The Other Half of the Incident Bill: Why Legal and Technical Response Must Move Together

Neither workstream can wait for the other. Faster containment limits the damage, and sound legal judgement limits the regulatory exposure and the consequences of future litigation. Our previous article asked whether businesses are better protected or just better insured. This one looks at the legal side of the bill, the part boards most often underestimate, and why packaging it into a warranty with the technical response changes how the first days of an incident plays out. 

Clocks that start immediately 

Legal deadlines need to be tracked and considered from as soon as an incident is discovered. Under UK and EU GDPR, the controller must notify the regulator without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put individuals at risk. A breach covers any compromise of confidentiality, integrity or availability of personal data, so ransomware that only locks data can still count. NIS2 requires in-scope EU entities to send an early warning within 24 hours of becoming aware of a significant incident. US public companies must file a Form 8-K within four business days of determining that an incident is material, and every US state has its own breach notification law, with its own triggers and deadlines. 

A business operating across multiple jurisdictions can face several of these clocks at once, each with different thresholds for what must be said. Getting the judgement wrong in either direction is costly: notify too little and the business invites closer regulatory scrutiny; notify too much, too early, and the business may have made admissions it later has to live with in litigation, alongside the risk of regulatory fines. 

Where the legal money goes

Legal costs in an incident come in two waves. The first wave is broadly universal: breach counsel advising alongside the technical response, guiding regulatory notifications, considering the risk of litigation, helping structure the forensic work and checking sanctions exposure before any ransom decision. The second wave is litigation and regulatory action, which is rarer but can dwarf everything else. 

NetDiligence's 2026 Cyber Claims Study, which covers 10,309 cyber insurance claims from incidents between 2021 and 2025, found large companies averaged $22.2 million in legal costs, with one settlement exceeding $500 million. For SMEs (defined as under $2bn revenue), which make up 97% of claims, legal costs were far smaller and less frequent. The first wave, though, has nothing to do with size: a small business needs legal advice in the first days as much as a multinational. 

Those figures describe insured claims. For a business without cover, every line of that bill lands on its own balance sheet.

Protecting the forensic report

How an investigation is set up in the first hours can decide whether its findings end up in a claimant's hands years later. A forensic report typically sets out exactly which weaknesses let the attacker in, which often makes it the most valuable document a claimant can obtain. Two protections can keep it our of reach: legal professional privilege and, in the US, the work product doctrine, which covers material prepared because litigation is expected. 

The best-known example is a 2020 US ruling involving a major bank. A federal court ordered the bank to hand its forensic report to class action plaintiffs, even though outside counsel had commissioned the work.. The court found the report would have been prepared in much the same form without the litigation, so it did not qualify as work product. The court also noted that the report had been shared widely with the board, dozens of staff, auditors and regulators.

The report can still be protected. It depends on the legal and technical engagements being structured together from the start, with a clear purpose, a scope kept separate from routine security work and clear limits on who sees the findings. That sequencing is hard to improvise mid-incident, and much easier when legal and technical response have been joined up before anything goes wrong.

Back to the gap

Our previous piece described the deductible or self-insured retention almost every cyber policy carries: the layer a business funds itself before the insurer engages. Legal fees arise early in an incident, so they fall squarely inside it. Legal advice is often needed before anyone has confirmed the incident is even a covered event.

For businesses with no cyber insurance at all, the position is starker. There is no panel, no breach coach and no reimbursement. The business has to find, vet and engage a specialist firm itself, under time pressure, while its systems may be down, and then pay for every hour.

What packaging it into a warranty changes

When legal costs sit inside a service warranty, the first-wave legal response is funded before the incident happens rather than argued over after it. Four things change.

• Speed. Legal advice is available alongside containment rather than after it, with a rapid claims process, coverage position or budget sign-off in the way.
• Choice. A good warranty does not force a law firm on the client. A business working with a law firm with relevant expertise should be able to keep it; one without should have a vetted panel of breach specialists to call on.
• Coordination. Because the technical responder and the warranty provider are the same party, legal and technical workstreams can run in step from the start, which is what privilege depends on.
• Certainty. Once a claim is validated, legal fees up to the cap are funded in advance, in the retention layer where they would otherwise be an unbudgeted cost.

For uninsured businesses, this may be the only legal backstop they have. For insured ones, it funds the layer that they would otherwise have to self-fund for the initial response, while the policy remains in place for litigation and regulatory costs above the cap. 

Being precise, again

A warranty that funds legal costs is not legal advice, and it is not liability insurance. It pays for counsel up to a cap; the advice itself comes from the law firm, which owes its duties to the client, not to the warranty provider.

Many cyber policies require insurer consent or panel counsel for costs to count towards the retention so that they can be reimbursed above it, so the warranty and the policy need to be set up to work together. And where one provider handles both monitoring and response, the way forensic work is engaged and reported should be agreed with counsel upfront, so the purpose of any report is clear.

Worth asking any provider:

1. Are legal costs funded directly, and up to what share of the cap?
2. Can we use our own firm, and is there a vetted panel if we don't have one?
3. How does counsel selection interact with our insurer's panel and consent requirements?
4. How is forensic work structured with counsel, so its findings stay protected? 

What this means for boards

Boards tend to picture an incident as a technical problem with a legal tail, or, after a bad experience, the reverse. In practice the two run side by side. Containment speed drives the operational cost, legal judgement drives the regulatory and litigation exposure, and both clocks start together.

Thomas Murray's CyberResponse+ service warranty funds legal costs directly. Clients can instruct their own firm or use one from Thomas Murray's trusted network, so legal advice runs alongside the technical response from the first hours. The cap also rises as the organisation reaches its security-maturity milestones. The question for the board then stops being who pays for which part of the response, and becomes whether the business can contain the incident and get the legal calls right at the same time.