The conventional wisdom
When privacy officers brief their boards on data breach risk, the conversation often ends with a nod to cyber insurance. The logic is simple: we've bought coverage, transferred the risk, and can focus on operations. Conduent's October 2026 settlement filing to the SEC made this explicit: "The Company maintains cyber insurance and does not expect this settlement to have a material impact on its financial position."
After an incident that exposed 62 million individuals' protected health information and resulted in an $80 million settlement, the company walked away financially whole. The insurance worked. Case closed.
Why this view is incomplete
This perspective treats cyber insurance as a substitute for security controls rather than a backstop. It's risky because it shifts your team's focus from preventing breaches to managing their financial aftermath.
Consider what Conduent's insurance policy didn't cover: three months of undetected unauthorized access, the chaos of notifying 62 million individuals, and the permanent loss of customer trust. The regulatory scrutiny that follows when a breach affects protected health information at scale is also unavoidable.
Your insurance premium buys you claims handling and legal defense. It doesn't buy back the three months between October 2024 and January 2025 when the SafePay ransomware gang had access to 8.5TB of your data without your knowledge.
The evidence
The settlement agreement required Conduent to "strengthen its data security practices" to resolve civil liability. This language appears when existing security measures are insufficient. You don't mandate improvements to adequate controls.
The breach itself reveals specific control failures. Unauthorized actors accessed data containing names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information. Under HIPAA's Security Rule (45 CFR § 164.312), covered entities and their business associates must implement technical safeguards, including access controls, audit controls, and transmission security. The three-month detection gap suggests monitoring controls failed at multiple layers.
The settlement structure is equally telling. It divides claimants into two subclasses: 40 million individuals whose data was stored in complex backup files "not readily accessible to third-party actors," and 22 million whose data was in readily accessible files. This distinction matters for breach notification under 45 CFR § 164.404, which requires assessing the probability that protected health information has been compromised. It also reveals that Conduent stored sensitive data in formats with varying access restrictions, suggesting inconsistent application of Technical and Organisational Measures across the environment.
What to do instead
Start with detection time as your primary metric. Conduent discovered the breach almost three months after the initial access. Your incident response plan should include automated alerts for unusual data access patterns, failed authentication attempts, and unexpected data movement. If you're a HIPAA business associate, 45 CFR § 164.308(a)(1)(ii)(D) requires you to regularly review records of information system activity.
Second, classify your data by accessibility and apply controls accordingly. The settlement's two-tier structure shows that Conduent knew which data was more exposed. That knowledge should have driven stronger access restrictions before the breach, not just settlement calculations after. Implement column-level security for sensitive fields in production databases and require break-glass access procedures for backup restoration.
Third, test your breach notification timeline. Conduent supports approximately 100 million US residents across government health programs. Notifying 62 million affected individuals isn't just a communications exercise; it's a compliance obligation under 45 CFR § 164.404(b), which requires notification without unreasonable delay and no later than 60 days after discovery. If your notification process depends on manual file analysis to determine what data was exposed, you'll miss that window.
Finally, review your cyber insurance policy for exclusions related to delayed detection or inadequate security controls. Insurers increasingly include clauses that reduce coverage when breaches result from failure to implement industry-standard safeguards. Your policy worked for Conduent this time. Read the fine print to confirm it would work for you.
When the conventional wisdom is right
Cyber insurance is essential risk management for organizations handling protected health information at scale. The Conduent settlement demonstrates its value: $80 million in liability resolved without material impact on operations or cash flow. For a company providing back-office support services to government health programs, that continuity matters.
Insurance also provides access to breach response expertise you can't maintain in-house. The settlement covered credit monitoring and medical data monitoring services for all claimants, plus plaintiff legal fees. Coordinating those services across 62 million individuals requires vendor relationships and claims handling infrastructure that only insurers can provide efficiently.
The conventional wisdom is right when it treats insurance as part of a defense-in-depth strategy. It's wrong when it treats insurance as a replacement for that strategy. Conduent's SEC filing emphasized that the settlement isn't an admission of fault or liability. But the court-mandated security improvements tell a different story: the controls weren't sufficient, and insurance covered the financial consequences but couldn't prevent the operational and reputational damage.
Your breach register should track detection time, notification compliance, and root cause analysis for every incident. If those metrics don't improve year over year, your insurance premiums will. And eventually, your insurer will decide the risk isn't worth underwriting at any price.
