Cyber Insurance

Core Takeaways

• Split the policy in two: first-party cover for the cost of responding, third-party cover for liability to others.
• It is not a substitute for security. Conditions such as multifactor authentication and offline backups are claim prerequisites, not suggestions.
• Limits are usually an aggregate with small sublimits per head of cover — the ransomware sublimit is often a fraction of the headline figure.
• Other policies have been deliberately narrowed to exclude cyber, so there is no silent fallback.

What is Cyber Insurance?

In plain English: cyber insurance pays the bills a security incident generates — the investigators, the lawyers, the notifications, the lost trading days, and the lawsuits. It does not stop the incident, and it increasingly will not pay out if the basic controls it asked you to maintain were not in place.

The Two Halves

First-party: the cost of responding

Head of cover	What it pays for
Forensic investigation	The specialist firm that determines what happened, what data was taken, and whether the attacker is still present
Breach counsel	Legal advice on notification duties, which vary by state and by sector, and privilege over the investigation
Notification	Printing, mailing, call centres, and the standing up of a notification website
Credit monitoring	Identity protection for affected individuals, often the largest single line item in a consumer breach
Business interruption	Lost income while systems are down, usually subject to a waiting period and calculated from financial records
Data restoration	Rebuilding systems and recovering data from backups
Cyber extortion	Ransom negotiation and, where lawful and approved, payment
Reputational response	Public relations and customer communication

Third-party: the cost of being blamed

Network security liability responds when a third party alleges you failed to protect their data. Privacy liability responds to allegations that you mishandled personal information. Media liability responds to content-related claims such as defamation or copyright in material you published. All three are defence-costs-heavy: the legal bill for defending a claim frequently exceeds the settlement, and defence is usually inside the limit rather than in addition to it.

Why a Dedicated Policy Is Necessary

For years the exposure sat in a gap: general liability forms assumed tangible property and bodily injury, and property forms assumed physical damage. Whether a data breach was covered depended on wording never written for it, and courts reached different answers.

Insurers closed the gap from both directions. They added cyber insurance as a product, and they added exclusions to general liability, commercial property, crime, and even some professional liability forms to remove the ambiguity. The practical result is that the question is no longer “might my other policies cover this” but “which policy is going to, and is it this one”.

Underwriting Conditions Are Claim Conditions

Cyber policies are unusual in how directly the security questionnaire feeds the coverage. Common requirements include:

• Multifactor authentication on remote access, privileged accounts, and email
• Backups held offline or immutable, with restoration tested rather than assumed
• Endpoint detection and response on servers and workstations
• Patch management on a defined schedule, with evidence of it
• An incident response plan naming who to call and in what order
• Segregation of networks holding sensitive data

These appear as warranties or conditions precedent. A claim arising from a failure to maintain one can be reduced or declined, which means the security control is doing double duty: it reduces the chance of a loss and it protects the coverage if one happens anyway.

The Ransom Decision

Cover for cyber extortion does not settle whether to pay. Two constraints sit outside the policy:

The first is sanctions. Paying a ransom to a person or entity designated under US sanctions is prohibited, and the prohibition applies to the payer regardless of what the insurance policy provides. Insurers therefore require notification to, and usually approval from, the carrier and often counsel before any payment is made.

The second is that payment does not reliably end the incident. Attackers who are paid sometimes return, and stolen data is frequently sold or held for a second demand whether or not a payment was made. This is why many policies now fund negotiation, decryption tooling, and recovery from backups as alternatives to payment, and why the incident response plan matters more than the sublimit.