An agency buys a cyber insurance policy but skips phishing training and routine patching. What is the sound risk-treatment critique?
Select an answer to reveal the explanation.
Short Explanation
Cyber insurance is a spare parachute, not a reason to stop packing the main chute. Transfer helps after a hit; training and patching still cut the chance you need that claim.
Full Explanation
Insurance is a transfer mechanism for financial consequences of cyber events. Foundational reduction controls — such as awareness training and timely patching — lower likelihood and often are required for coverage integrity. Purchasing a policy while neglecting those controls confuses complementary transfer with a substitute for reduction.