Glossary

What is a breach coach?

By Emily Yiu. Updated October 2026.

A breach coach is a lawyer who specializes in privacy and cybersecurity and leads the legal side of a cyber incident. Many cyber insurers give policyholders access to one through a panel and an incident hotline. The coach helps scope the incident, advises on notification duties and brings in forensic and other vendors. Some insurers call the role breach counsel.

What it means in practice

The term is used mainly in cyber insurance. One US insurer describes a breach coach as an attorney who specializes in data privacy and cyber security and has working relationships with forensic investigators, crisis communications firms and other vendors. A Canadian law firm’s description is close: lawyers experienced in privacy law and cybersecurity who act as the main point of contact after a breach.

The usual sequence is simple. You notify your insurer or broker through the incident hotline. The coach holds a triage or scoping call, often the same day, and then helps decide what needs doing. That typically includes hiring a forensic firm, deciding whether and when to notify regulators and affected people, and lining up notification, credit monitoring and public relations vendors. One insurer says its breach counsel is usually instructed by the insurer or broker after the insured reports the event.

The legal rules the coach applies differ by country. In Canada, that means the federal breach reporting duties under PIPEDA, including the real risk of significant harm test, plus provincial laws. In the US, it means state breach notification laws and sector rules. The coach advises on which apply to your facts.

Many policies include access to a breach coach. Whether the legal fees sit inside or outside the retention, and whether you must use the insurer’s panel, varies by insurer and policy. One law firm’s guide to cyber coverage warns that some policies pay only for pre-approved panel vendors and lawyers, and that costs outside the panel may be denied or only partly reimbursed. Read the wording.

Privilege is part of the appeal, but not a guarantee. Courts in both countries have looked hard at whether forensic reports prepared after a breach were really for legal advice or were ordinary business work, and at how widely they were shared. Some have ordered them disclosed.

Where it shows up in an incident

Whoever holds the policy, often the executive sponsor or privacy officer, makes the first call. Make it early, before engaging vendors or promising payment to anyone. The coach coordinates the legal and vendor side. Someone inside the organization still runs the technical and business response.

Common mistakes:

  • IT hires a forensic firm it already knows before anyone calls the insurer, and the work may not be covered or privileged.
  • The hotline number and policy number live only in email, which is down.
  • Forensic reports go to a wide internal distribution list.
  • Nobody knows whether the policy requires panel counsel.

The renewal readiness checklist covers keeping this information current.

In a tabletop exercise

Sample inject: “A ransom note appears at 6 a.m. Your IT manager has already called a managed security provider they know, and it has started imaging servers. Your policy says to call the insurer’s hotline before engaging vendors. Does anyone know the number? Who calls? What happens to the work already under way?”

Discussion question: “Who in the room can find the insurer hotline and the policy number without using company email?”

Sources

Want to see how your team would handle this for real? Here is how a facilitated tabletop works.