What We Covered at the AMCHAM Tech Hub Islands Summit 2026, and Why It Matters for Your Business.
Published by PRFC Limited, June 2026
It was a privilege to join Marlon Cooper, Samantha Deoraj, Obika Gellineau and our moderator Melissa Pierre on the Cyber Resilience & Risk Transfer panel at this year's AMCHAM Trinidad & Tobago's Tech Hub Islands Summit 2026, one of the Caribbean's most important forums for technology and business leadership. The cyber security discussion was lively, the audience engaged, and the questions, particularly around ransomware, made clear that this topic is no longer abstract for businesses in our region. It is immediate, it is local, and it is escalating.
Our contribution to the panel focused on something that often gets overlooked in the broader cyber security conversation: the role of cyber insurance, not just as a financial safety net, but as an active tool for building organisational resilience. We wanted to demystify it, and to challenge a few assumptions that are quietly putting Caribbean businesses at risk.
What We Discussed:
What a Cyber Policy Actually Covers
Many business owners are surprised to learn just how broad a well-structured cyber policy is. Beyond the obvious of covering the cost of a breach, a good policy responds to business interruption losses, data restoration, regulatory notification costs, crisis PR, and third-party claims from individuals or entities affected by a breach originating on your systems. There are also meaningful extensions available for social engineering fraud, cloud and vendor outages, emerging AI exposures and reputational harm.
The point we pressed: a cyber policy doesn't just pay for the breach - it provides a pre-incident analysis of your exposures, and when properly structured, pays for everything that happens during AND after the breach, which is usually where the real damage lives.
The Onboarding Process, and Why It's More Valuable Than You Might Think
Getting a cyber policy isn't simply a matter of filling in a form and paying a premium. The application process (covering your network architecture, backup strategy, multi-factor authentication, employee training, and incident history) is itself a structured security review. For many businesses, it is the first time anyone has asked these questions in a systematic way.
Underwriters draw on live claims data across thousands of businesses globally. When they flag a gap in your controls, they are telling you something that is actively causing losses right now, not recycling generic best practice. That is free, current, threat-informed advice, and most policyholders don't recognise it as such.
The 24/7 Emergency Response Resource
Perhaps the most under-appreciated feature of a modern cyber policy is the incident response panel included within it: pre-vetted forensic IT firms, specialist breach lawyers, and crisis communications experts, available around the clock via a single contact number and at no additional cost to the policyholder.
In a live incident, the first hours are the most consequential. Having expert guidance immediately available on what to preserve, what not to touch, who to notify and in what order, materially changes the outcome. This is a SWAT team on retainer, built into your premium.
How Cyber Interacts with Your Commercial Crime and D&O Policies
Traditional commercial crime policies were designed for a world of physical theft and employee dishonesty. They were not designed for business email compromise, funds-transfer fraud, or social engineering, which is how the overwhelming majority of financial losses from cyber incidents actually occur today. A cyber policy fills these gaps in ways that a crime policy simply cannot.
Directors and Officers face a parallel and growing exposure: personal liability for inadequate cyber governance. A significant breach doesn't just affect the business: it can attract regulatory scrutiny and derivative actions directed at the board itself. These three policy types need to be reviewed together, not purchased in silos.
The Ransom Question
This is always a key part of a cyber discussion, and rightly so. Here is a concise summary of what you need to know:
- It is not explicitly illegal in T&T to pay a ransom, but "not illegal" and "safe" are very different things. The risk lies in what surrounds the payment, not the act itself.
- T&T's Anti-Terrorism Act and AML/CFT regulations criminalise providing funds to designated entities, knowingly or recklessly. Many major ransomware groups are formally sanctioned under US, UK, and Australian law. Paying them in cryptocurrency may constitute terrorism financing under T&T law, regardless of intent.
- US OFAC sanctions apply extraterritorially and carry strict liability. If your payment touches a US correspondent bank or clears through New York, which describes most businesses in this region, you carry a real sanctions exposure, even without knowing you paid a sanctioned entity.
- Payment does not extinguish your regulatory obligations. Every breach notification duty that arose at the moment of the attack remains fully in force after you pay. And since modern ransomware almost universally involves data exfiltration before encryption, paying for a decryption key does nothing to retrieve the stolen copy.
- T&T's Data Protection Act 2011 has never been fully proclaimed into force. The full private sector obligations, breach notification, data handling rules, penalty provisions are pending a Presidential Proclamation that requires no further parliamentary process and can happen at any moment. Businesses without a compliance plan are already behind.
- Where your data is stored matters. Cloud infrastructure in the EU, UK, or US can expose a T&T business to GDPR, UK GDPR, and US state data laws simultaneously, regardless of where the company is incorporated. A single breach can trigger multiple notification regimes at once, each with different deadlines.
- The practical case against paying a ransom is compelling. 84% of those who paid in Q4 2024 failed to fully recover all their data. 80% were attacked again within 12 months. Three quarters of victims now refuse to pay, and those with the right protocols and resources recover anyway.
Download our free "Concise Introduction to Cyber"
We have produced a concise introductory reference document covering all of the above, designed to be read in a few minutes and kept for reference. It is free, requires no registration, and is available for download below.
→ Click to Download our free PDF: Cyber Insurance — A concise introduction
More detailed whitepapers on this and other importat topics are available on request.
