Business Continuity and Crisis Exercise for an Insurer
A board-level crisis exercise that exposed and closed four single points of failure.
Client name withheld by agreement- Client
- Property and casualty insurer
- Region
- United States
- Year
- 2024
- Duration
- 10 weeks
- Scope
- 27 critical processes · executive tabletop
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A property and casualty insurer had business continuity plans written for floods and fires. None of them assumed a cyberattack that takes out systems and people at the same time.
The board asked a direct question after a peer’s outage: if it happened here, who decides what, and how fast?
What we did
The approach, step by step.
- 01
Critical processes ranked
Twenty-seven processes analyzed for impact over time, from claims intake to policy issuance and payments.
- 02
Dependencies exposed
Systems, suppliers and key people mapped behind every critical process.
- 03
Executive tabletop
A realistic, escalating cyber scenario run with the executive team and board observers.
- 04
Plans rebuilt
Decision rights, communication trees and workarounds rewritten for the scenario that actually threatens the business.
Outcomes
What changed, in numbers.
- 27
- critical processes analyzed
- 4
- single points of failure closed
- 1
- board-level crisis exercise completed
- 100%
- of critical processes with tested workarounds
The exercise was uncomfortable in exactly the right way, and we are far better for it.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
United States · 8 weeks
Offensive Security & Resilience · 2025Pre-Peak Penetration Testing for a National RetailerTwo critical payment-page exposures found and fixed six weeks before holiday trading.
-
Gulf Coast, U.S. · 20 weeks
Offensive Security & Resilience · 2024OT-Safe Ransomware Resilience for an Energy UtilityRecovery time for core systems proven at under 18 hours, without touching live operations.
-
Dallas, Texas · 24 weeks
Offensive Security & Resilience · 2025 · OngoingOne Evidence Model for a Fintech LenderFour frameworks mapped to one control set, with audit evidence requests down by two thirds.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.