Using your report with your insurance broker, without overpromising

If your office carries cyber liability coverage, your broker may ask questions about how you handle sensitive data. It is tempting to hand over a polished report and let it speak for you. Before you do, it helps to be precise about what the report is, and what it is not.

This is general guidance, not insurance or legal advice. Your broker and your policy documents are the authority on what your insurer needs.

What the report is

A MyVaultMate report is a dated record. It shows what the agent found on the drives and folders you chose to scan, how serious the findings were ranked, and, over time, what changed between scans. It has five headline numbers (files scanned, files with exposed data, high-severity findings, devices affected, and an estimate of the ID numbers found), findings by type and by computer, the highest-risk files, and next steps.

That is useful as a factual record: on this date, this was found; on a later date, this had changed.

What the report is not

Say this plainly to yourself before any conversation:

• It is not an attestation. Nobody is vouching on your behalf that your office is secure.
• It is not a certification of any kind, and it does not mean you meet any standard or law.
• It does not lower what you pay for coverage, and nothing in it should be presented that way.
• It does not replace the controls insurers ask about, such as multi-factor authentication, backups, written policies, or an incident response plan. It also only covers what was scanned: files in the supported types, in the places you chose.

Overpromising is the real risk. An application is something you sign, and statements on it should be true. A scan report that shows few findings does not mean the office has no exposed data, because detection is rule-based, some file types are not read yet, and you choose what is scanned.

Start with the broker's questions

Rather than guess what is wanted, ask your broker what the application and renewal questionnaire ask about sensitive data. Then see which questions your report can honestly inform. For example:

• "Do you know where sensitive client data is stored?" A dated report can support a truthful answer to that.
• "Do you remove data you no longer need?" Your history of findings and what you removed can illustrate your process.
• Questions about encryption, access and authentication need answers from your IT provider or your own settings, not from a scan report.

Let the broker tell you whether the report is useful at all. Some will want it, some will want a short written answer, and that is their call.

Send the broker page, keep the rest

Every MyVaultMate report opens with a page made for your insurance broker, on every plan. It shows the three average risk scores, counts by kind of data, how many files could not be read, what changed since the last period, how many computers were covered and the controls the dashboard knows about, such as sign-in codes and disk encryption. It has no file names, folder paths, people's names or sample values, and it says “Safe to share with your insurance broker” at the top. The Insurance Summary adds the history behind those numbers.

The pages after it are marked internal. They are for fixing files: they list file paths and redacted samples, and file names can themselves reveal client names or case details. Keep those in the office, and send the broker page on its own. Neither is a compliance certification.

Keep your own records straight

Before any renewal, gather a few things in one place: your dated reports, a short note of what you removed or moved and why, and the names of the people who handle your IT and your backups. If your broker asks a question the report cannot answer, say so, and point to the person or document that can. Avoid rounding up. "We scan every hour" should be true on the day you write it, and if the schedule changes, change your answer too. If a report ever shows high-severity findings that are still open, it is better to say you are working through them than to leave them out of the conversation.

A sensible way to talk about it

Something like this stays on the right side of honest: "We scan our computers on a schedule for exposed client data, we keep dated reports, and we work through what turns up. I can describe the process; I would like to know what your application needs." That claims a practice, not a result.

You can see what a report looks like at /sample.