Policyholder Guidance for Critical PHP Vulnerabilities
Cyber Incident? Get Help

Coalition's in-house Incident Response services: With no out-of-pocket costs

Featured Image for Coalition's in-house Incident Response services: With no out-of-pocket costs

It’s 5 p.m. on a Friday, and you are ready to start your weekend when the call comes in:

“We just had a rough call with our largest customer. They had yet to pay our last invoice, which is highly unusual for them, so we called to follow up. They told us that they had paid using the updated wire instructions we sent them. We told them we didn’t send any new instructions. Then they sent us a copy of the email from our AP manager that did exactly that. IT says the email in question looks like it may have come from our system.”

You feel the knot forming in your gut as you wonder how you will get to the bottom of this, what other damage may have been done, and most importantly, who are you going to call?

No, it’s not Ghostbusters

If you are a Coalition policyholder, the answer to that last question is simple — it’s us. We are available around the clock, 24/7, to assist you. Our in-house Incident Response team members previously served in government (NSA, CIA, and FBI) and top incident response vendors. They have the experience and the tools to help you figure out what happened, stop the attack, identify the damage done, and recommend steps you can take to prevent similar attacks in the future.

Here is an example of our team in action, tackling a ransomware attack on the ground.

Faster response = better results

Our in-house team goes into action as soon as you tell us there might be a claim — much faster than most insurers. It’s no surprise that the sooner the incident response starts, the sooner you can get back to business as usual. It is also true that a quick response can dramatically reduce costs as well.

In 2020, 45% of events reported to Coalition were resolved at no cost to the insured as part of our pre-breach services. Coalition’s in-house Security and Claims teams have also recovered 84% of all funds lost by policyholders from fraudulent funds transfers. In several cases, the funds recovered were greater than the limit of insurance for funds transfer fraud coverage purchased by the policyholder.

On the same team — solving cyber risk

Coalition’s in-house security and forensics services team is unique. We have the same incentives that you do. We both want to mitigate a cyber event as quickly and efficiently as possible. We believe in these services so much that we are proud to announce a new endorsement we are adding to all of our surplus lines policies. The $0 SIR for Coalition Incident Response endorsement amends coverage to eliminate your Self Insured Retention (SIR) for the costs of services provided by our in-house incident response team. This is one more way we help our customers defeat the cyber credit crunch.

At Coalition, our mission is to solve cyber risk. We provide cyber risk services before, during, and after an incident with real-time threat scanning, security awareness training, and many other powerful security tools at no additional cost to our customers

Related blog posts

See all articles
Security

Blog

Security Alert: Critical PHP Vulnerabilities Put Most of the Web at Risk

Coalition is actively urging all businesses using PHP to patch two critical vulnerabilities in software widely used across the internet.
Joe ToomeyOctober 21, 2026
Security

Blog

Designing Security for the People Who Have to Live With It

Anyone who tells you security doesn't introduce friction is lying. Protection comes at a cost, and it’s usually paid in someone else's time and attention.
Chris ClarkOctober 20, 2026
Security

Blog

ConnectWise Investigating Unauthorized Access to Cloud Backup App

Coalition and Wirespeed have notified businesses that may be exposed to attempts of unauthorized access in ConnectWise Cloud Backup for Microsoft 365.
Jake ReynoldsOctober 16, 2026