Home/Questions/Governance and workforce/Third-party content use
Governance and workforce

Does the Applicant use, disseminate or display material or content of others?

Almost every organisation answers yes, usually without realising how much content is in use or where its licences are.

Attested, not tenant-verifiable

What the carrier is actually asking

The carrier is asking whether you use, distribute, or display material created by others: images, music, video, text, fonts, and software components. It relates to the media liability and intellectual property elements of the policy.

Why it is underwritten

Copyright claims are frequent, inexpensive to bring, and often pursued at scale by rights holders using automated detection. Cyber policies commonly include some intellectual property cover for published content, and the carrier wants to understand the exposure.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Licensing records are attested, and the estate is usually larger than the record.

PlatformWhere the setting livesWhat has to be true
Asset recordsLicences for images, video, music, and fonts in useLicence evidence per asset, including scope and expiry. Attested
AgencyContent produced by agencies and its licensingWhether licences transferred to you and what they permit
WebsiteFonts and embedded media on public propertiesFont licensing in particular, which is a common and frequently enforced gap
SoftwareOpen source components and their licence obligationsA component inventory with licences, since some obligations attach to distribution
ProcessApproval before content is publishedA route that checks licensing before publication rather than after a demand letter
Fonts and stock images are the common claims

Web font licences frequently limit page views or domains, and stock image licences expire. Both are detected automatically by rights holders and pursued at volume. Neither feels like intellectual property risk until the letter arrives.

What a defensible yes requires

  • Licences are held and retrievable for content in use.
  • Agency-produced content has documented licensing, transferred to you.
  • Font and stock licences are tracked for expiry and scope.
  • Open source components are inventoried with their licence obligations.
  • A review happens before publication.

How this answer goes wrong

The answer is no because the organisation does not think of itself as using others content, while the website carries stock photography, a licensed font, and an agency-produced video. All three are third-party content, and the licensing for at least one of them cannot be located.

Frequently asked

Does open source software count?

For this question usually the focus is published media, and open source licence obligations are a genuine adjacent exposure worth inventorying.

What if an agency produced the content?

Get the licences and the indemnity in writing. The publisher is the target of the claim regardless of who sourced the asset.

Are fonts really a risk?

One of the most commonly enforced. Web font licensing is scope-limited and monitored, and unlicensed use is detected automatically.

Is this covered by cyber insurance?

Often partially, through media liability. Scope varies considerably, and it is worth reading if publishing is central to your business.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture