Cybersecurity expertise.
For insurance.

A profession, a responsibility.

Working as a cybersecurity expert calls for technical competence, practical experience and an investigative method. It also entails professional responsibility: examine facts carefully, explain the reasoning and produce substantiated, understandable and verifiable conclusions.

This work for insurance is carried out within the scope of an agreed assignment. It is distinct from a judicial expert assessment commissioned by a judge through appointment by a court in France. Its own framework carries demanding standards of rigour and professional ethics.

A commitment to establishing the truth.

Our approach seeks to establish the truth: determine what the available evidence supports, examine competing hypotheses and identify what remains uncertain.

Conclusions follow the facts, including when those facts require the initial hypothesis to be revised.

• Objectivity and impartiality

  Exercise independent judgement and identify conflicts of interest.

• Rigour and traceability

  Document sources, investigative steps and the reasoning connecting findings to conclusions.

• Confidentiality

  Protect the information and data entrusted to the expert during the assignment.

• Competence and sound judgement

  Respect the scope of the assignment, acknowledge limitations and bring in additional expertise when needed.

Findings, hypotheses and conclusions are distinguished in the report. Observations from relevant participants are examined within the framework of the assignment.

Establish evidence of the attack and explain its mechanisms.

A reported attack calls for investigation. Logs, network traces, files, configurations, backups and other digital artefacts can help establish whether it occurred. Their origin, integrity and collection conditions need to be documented so their significance can be assessed.

1. Examine
2. Reconstruct
3. Document

The analysis seeks to reconstruct the timeline, access paths, actions taken and affected systems. It examines mechanisms that could explain the findings alongside other possible causes, such as equipment failure, human error or misconfiguration.

The availability and quality of evidence determine what can be established. Each conclusion identifies its supporting evidence and the limits of the analysis.

Connect the mechanisms to the damage. Or rule out that link.

The occurrence of an attack and the existence of damage do not, on their own, establish cause and effect. The expert examines the technical sequence that could connect observed events to business interruption, data loss, system alteration or other reported damage.

Assessing causation involves comparing the timeline, identified mechanisms, extent of the effects and alternative explanations. This helps distinguish consequences attributable to the attack from those associated with other events or pre-existing failures.

Technical expertise within the IXI-Plus network.

Stelau contributes its cybersecurity skills to IXI-Plus network assignments for the insurance sector. Work may cover risk prevention, investigation of the causes of a loss, analysis of its consequences and appropriate recovery or preventive measures.

Technical findings are considered alongside other expertise needed for the assignment, including financial, industrial and crisis management skills. The report sets out the scope, material examined, findings, causal reasoning, limitations and recommendations. It informs decisions by participants in the insurance sector.

From technical findings to a reasoned submission.

In the separate framework of a French judicial expert assessment, a party may send written observations to the appointed expert, commonly called a “dire”. Technical analysis can support those observations by citing exhibits, specifying facts, examining hypotheses and setting out points requiring a response.

The submission sets out a party’s observations; it is distinct from the judicial expert’s report. The simulation below illustrates this process using a fictional case.

Passing on professional practice.

Becoming an expert for insurance requires cybersecurity skills to be complemented by training in investigation, causal analysis, report writing and professional ethics. The experience of Stelau’s experts provides a foundation for passing on this practice to consulting engineers and supporting their development.

This development combines learning, case analysis and work alongside experienced practitioners. It builds the ability to justify a conclusion, test it against the facts and recognise what cannot be demonstrated.