The fight is over fault.
Not access.
Forensics tells you how an attacker got in. All Lines establishes what happened and in what order, whose control failed, which policy responds, and what the loss actually is — the investigatory record a cyber file is decided on, and the one part of the file nobody builds.
Licensed all-lines adjusters · 35+ years · 5,000+ claims · Licensed in 12 states
Four questions decide every cyber claim
Incident response answers none of them. The carrier's desk adjuster rarely has the capacity. On claims under a quarter million dollars — the overwhelming majority of a cyber book — they are frequently never asked at all.
What happened, in what order?
A forensic report gives findings. A claim file needs a chronology that survives cross-examination — who clicked, what alert fired, when the wire left, what was contained and when. We build the timeline from the forensic report, mail headers, authentication logs, and statements.
Whose control failed?
The insured’s own gap, an employee, an MSP, a SaaS vendor, a bank, or the attacker alone. Fault allocation decides whether the file is paid, denied, or worth pursuing — and it is the part of the file almost nobody writes down.
Which policy responds?
Cyber, crime and fidelity with a social-engineering endorsement, technology E&O, or D&O. Business email compromise claims land on the wrong policy constantly, and the wrong policy means the wrong limit, sublimit, and retention.
Are the dollars real?
Business interruption and extra expense are the most inflated components of every ransomware claim. We rebuild the pre-loss baseline and test every claimed dollar against it.
The first question is evidentiary
A cyber loss is only provable if the record of it still exists. What telemetry was collected, and how long it was kept, decides whether causation can be established at all. Most claim files open by asking for the incident report and an interview. That is the wrong order.
What telemetry exists?
Identity and authentication logs, endpoint detection, cloud control-plane audit trails, email gateway, VPN, SaaS audit logs, backup job history. Named by system and by user population — not "do you have security tools."
How long is it retained?
A retention window is a causation deadline. If identity logs roll off at thirty days and the intrusion ran for sixty, the record of the initial access is already gone when the claim is reported.
When did they know, and how?
The detection timeline drives the business-interruption period, and it answers whether the loss was discovered and contained with reasonable speed — a question carriers ask and insureds usually answer from memory.
The clock starts before the analysis
Once a loss is reasonably anticipated, letting logs expire can destroy evidence the carrier and any later litigation will need. Retention schedules do not pause because a claim was opened. Our first act on a cyber file is a written preservation demand — suspend log rotation and backup overwrite on the systems in scope — issued the day the file opens, before the first interview.
Telemetry Sufficiency Assessment
A short, fixed-fee engagement that runs before the causation work: what existed, what survived, what is missing, and what that means for proving cause. Three to five pages — a systems-and-retention table, the gap list, and a plain statement of which elements of the claim can be evidenced and which cannot. On files where the record is largely gone, it saves the cost of an investigation that could not have reached a conclusion.
What we deliver
Fixed-scope engagements, priced per file, with a defined deliverable — not an open-ended consulting relationship.
Claim Verification & Causation Report
The core deliverable: reconstructed timeline, control-failure findings by party, written allocation of fault, outstanding questions, and an exhibit set. Written to be handed to a carrier committee, a reinsurer, or a court without rewriting.
Recorded & Written Statements
From the people who touched the loss — chief financial officer, controller, accounts payable, IT administrator, and the vendor account contact. Taken by licensed adjusters with jurisdiction-compliant documentation, the same way we take statements on any other claim.
Coverage-Trigger Analysis
Which policy, which limit, which sublimit, which retention, and where the loss actually belongs across a multi-line tower. The analysis that keeps a claim from being paid out of the wrong pocket.
Business Interruption & Extra Expense Verification
Pre-loss baseline rebuilt from financials, then every claimed dollar tested: lost profit, payroll continuity, overtime, replacement cost, forensic and notification invoices, waiting-period and sublimit math.
Recovery & Subrogation Package
Where a vendor, MSP, integrator, or financial institution contributed to the loss: the causation record, contractual indemnity review, and a recovery package prepared for pursuit rather than assembled after the fact.
Claim Liaison Through Incident Response
One named adjuster on the file from first notice to closure — coordinating the insured, the incident response team, and the forensic vendor, and confirming at every stage that the response sits inside the policy. Nothing spent that will not be paid; nothing missed that should have been pursued.
What we do not do
Cyber claims attract vendors who claim to do everything. We work one seam of the file and say where the edges are. If a file needs forensics before an investigation is worth starting, we will tell you that instead of selling you a report.
We work from the forensic report you already have. We do not compete with your incident response panel — we test its work and build the claim record around it.
- Perform digital forensics, incident response, or malware analysis
- Provide legal advice or breach-notification decisions
- Take custody of personally identifiable information
- Write a report that concludes what the retaining party wants it to conclude
How a file moves
Scope
File received, privilege and data-handling confirmed, deliverable and fee fixed before work begins. No hourly scope drift.
Record
Documents, forensic report, logs, contracts, and statements assembled into one exhibit-indexed record.
Analyze
Timeline reconstructed, control failures assigned to parties, coverage trigger mapped, damages tested against baseline.
Report
Written findings with the allocation, the open questions, and what they are worth. Depositions and testimony available if the file goes adversarial.
Claim types
- Business email compromise
- Vendor & social-engineering fraud
- Misdirected wire
- Ransomware
- MSP / SaaS vendor failure
- Cloud misconfiguration
- Technology E&O
- Crime & fidelity overlap
- Business interruption & extra expense
Who retains us
This is built for the insurer's side of the file — investigation a carrier retains directly, not advocacy for the insured. Cyber writers and MGAs carrying a book without field investigative capacity. TPAs with delegated cyber authority. Captive managers and programs whose retention layer carries the loss. Brokers and coverage counsel who need a report with a licensed adjuster behind it.
Engagements are scoped per file. Single desk review, full causation report, or investigation — a fixed fee quoted before work starts.
Cyber claims — common questions
- What is a cyber claims investigation?
- It is claim investigation applied to a cyber loss: establishing a defensible chronology, taking statements from the people involved, determining which party’s control failure caused the loss, identifying which policy responds, and verifying that the claimed dollars are real. It is performed by licensed adjusters, not by the forensic firm that handled the incident response.
- How is this different from what our forensic firm already delivers?
- A forensic firm answers how an attacker got in and whether the incident is contained. Its report is written for incident response and, frequently, for privilege. It does not allocate fault between the insured, an employee, a vendor, and a bank; it does not test the business-interruption claim; and it does not map the loss to a policy limit or sublimit. Those are claim questions, and they are the ones that decide the file.
- Does ALCC perform the forensics or the incident response?
- No. ALCC works from the forensic report you already have, or tells you plainly that one is needed before an investigation is worth starting. We are deliberately not a forensic firm and not an incident-response vendor — we are the party that tests their work and builds the claim record around it.
- Which cyber claim types does ALCC take?
- Business email compromise and social-engineering fraud, misdirected wire and payment-instruction fraud, ransomware, MSP and SaaS vendor failure, cloud misconfiguration, technology errors and omissions, claims that implicate both a crime/fidelity policy and a cyber policy, and the business-interruption and extra-expense components of any of the above.
- How fast can ALCC turn a file around?
- On a complete file, a coverage-trigger and open-questions memorandum within 48 hours. A full causation and allocation report typically within five business days, and faster where a claim deadline or a recovery window requires it. Urgent files are scoped at intake, not after the fact.
- Are ALCC’s adjusters licensed to work cyber claims?
- All Lines Claim Consultants’ principal is a licensed all-lines adjuster, licensed in 12 states, with 35 years and more than 5,000 claims behind her. ALCC works at the direction of the carrier, program, captive manager, broker, or counsel that retains us, and engagements are scoped per file at a fixed fee.
Send us a file and see what comes back
One claim, one fixed fee, one written report. Talk directly with Renee Bryant about the file you have open right now.
All Lines Claim Consultants · 6600 Taylor Road, Suite 103, Punta Gorda, FL 33950