What does cyber insurance actually cover?

A cyber policy is really two policies in one jacket. First-party coverage pays your own costs after an incident. Third-party coverage pays what you owe other people. Most disappointment at claim time comes from assuming a policy does both generously when the sublimits say otherwise.

First party versus third party

The split matters because the two halves are triggered by different events and are often limited differently on the same policy.

The insuring agreements you will actually see

• Incident response. Forensics, breach counsel, notification and monitoring. Usually the first coverage to respond and often the most used.
• Business interruption. Lost income while systems are down, subject to a waiting period measured in hours.
• Dependent business interruption. The same, but when the outage happens at a vendor rather than at you. Frequently narrower or absent.
• Cyber extortion. Ransom negotiation and payment where lawful, often with coinsurance.
• Data restoration. The cost of rebuilding data and systems, which is not the same as the cost of the hardware.
• Network security and privacy liability. The third-party half, covering claims brought against you.
• Regulatory defence and penalties. Where insurable by law.
• Social engineering and funds transfer fraud. Money leaving on a fraudulent instruction. Almost always sublimited, often heavily.

The sublimits that decide real recovery

A policy can carry a headline limit and still recover very little on the loss you actually suffer, because several of the agreements above sit under their own smaller caps. Social engineering is the most common example. A business can hold a substantial policy limit and find that a fraudulent payment instruction is capped at a fraction of it.

Read the declarations page for each agreement separately rather than reading the top limit and assuming it applies throughout.

Exclusions that surprise buyers

• War and hostile act wording. How state-backed attacks are treated varies significantly between forms and has been actively litigated.
• Failure to maintain stated controls. If the application represented that a control was in place, not maintaining it can affect the claim.
• Prior known incidents. Anything a responsible person knew about before inception.
• Betterment. Upgrading systems beyond their pre-loss state is generally the insured’s cost.
• Bodily injury and property damage. Usually sit in other policies, which matters where operational technology is involved.

The exclusion that causes the most argument is not usually exotic. It is a control the application said was in place that turned out to be partially deployed.

Definitions do heavy work in cyber forms. Our cyber liability glossary covers the specific terms, and what cyber insurance costs explains how these choices affect premium.

Have someone read the policy with you

If you are not certain which half of your policy responds to the scenario you are worried about, that is worth twenty minutes before renewal rather than during an incident. 4J reviews cyber programs for Texas businesses.

Talk to a broker or call (469) 756-8776.

Educational content prepared from policy forms, carrier materials and regulatory sources. It is not a binder, a policy interpretation, or a guarantee of coverage. Coverage, availability and pricing depend on underwriting and the terms of the policy actually issued.