Simpson & McCrady, LLC

10/15/2026

The most expensive email your team gets this year probably won’t look like a scam. It will look like it came from your CEO, your attorney, or a vendor you pay every month.

Business email compromise works because it borrows trust you’ve already built. Email and wire fraud made up 58% of the claims in Coalition’s 2026 Cyber Claims Report. AI is also cleaning up the typos that used to give these emails away.

Our advice: tell your team, in writing, that no one will ever get in trouble for calling to verify a payment request, including one that seems to come from you. Then make that call mandatory for every new wire or change in bank details.

10/12/2026

We were honored to sponsor the St. Barnabas 2026 Ladies Day Out!

Several members of our team and their guests attended the event to support this wonderful organization.

St. Barnabas serves the elderly and retired of our community, by offering compassionate, comprehensive care, regardless of the individual's ability to pay. We are proud to support this incredible mission in the Pittsburgh community.

10/06/2026

From closing up the lake houses, to winterizing the boats for the season, putting the summer toys away for the winter is an end-of-summer ritual for many families.

Do you have everything you need to make sure your boat is safe and ready for the start of next summer? Our friends at Chubb have a great checklist for prepping your boat for winter lay-ups.

When summer is coming to an end, it’s time to prepare your boat for the winter months. If you plan to have your boat hauled out and stored over the winter, here are a few items to remember.

10/01/2026

It's Cybersecurity Awareness month! We'll be sharing our insight throughout the month on how to approach your cybersecurity in both your business and your personal life.

How is AI going to change the landscape of cybersecurity in the future? How is AI changing the landscape today?

Check out the article written by our team on the click below!

Source: Google Threat Intelligence Group (GTIG), “Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access” — May 11, 2026. This memo summarizes key findings and their implications for your organization’s risk profile.

09/30/2026

We're live!! Please go show our new website some love, we are so excited to share it with you!

Our team, in conjunction with the team at Fifth Influence, worked hard to bring you a thoughtful, informative, and user-friendly website experience. You'll find us at the same URL you've always known but explore a brand-new look.

Check it out by clicking the link below!

https://www.simpsonmccrady.com/

Thank you to everyone who helped make this vision a reality!

Independent Pittsburgh insurance brokerage since 1911. Simpson McCrady protects successful families and middle-market businesses in all 50 states. Named advisors, no call centers.

09/23/2026

If your website loads in California, you can be sued in California.

That "Accept Cookies" banner everyone clicks past without reading turns out to be doing real work. Plaintiff's firms have started treating standard tracking tools, Google Analytics and Meta Pixel among them, as illegal "pen registers" under California's Invasion of Privacy Act. If the script fires before a visitor clicks accept, that is the alleged violation, and every page load counts.

Demands are landing between $5,000 and $30,000 and are deliberately priced just under what it costs to fight one.

Our advice: fix the consent banner first, then check the policy. This is one of the few exposures where the remediation costs less than a single settlement.

08/14/2026

Where does your organization stand? A 90-day roadmap by maturity.

Not every organization is starting from the same place on AI governance. Identify your current stage below, then focus your next 90 days on the actions listed for that tier.

Stage 1: Early-Stage. AI is in use, but governance is absent or informal. You're here if employees are using AI tools without centralized tracking, no one owns AI risk formally, and there's no written policy on acceptable use.

Your priorities: build an AI inventory (a spreadsheet is a fine starting point), name one risk owner, draft an acceptable use policy, and fold AI-specific scenarios into your incident response plan.

Stage 2: Developing. Governance exists, but it operates in silos. You're here if you have an inventory and a named owner, but security and governance aren't aligned and you haven't adopted a recognized framework.

Stage 3: Advanced. Governance is established. The goal now is continuous and defensible. You're here if security and governance are aligned and a framework is in place, and the challenge is keeping the program audit-ready.

Your priorities: define what triggers a formal reassessment, build executive-level reporting so leadership has a real dashboard view, and run the 48-hour test. Could your organization produce a complete AI risk artifact within 48 hours if a regulator or insurer asked for one? If not, that's the gap to close.

Our team wrote an article with more details on how to update your cyber coverage with the rapidly changing AI landscape, no matter what stage your company lands in.

Wherever you land on this, it's worth a conversation with your broker about whether your coverage reflects where you actually are.

Which stage is closest to where your organization sits today?

08/12/2026

Does a nonprofit board's D&O policy cover a data breach?

No. And this is a common we see with nonprofit and human services clients across Western Pennsylvania.

D&O insurance protects board members and executives from claims about decisions they made, mismanagement of funds, employment disputes, breach of fiduciary duty. A cyber incident is a different kind of exposure entirely, and it needs its own policy.

Here's why this matters more for nonprofits than most people assume. A human services organization handling client records. A school with student data. A community development nonprofit processing donor payment information. All of them sit on sensitive data, and most of them are running on tighter margins than the businesses that typically carry standalone cyber coverage.

The good news: cyber liability for nonprofits is more accessible and more affordable than most executive directors expect. The bad news: the boards that find this out after a breach are the ones who assumed D&O had it covered.

If your organization hasn't looked at its cyber coverage separately from its D&O policy, that's a conversation worth having before renewal, not after an incident.

08/05/2026

There are six ways AI has quietly rewritten your cyber risk profile.

Ransomware is faster now. AI automates the discovery of vulnerabilities and the brokering of access, shrinking the time between breach and extortion demand.

Data breaches are sharper too. AI-powered reconnaissance lets attackers zero in on your most valuable data: PHI, PII, financial records.

Social engineering doesn't look like spam anymore. These emails reference real org charts, real vendors, real names.

Technology E&O exposure has grown right alongside it. A supply chain attack on one AI vendor can ripple out to every client who relies on that platform.

Business email compromise now has an audio and video dimension. Deepfakes are convincing enough to impersonate an executive in real time.

And a newer category is emerging: standalone AI liability. Carriers are starting to add AI-specific exclusions to E&O and cyber policies. That means some organizations deploying AI tools may have real gaps in coverage nobody has flagged yet.

Our team has written a memo to summarize the ways AI has changed the risk landscape, governance, and coverage for your business.

The regulatory ground is moving just as fast. The EU AI Act is already live. NIST's AI Risk Management Framework is becoming the de facto US standard for 2026, and insurers are starting to reference it in underwriting. ISO 42001 is on track to become the market-expected certification by 2027.

AI hasn't just changed how attacks happen. It's changing what your policy needs to cover and what regulators expect you to prove.

Has your organization reviewed its cyber coverage against any of this yet?

08/03/2026

Good conversations happen when nobody's trying to sell anything.

That was the mixer at Leech Tishman's office this week. A few members of the S|M team spent the evening with attorneys, wealth managers, and other Pittsburgh professionals who spend their days advising the same business owners and families we do.

No pitch decks. No agenda beyond actually knowing the people you're supposed to be collaborating with when a client needs more than one kind of advisor in the room.

This is the part of the job that doesn't show up in a renewal proposal but matters just as much. The professionals who know their clients personally, can anticipate their needs before they arise, and can recommend them to trusted brokers, attorneys, and advisors. This is the beauty of the Pittsburgh network.

Thanks to the Tishman team for hosting!