This episode explores the importance of proper standalone cyber insurance over weak extensions in management liability policies, which often lack real incident support. They highlight poor practices like a major bank requesting sensitive client data via email and stress building a true security culture rather than tick-box compliance. Key advice includes using established frameworks (like risk-based ISO 27001), minimising stored PII, using secure portals instead of email, and preparing continuity plans with offline "black box" contacts and regular tabletop drills.