Two Guys and a Data Breach

What should tax professionals, accountants, and business owners understand about cybersecurity and cyber insurance before a data breach occurs? In this special edition of Data Security over Coffee, Joe Harford of Reclamere is joined by Steve Ferguson, Director of Growth Strategies & Insurance at Protection Plus, for a candid conversation about cyber risk, insurance coverage, AI, incident response, and the practical steps organizations can take before an incident puts the business under pressure. Steve brings decades of experience in specialty insurance and has spent the past several years helping tax and accounting firms address cyber insurance and data breach response. Together, Joe and Steve examine cybersecurity from both sides of the equation: reducing risk before an incident and understanding what happens when insurance and response services are needed afterward. In this episode, they discuss: • A real-world tax firm data breach and the business consequences of delaying response • Why tax and accounting firms need a Written Information Security Plan (WISP) • Why a WISP should be reviewed, updated, and tested regularly • The importance of understanding exactly what your cyber insurance policy covers • Why organizations should not assume emerging AI-related risks are automatically covered • How employee security awareness training can reduce preventable cyber incidents • Why vulnerability scanning, penetration testing, and risk assessments matter before a breach • The role of incident response plans and tabletop exercises • Why cyber readiness requires ongoing attention rather than an annual compliance exercise • How cybersecurity and cyber insurance work together to strengthen business resilience Steve also shares practical guidance for business owners reviewing cyber insurance. An insurance policy is a contract, and leaders should understand what is actually included rather than relying on assumptions about coverage. The conversation also addresses the human side of cybersecurity. According to Steve, a significant portion of the cyber claims Protection Plus sees involve employee mistakes, reinforcing why ongoing security awareness training should be part of an organization’s regular operating rhythm. For tax professionals and accounting firms, the stakes are particularly high. Sensitive taxpayer information, financial records, identity data, and access credentials make preparedness, documentation, employee training, and response planning essential parts of protecting both clients and the business. Whether you work in tax, accounting, financial services, professional services, or another data-intensive industry, this episode offers practical guidance for aligning cybersecurity, cyber insurance, and organizational readiness. Learn more about Reclamere: https://reclamere.com/ #Cybersecurity #CyberInsurance #TaxProfessionals #Accounting #DataBreach #WISP #IncidentResponse #AIRisk #CyberResilience #RiskManagement #SecurityAwareness #DataSecurityOverCoffee