> vulnerability in the member portal of a major diving insurer

What are the odds an insurer would reach for a lawyer? They probably have several on speed dial.

What makes you think they don't retain them in-house?

What makes you think you don't need speed dial in-house? ;)

Depends on the usage... in-house counsel may open up various liabilities of their own, depending on how things present.