After an attack, the insurer wants to know cause, extent and date, and the insured needs to prove the same three things. Forensic examination answers with preserved evidence and, before the incident, shows whether the policy will work.
Lei nº 15.040/2024, the Brazilian private insurance statute, says that claims adjustment serves to identify the causes and effects of the reported event (art. 75). And it requires the adjuster to employ specialised experts whenever necessary (art. 80, III). In a ransomware attack, a data breach or an e-mail fraud, cause and effect are in the system records.
The examination answers how they got in, what they took, since when and whether they are still in the environment. It builds the timeline with chain of custody and separates what was the attacker's doing from the vendor's and from the company's own IT. Where there is a data breach, the immediate preservation actions come first, and the expert report also serves the ANPD.
A denial of coverage must be express and reasoned (Lei 15.040/2024, art. 86, § 6º), and the insurer must hand over the documents on which it is based (Lei 15.040/2024, art. 83). The expert report works on those grounds.
To take out the insurance, the company answers a questionnaire: does it have MFA, isolated backups, retained logs? The law requires that information to be given. Breaching that duty wilfully leads to loss of cover; negligently, to its reduction (Lei 15.040/2024, art. 44).
The forensic assessment checks, before the policy is taken out or renewed, whether each declared control exists and works. It is the preventive forensic audit described in Corporate Investigations and Compliance, applied to the policy. It also checks whether the environment retains the traces the examination will need: without logs, no one reconstructs the incident. It is not a compliance certification: it is the technical answer to the question "will the policy work?".
A company held life insurance for its partners, who were elderly. After one of them died, the remaining partners extended the cover. When another partner died, the insurer refused payment, alleging that the deceased's signature on the enrolment form was forged.
The forensic handwriting examination looked at the signature of the deceased partner and that of the remaining partner. In the handwriting of elderly persons, variation in the stroke is expected and does not, on its own, indicate forgery.
Both signatures were genuine. There was therefore no fraud in the contracting as alleged.
A company suffers a ransomware attack weeks after taking out cyber insurance. The insurer suspects that the intruder was already in the environment before the policy period and that the declared MFA did not exist.
The examination preserves servers and logs before restoration and reconstructs the timeline from the Microsoft Entra ID and VPN logs. The first access appears days before the encryption, already within the policy period: a phishing attack stole a manager's session and bypassed the active MFA.
The expert report gives the adjuster the start date, the entry vector and proof that the declared control existed.
A manufacturer is about to renew its cyber policy. Before the questionnaire, the legal department requests a forensic assessment.
The examination finds gaps: MFA missing on administrator accounts, backups in the same domain as the servers, access logs kept for only a few days and without the source port of the connections, service accounts with full privileges. In an incident, each inaccurate answer would be grounds to reduce or deny cover.
The company fixes the critical points and answers the questionnaire with what the examination measured.
See also
Information Security and Compliance → Corporate Investigations and Compliance → LGPD, ANPD and Data Breach Forensics → Cloud, Identity and DevOps Forensics → Forensic Handwriting and Questioned Document Examination → Audiovisual Forensics: Video and Image →