Draft: this page is held for legal review and is excluded from search indexing
CORK COVERAGE
Cork coverage comes standard with membership
Every SafeIT member is backed by warranty-backed cyber financial protection from Cork (corkinc.com). It is included with the service. There is no separate application, no separate premium, and no box to tick.
Cork coverage activates once your environment meets Cork's required security baseline, the standard stack of RMM, MFA, EDR, verified backups and the rest, which we confirm and put in place during onboarding rather than on the day you sign. Coverage is then monitored continuously: if something falls out of compliance, there is a short window to put it right before that coverage is paused.
The reason we lead with it: a cyber incident at a plant is not primarily an IT problem. It is a stopped line, a shipping window you miss, a batch record you cannot produce, and a customer asking questions. Restoring the systems is our job. The money that leaks out of the business while we do it has, until now, been entirely yours to absorb.
What a cyber warranty actually is
A warranty is a promise about a product. You already buy them: on a compressor, on a forklift, on a control panel. If the thing fails while it is being used properly, the party who stood behind it pays.
A cyber warranty works the same way, and the product being warranted is the security controls we run on your systems. Cork looks at the stack SafeIT deploys and maintains, the monitoring, the backups, the endpoint protection, the identity controls, and stands behind it financially. If those controls are in place and an incident gets through anyway, the warranty pays out toward the costs that follow.
That is a different animal from insurance, and the difference is worth understanding before you assume you already have this.
| Cyber insurance | Cork cyber warranty | |
|---|---|---|
| How you get it | Broker, application, underwriting, questionnaire | Included when you sign with SafeIT |
| What you fill in | A long application about your controls | Nothing. We already run the controls |
| What you pay | A separate annual premium | No separate premium |
| What it's tied to | Your declarations on the application | The controls we actually operate and monitor |
| When money moves | After a claim is assessed | Initial payout in under an hour |
| Typical range | Whatever you bought | $25K–$500K |
| Renewal risk | Premium rises or cover narrows after a claim | Tied to the service, not to a claims history |
| Does it replace the other? | No | No: see this does not replace cyber insurance |
The practical difference is the questionnaire. Cyber insurance asks you to declare your controls, and a mismatch between what you declared and what was actually running is where claims get argued. The warranty is attached to controls we deploy, monitor and can evidence, because we are the ones running them.
Coverage range and speed
Coverage in the $25,000 to $500,000 range, with the tier determined by the service package and the environment.
Initial payout in under an hour from a validated incident.
The sub-hour piece matters more than the headline number. In the first day of a real incident you are paying for people, not for a settlement: an outside responder, overtime, a freight change, a temporary line. Money that arrives in six weeks does not help you on Tuesday. Money that arrives before the first shift ends does.
What's covered, what's not
| Generally covered | Generally not covered |
|---|---|
| Incident response and forensic investigation costs | Physical damage to plant, machinery or product |
| Labour to restore systems, data and business software | Incidents that began before coverage started |
| Business interruption during the covered recovery window | Systems outside the SafeIT-managed scope |
| Costs of customer and regulatory notification | Losses arising from controls being removed or disabled against our advice |
| Legal and advisory costs tied to the incident | Fines, penalties and regulatory sanctions, where uninsurable by law |
| Recovery of data from backup where restoration is needed | Ordinary equipment failure, wear and tear, or power events |
The honest framing: treat this table as a plain-language map of the territory. The warranty document is the thing that decides what is paid. If the two ever disagree, the document wins and this page is wrong.
The first 24 hours
Read the diagram as the shape of the day, not a guarantee of the clock. Every incident is different and some of them are much worse than this.
Two things worth pulling out of it.
You make one call
The 24/7 emergency line. You do not chase a broker, find a policy number, or work out who to notify first. We run containment and we handle the Cork side. Your job that morning is deciding what the plant does about the shipping schedule, which is the only part of it nobody else can do for you.
The paperwork starts on day one, not day thirty
From the moment an incident is declared we are logging what happened and when. That record is what your insurer, your customers and your auditor will all eventually ask for, and it is far easier to write while it is happening than to reconstruct three weeks later from memory and Teams messages. Clients get it through the same portal they raise tickets in, which makes it usable as governance evidence.
This does not replace cyber insurance
Say it plainly: the Cork warranty is not insurance, and it is not a substitute for a cyber insurance policy. Keep your policy. If you don't have one, get one.
They do different jobs. The warranty is fast money tied to the controls we run, sized for the immediate cost of getting you back on the line. A cyber insurance policy is broader, third-party liability, larger loss limits, legal defence, contractual exposure, and it is underwritten against your whole business, not against one vendor's stack.
Where they help each other:
- The warranty covers the first hours while the claim process is still getting started.
- The evidence we produce, the incident log, the control documentation, the restoration timeline, is exactly what an insurer asks for, and having it ready tends to make the claim shorter.
- Insurers increasingly want to see the controls the warranty is attached to. Having them running and documented is useful at renewal, whatever else happens.
Enhanced coverage at Member of Both
If you are a SafeIT member and a member of one of the industry associations on our partner organizations list, you're at the Member of Both tier, and members at that tier get enhanced Cork coverage.
It comes alongside the rest of that tier: a priority SLA, meaning a faster response target, a free annual re-assessment, reserved event seats and the recognition badge. The full comparison is on Member benefits.
To be exact about the sequence: Cork coverage comes with membership. The warranty attaches to the controls we run, and running your controls is what membership is. There is nothing separate to apply for, no questionnaire, and no premium line on your invoice.
Questions people actually ask
"Is this insurance?" No. It is a warranty on the security controls we deploy and maintain, backed by Cork. It has no premium, no application and no underwriting, and it does not replace a cyber insurance policy.
"Do I have to do anything to activate it?" There is nothing to apply for separately: it comes with the service agreement, with no questionnaire and no separate line on your invoice. Coverage activates once your environment meets Cork's required security baseline, which we confirm and put in place as part of onboarding rather than on the day you sign. Once active, it stays in place as long as that baseline is maintained.
"What if I disable something you installed?" Then that system may fall outside the covered scope. This is the same logic as any warranty, it stands behind the product as it was supposed to be used. If a control has to come off for a production reason, tell us, and we'll document what changed and what it means.
"Does the coverage cover my whole plant, including the line-side systems?" It covers what's in the managed scope. Older line-side and legacy systems are often part of that scope but sometimes need specific handling: the free assessment is where that gets established, in writing, before anyone signs anything. See legacy & critical-system continuity.
"What happens to my coverage if we have an incident?" Unlike an insurance policy, the warranty is attached to the service rather than to a claims history.
What this means for your plant
What this means for your plant Cork coverage comes with membership. Warranty-backed cyber financial protection, no application and no premium. Money starts moving in the first hour, when you're paying for people, not a settlement. It sits alongside your cyber insurance policy. It does not replace it.
Book a free assessment → /membership/join/#assessment
Related
- The membership model, why we call our service a membership
- Member benefits: the full stack, including the Member of Both tier
- Become a member: the path, and the first conversation
- Book a free assessment
- Cyber resilience, the controls the warranty is attached to
- Business continuity & disaster recovery
- Legacy & critical-system continuity
- NIST readiness · Resource library
- Partner organizations · Roundtables