they are inevitable. A stock price decline of sufficient magnitude will trigger shareholder litigation, name directors, and force the company’s insurance to contemplate this as core exposure.

Most private-company D&O policies were not designed with securities claims in mind. Coverage language focuses on operational claims. Additionally, sub-limits apply to securities exposure, and exclusions carve out entire categories of securities liability. When the securities claim arrives, coverage gaps emerge—and directors discover they are underinsured.

Side A Cover Becomes The Single Most Important Layer

D&O insurance has three components: Side A, Side B, and Side C.

Side A covers individual directors and officers for their personal liability when the company cannot indemnify them—either because the company lacks financial capacity, because the company’s own coverage is exhausted, or because a conflict of interest prevents the company from providing indemnification.

For private companies, this distinction is largely academic. The company and board typically share aligned interests, and the company indemnifies directors as a matter of course.

For public companies, this alignment breaks down significantly. In securities litigation, the company’s interests often diverge from the board’s. The company may settle, cutting a deal that leaves directors exposed. Alternatively, the company may become insolvent, unable to fund indemnification. Or conflicts of interest may prevent the company from providing coverage.

When these situations arise, Side A becomes the only protection directors have. It covers them personally, independently of the company’s financial status or indemnification decision.

This is why Side A becomes the single most important part of the policy at IPO. It’s not ancillary—it’s essential. Directors need it to protect themselves when company and board interests split.

Finally, Side A coverage levels, attachment points, and exclusions must be carefully calibrated at placement. Underestimating Side A need ranks among the most common errors in IPO policy restructuring.

Historic Pre-IPO Acts Create Runoff Exposure

IPO liability doesn’t start at listing. Instead, it reaches backward.

Actions taken before going public face new scrutiny under securities claim standards after listing. A pre-IPO business decision that seemed reasonable in a private context can become the subject of shareholder litigation after the company goes public, based on its impact on future performance or market expectations.

Additionally, regulatory investigations reach into pre-listing conduct. Audits and SEC investigations often examine decisions made months or years before the public offering, looking for patterns or disclosure failures that should have been disclosed in the prospectus.

This backward reach creates runoff exposure. Directors need protection not just for forward-looking liability, but for the liability legacy they’re bringing to the public markets from their private-company past.

Typically, this runoff exposure requires either tail coverage (extended reporting period endorsements that continue coverage after the D&O policy ends) or runoff policies purchased specifically to cover pre-IPO acts. However, standard placement coverage may not adequately address this exposure.

Many companies overlook runoff exposure because they assume IPO coverage begins at listing and protects from listing forward. Unfortunately, this assumption is wrong. Runoff protection must be built into the policy structure.

Restructuring the Policy: Placement, Not Renewal

The timing of D&O restructuring is critical. It must happen at placement, not at renewal.

IPO placements create a window of opportunity. The IPO working group includes legal counsel, underwriters, and investment bankers all focused on disclosure and risk management. Moreover, the underwriter’s due diligence process creates a forum for reviewing insurance coverage gaps, and the prospectus itself provides an opportunity to disclose insurance arrangements and policy details to investors.

If companies defer D&O restructuring to the renewal cycle—months or a year after listing—these opportunities disappear. The IPO working group has disbanded. Underwriter leverage has evaporated. The prospectus is filed and locked.

More importantly, deferring restructuring leaves directors exposed in the months immediately after listing, when securities risk is highest. Stock volatility is pronounced around IPO. Investor expectations are freshly set by prospectus disclosures. Shareholder litigation risk is most acute in the weeks and months following public trading.

Conversely, restructuring at placement means coverage is in place before any of this exposure hits. Additionally, the D&O policy is built with IPO-specific knowledge—what the prospectus actually says, what disclosures were made, what exposure the underwriter identified.

The placement timing also affects pricing and terms. Underwriters and insurers are engaged in the IPO process, so companies can negotiate coverage as part of the broader placement transaction. Deferring to renewal means negotiating D&O coverage in isolation, without the context or leverage of the IPO itself.

Know Your D&O Coverage

Typically, companies treat D&O insurance as a back-office function. However, at IPO, it becomes a front-office issue. Directors need to know exactly what they’re protected against and what gaps remain.

Companies should take the following steps:

First, review what prospectus liability the policy actually covers—including criminal defense costs and underwriter indemnification disputes.

Next, confirm that securities claims protection is built into the core coverage, not carved out or sub-limited.

Additionally, understand Side A coverage levels and confirm they’re sufficient for worst-case scenarios where the company and board diverge.

Further, verify that runoff and tail coverage address pre-IPO acts and historic exposures.

Finally, test the vendor relationships and claims processes before an actual incident occurs.

The companies that complete this work are the ones that discover coverage gaps in time to fix them. Conversely, the companies that don’t are the ones that discover gaps when a securities claim arrives—months after the prospectus was filed.

Continuum helps companies audit their D&O policy before going public and build coverage that actually protects directors when it matters most: on listing day and in the months that follow.

The D&O policy your company has today isn’t the policy it needs on listing day.

What This Report Covers

• Why cyber insurance in APAC needs to be sized to the outage, not the data breach
• What a modern cyber policy actually buys you, and why the vendor panel matters more than the indemnity
• How AI-generated attacks like the Arup deepfake fraud sit between Cyber, Crime, and Social Engineering Fraud cover
• Where AI-specific exposures, supply chain risk, and social engineering fraud consistently fall short in mid-market wordings
• What a defensible cyber programme looks like across Cyber, Crime, and PI

Download the PDF →

Most cyber insurance policies were written for attacks that don’t happen anymore. Attackers targeted your perimeter. They tried to breach your data. They deployed ransomware against your infrastructure. Cyber policies were built to respond to those scenarios. But the threat landscape has fundamentally shifted. Attackers now exploit AI vulnerabilities, compromise your vendors, and use social engineering to trigger voluntary transfers. The policies haven’t kept pace.

AI Is Rarely Named Explicitly In Policy Language

AI has become a primary attack vector. Model manipulation, prompt injection, data poisoning, deepfake fraud. These are real threats that organizations face today.

But most cyber policies don’t explicitly reference AI. Cover for these threats is inferred, not guaranteed. The NIST AI Risk Management Framework provides a comprehensive approach to managing AI risks, but most cyber policies predate this framework and don’t incorporate its recommendations.

A policy might cover “fraud” or “unauthorized access,” but it doesn’t explicitly state whether that covers AI-generated deepfakes or model poisoning attacks. The OWASP Top 10 for Large Language Model Applications identifies specific LLM vulnerabilities that organizations should protect against, yet standard cyber policies remain silent on these threats.

This creates ambiguity. When an organization experiences an AI-enabled attack and files a claim, the insurance company can argue: this threat wasn’t contemplated in the policy language. Cover is disputed. The organization absorbs the gap.

Explicit coverage for AI-specific threats is beginning to appear in new policy wordings. But most organizations are still operating under older language that treats AI threats as variations of traditional fraud or system compromise, rather than as distinct attack vectors.

Supply Chain Risk Sits In Contingent BI—And It’s Sub-Limited

The most common attack path today isn’t through the insured’s own perimeter. It’s through a vendor or SaaS provider. Attackers compromise a less-secure supplier. The insured’s operations stall because they depend on that supplier’s service.

The CISA Securing the Software Supply Chain guidance outlines best practices for managing supply chain risk, but most cyber policies don’t adequately cover the financial impact when a vendor is compromised.

This is contingent business interruption exposure. It’s covered under most cyber policies—but typically as a sub-limit well below the main aggregate. An organization with $10 million in cyber coverage might have only $1 million in contingent BI sub-limits.

For an organization losing $500,000 daily when a critical vendor goes offline, a $1 million sub-limit covers two days of losses. The remaining exposure is uninsured.

Additionally, contingent BI coverage often requires proof that the vendor’s outage directly caused a demonstrable loss. Establishing that causal chain takes time. By the time the claim is approved, the organization has already absorbed months of recovery costs.

Social Engineering Cover Is Scattered Across Cyber And Crime Wordings

Social engineering attacks result in voluntary transfers. An employee believes they’re following legitimate instructions from an executive. The money moves to an attacker. The system worked correctly. But the loss is real.

This loss sits between cyber insurance and crime insurance. Neither policy owns it cleanly. Cyber insurance covers system breaches, not voluntary transfers. Crime insurance covers theft, but often excludes “voluntary parting”—situations where the victim willingly transferred money because they were deceived.

Social engineering fraud (SEF) coverage attempts to bridge this gap. But SEF is placed inconsistently across cyber and crime wordings. Some organizations have it under cyber. Some under crime. Some under both, but with different sub-limits and exclusions.

When a social engineering attack occurs, the claim gets disputed. Is this cyber? Is this crime? Does the voluntary parting exclusion apply? By the time the coverage question is resolved, the organization has already spent months without recovery.

Regulators Are Expanding AI Enforcement

Regulators in the UK, EU, and APAC are expanding enforcement around AI governance, model integrity, and data security. When an organization experiences an AI-enabled attack or discovers model poisoning in their systems, regulators open investigations.

The HKMA Supervisory Approach on Cyber Risk Management and HKMA Technology Risk Management Guidelines set expectations for Hong Kong institutions. In Singapore, the MAS Cyber and Technology Resilience Experts Panel and the MAS AI-Driven Cyber and Technology Risk Taskforce are actively working to strengthen defenses against AI-enabled threats.

The EU AI Act and AI Act Explorer set a comprehensive regulatory framework. The FCA’s AI governance expectations in the UK emphasize governance and operational resilience.

These investigations trigger notification requirements, defense costs, and compliance obligations. Traditional cyber policies address notification costs for data breaches. They don’t explicitly address notification for AI governance failures or model compromise incidents.

As regulatory enforcement expands, organizations are facing investigation costs that their cyber insurance doesn’t contemplate. The gap between actual exposure and insured exposure widens.

The Three Gaps Show Up In Almost Every Mid-Market Programme

When Continuum reviews cyber insurance programmes for mid-market and fintech organizations, three gaps consistently appear:

First, AI threats are inferred, not explicit. Cover for model manipulation, prompt injection, or deepfake fraud depends on how broadly the policy interprets “fraud” or “cyber attack.” That ambiguity creates claims disputes.

Second, supply chain risk is sub-limited. Contingent BI coverage exists but is capped well below the organization’s actual exposure to vendor outages. The most likely attack path is under-insured.

Third, social engineering sits in a grey zone. Whether the claim is covered depends on how cyber and crime policies interact, how SEF sub-limits are structured, and whether voluntary parting exclusions apply. The coverage landscape is unclear.

A Defensible Cyber Programme Aligns Wordings Across Cyber, Crime, And PI

Organizations need cyber insurance that explicitly addresses AI threats. They need contingent BI sub-limits that reflect their actual vendor dependencies. They need clear coverage for social engineering fraud without voluntary parting exclusions.

Most importantly, they need alignment. Cyber, crime, and professional indemnity policies should work together to close gaps, not create them. When a loss occurs, the organization should know which policy responds—not spend months disputing coverage.

This requires reviewing wordings against the current threat environment, not the environment they were drafted for. Most cyber programmes were built three to five years ago. The threat landscape has evolved. The policies haven’t.

Understanding Your Coverage Against Today’s Threats

Before renewing cyber insurance, organizations should ask:

Does the policy explicitly cover AI-specific threats? Or does cover depend on broad interpretations of “fraud” and “system compromise”?

What are the contingent BI sub-limits? Are they adequate for a multi-day vendor outage? Or do they cover only a fraction of your actual exposure?

How is social engineering covered? Is it under cyber, crime, or SEF? Are there voluntary parting exclusions? What are the sub-limits?

How do your cyber, crime, and PI policies interact? Do they work together to close coverage gaps, or do they create overlaps and exclusions?

Most organizations can’t answer these questions. They renew based on premium, not on whether the coverage aligns with their actual threat environment.

Continuum Helps Close The Gaps

Cyber policies need to evolve. The Insurance Information Institute’s latest cyber insurance market analysis shows the market is growing, but coverage gaps persist. Until policies evolve, organizations need to understand where their coverage falls short and what gaps exist between their actual cyber risk and their insured exposure.

Continuum reviews cyber, crime, and PI policies against the threat environment organizations actually face today. We identify where AI threats are under-covered, where supply chain risk is sub-limited, and where social engineering sits in a grey zone. We help organizations align their wordings to close those gaps before a loss occurs.

Before renewing cyber insurance, understand what your policies actually cover—and what they don’t. Contact Continuum to review your coverage against the current threat landscape.