The unhedgeable board: Personal liability in an age of uninsurable risk
The architecture of modern board service was built on one foundational assumption — that risk could be layered, priced, and ultimately transferred. That assumption is breaking down. Most directors haven't internalized it yet.
Alex Kruzel
December 2025
Telesto Insight
There is a conversation I find myself having with increasing regularity with board members across industries, geographies, and ownership structures. It goes something like this: they have reviewed their D&O policy, confirmed their indemnification agreement, maybe even checked their cyber insurance. They believe they are protected. Then I start asking questions — and the confidence begins to erode.
The question is never whether the policy exists. The question is whether it covers what you actually think it covers — and whether the risk environment you're operating in today was remotely anticipated when those protections were written. In most cases, the answer to both is no.
We have arrived at a remarkable and underappreciated inflection point in corporate governance. The traditional instruments of risk transfer — insurance, hedging vehicles, contractual indemnification — are facing structural limits precisely when the underlying risks are becoming structurally larger. This is not a temporary softening in one market. It is a multi-vector contraction of private sector risk tolerance, happening simultaneously across cyber, physical property, and geopolitical exposure. And it is landing squarely on the personal balance sheets of individual directors.
I — The myth of risk transfer at the board level
For the better part of three decades, the governance framework for senior corporate leaders has been built around a deceptively elegant idea: that personal liability risk is manageable through layered insurance programs. Directors & Officers coverage, supplemented by indemnification agreements, cyber policies, and political risk insurance, was supposed to create a protective architecture that converted existential personal exposure into manageable, priced, and transferred risk.
The architecture is cracking — and the cracks are not evenly distributed. They are deepest exactly where company risk is greatest: in technology-intensive operations, in globally distributed businesses operating in politically volatile environments, and in asset-heavy enterprises with significant coastal or high-weather-risk real estate.
The most consequential problem I encounter is not that directors lack protection. It is that they believe they have more protection than they actually do. The gap between perceived coverage and actual coverage is not a minor technical matter. It is the difference between a board member who walks into a meeting understanding their personal exposure and one who discovers it in discovery.
"The question is never whether the policy exists. The question is whether it covers what you actually think it covers — and whether the risk environment you're operating in today was remotely anticipated when those protections were written."
II — Three converging failures of risk transfer
What is unusual about this moment — and what makes it genuinely different from prior cycles of insurance market hardening — is that the contraction is happening across three structurally distinct risk categories simultaneously. Each would be concerning on its own. Together, they are rewriting the baseline assumptions of corporate risk management in ways that most boards have not yet confronted.
Cyber insurance's exclusion proliferation. The cyber insurance market is nominally soft. Premiums have declined modestly. But the coverage landscape tells a different story. Insurers are systematically narrowing what they will cover through exclusion clauses that have become broader and more consequential with each renewal cycle. State-sponsored cyberattacks — now among the most common vectors against corporate infrastructure — are explicitly excluded from most policies, with "war exclusion" language interpreted broadly enough to capture any event with a plausible nation-state connection. The 2024 CrowdStrike outage, which affected over 8.5 million Microsoft systems globally, illustrated the "systemic risk" category that insurers are now racing to exclude.
The more insidious problem is the gap between D&O and cyber coverage. Many D&O policies contain broad cyber exclusion clauses. Many cyber policies contain securities exclusions. The result is a zone of unallocated risk: decisions made by boards during or in response to a cybersecurity incident may be covered by neither. I regularly sit with boards that have purchased both products and believe the combination provides comprehensive protection. The fine print tells a different story.
Physical property and climate-driven uninsurability. This is no longer a future projection. It is present-tense commercial reality. In 2024, globally insured weather-related losses reached $137 billion — 40% above the ten-year average. The California FAIR Plan — the state's insurer of last resort — now covers over 610,000 policies, up from 140,000 in 2018. State Farm and Allstate have withdrawn from California's high-risk markets entirely. Major carriers have followed in Florida, Louisiana, and parts of the Gulf Coast. What is emerging is a new asset category: properties that are not merely expensive to insure, but commercially uninsurable in the private market.
Political risk and geopolitical exposure. The Strait of Hormuz is the most vivid current example of a broader phenomenon I have been tracking for several years. Following escalations involving the US, Israel, and Iran, major maritime insurers suspended or catastrophically repriced war-risk coverage for ships transiting the Persian Gulf. The Lloyd's Market Association designated the entire Persian Gulf a high-risk area, triggering mandatory additional premiums and policy cancellations. The Trump administration was compelled to direct the US Development Finance Corporation to establish a $40 billion reinsurance facility to backstop what private markets would not cover.
The lesson for corporate boards extends well beyond shipping. When geopolitical risk escalates to the level of active conflict, the private insurance market does not simply become expensive — it exits. Companies with supply chains, manufacturing operations, or commercial interests in geopolitically volatile regions are running on the implicit assumption that government backstops will materialize if private markets fail. That assumption has no contractual basis and should not be treated as a governance tool.
The protection gap: Where insurance fails corporate directors
Click any row to see the specific coverage failure mechanism. Data reflects 2025 market conditions.
Sources: Swiss Re, Munich Re, NAIC, Lloyd's · 2025
III — Which boards face the most acute exposure
One of the most useful frameworks I have developed working across PE-backed portfolio companies and public corporation boards is a simple risk multiplier: the more a business exhibits certain structural characteristics, the more exposed its directors are to the specific failure modes described above. The four multipliers are: global operational footprint, capital intensity, workforce scale, and technology dependency. A company that scores high on all four is operating in territory where traditional risk transfer tools are simultaneously failing.
Click any sector below to explore specific liability vectors.
Telesto synthesis · Swiss Re · Munich Re · NAIC · SEC filings · 2025
Director liability across the PE investment lifecycle
Click any stage to examine specific personal liability questions for PE-appointed and independent directors.
IV — The questions I cannot stop asking
Part of what makes this moment so interesting — and so difficult — is that the most consequential questions are genuinely unresolved. The governance literature has not caught up with the insurance market's structural shift. These are the questions I keep returning to in my work — and that I believe every board member with significant global, technology, or asset exposure should be asking right now.
What keeps me thinking — and what should keep every board member thinking.
At what point does a board's failure to explicitly address insurance coverage gaps — rather than simply assume coverage — constitute a breach of its oversight duty? The SEC has begun treating cybersecurity as a disclosure obligation. Is uninsurability next?
When the government becomes the insurer of last resort — as happened with the DFC and Strait of Hormuz coverage — does that implicitly change the standard of care expected of boards that relied on the prior private market?
For privately held companies, where disclosure obligations are lower and governance practices more variable, is the personal liability risk for directors actually higher than for their public company counterparts?
As climate-driven uninsurability spreads, will fiduciary duty claims against boards that approved real estate acquisitions in high-risk zones become as common as the post-financial-crisis wave of risk oversight litigation?
The D&O market is nominally soft. But if the coverage is soft while the risk is hardening — more exclusions, broader carve-outs — does lower premium actually reflect greater personal risk, not less? Are directors reading the signal backwards?
As AI-driven decisions made by algorithms the board approved but cannot fully explain become the subject of securities litigation, what does "informed oversight" actually mean? Can a board credibly claim it exercised oversight of a system it did not understand?
V — Governing what cannot be transferred
I do not pretend to have resolved these questions. But I can offer a framework for how I would want my clients — and any board I advise — to approach them. The principles are straightforward, even if the execution is not.
First, stop assuming coverage. Commission an independent, line-by-line analysis of your D&O, cyber, property, and political risk insurance against the specific exclusions and coverage gaps described in this analysis. Do not rely on certificates or broker summaries. Read the policies. Stress-test them against realistic scenarios.
Second, separate personal protection from entity protection. Directors — particularly those serving on boards of leveraged, PE-backed, or financially stressed companies — should ensure that Side A D&O coverage, personal indemnification, and advancement provisions are in place, reviewed, and adequate. The protections that matter most are those that survive when the company cannot or will not indemnify.
Third, document governance deliberately. Board minutes, committee reports, and resolution records are the primary evidentiary record in D&O litigation. They are also the primary basis for insurer coverage determinations. If your board considered a cyber risk, a climate exposure, or an AI governance question — document that it was discussed, what information was reviewed, and what decisions were made. The absence of documentation creates a presumption of absence of oversight.
"The companies that navigate this landscape well will not be those that spend the most on insurance. They will be those whose boards govern with enough sophistication to understand what insurance actually covers — and enough integrity to act on what it doesn't."
We are entering an era in which the personal liability exposure of corporate directors is genuinely structural — not cyclical, not temporary, not manageable through the traditional toolkit alone. The risks are real, they are growing, and they are landing on individual balance sheets in ways that the governance architecture of the prior era was not designed to handle.
The question for every director is no longer "am I covered?" It is: "do I understand what I am not covered for — and am I governing accordingly?"
That is the conversation I am most interested in having.
CEO & Founder, Telesto. Alex advises corporate boards, management teams, and private equity sponsors on geopolitical risk, operational resilience, and sustainability strategy across the US and globally. She is the author of The Courage to Continue: Stay the Course on Sustainability to Secure Our Future.
For advisory engagement or speaking inquiries, visit alex-kruzel.com or telestostrategy.com.
Sources: Swiss Re (2025), Munich Re (2025), NAIC (2025), Lloyd's of London, California FAIR Plan, SEC, US Development Finance Corporation, US Bankruptcy Courts, Reuters. All data points cited from publicly available industry research and regulatory disclosures.