What Cyber Insurance Actually Covers
Commercial cyber insurance is not one promise to pay for “a cyberattack.” It is a set of contractual responses to particular losses, with particular triggers, limits and exclusions. This chapter explains how those parts fit together so that a reader can trace one incident from operational disruption to a possible claim, and can see why the same event may also reach property, crime or liability policies.
That distinction matters because the usefulness of the corporate safety net depends on what it actually catches. A firm may be insured against restoring its data but not against a supplier’s outage. It may have privacy liability protection but face a separate dispute over a fraudulent payment. An insurer may have intended to write a carefully bounded cyber book while carrying unrecognised exposure in older policies. The central issue is not the label on the policy; it is the path from an event to a covered loss.
A policy follows the loss, not just the attack
The most useful starting point is the direction in which money and harm move. First-party coverage addresses the insured firm’s own costs. Third-party coverage addresses claims brought by people or organisations affected by the incident. These are not two levels of severity. They are two different relationships created by the same event.
Imagine that an organisation discovers that an intruder has encrypted important files and copied customer data. Before it can decide how to resume operations, it may need forensic investigators to determine what happened, lawyers to assess reporting duties, and communications specialists to notify affected customers. It may need to restore data or replace compromised software. While systems are unavailable, it may lose revenue and incur extra expenses to keep essential functions running. Those are first-party consequences: the firm is bearing the direct cost of its own disruption.
A policy may respond to some of those costs through incident-response, business-interruption, cyber-extortion and data-restoration cover. Incident-response services can be as important as reimbursement because a prompt investigation can help the organisation contain the event and begin recovery. Business-interruption cover may address lost income or extra expense during restoration. Cyber-extortion cover may address response costs and, where permitted by the policy and applicable law, a ransom payment. Data-restoration cover concerns the cost of restoring or replacing damaged or lost data or software.
The word “may” is doing real work here. These categories are common, not universal. A business-interruption provision can have a waiting period, a maximum indemnity period, a sub-limit, a definition of covered interruption, or a requirement that the interruption result from a specified kind of event. Cyber-extortion terms can set their own conditions and limits. Restoration cover may distinguish between data that can be recovered and data that must be recreated. The existence of a category does not settle its scope.
The same incident can create third-party consequences. Customers may claim that their personal information was exposed. A business partner may allege that the insured’s security failure caused losses in its own operations. A regulator may investigate a privacy or security violation. Payment-card arrangements may impose fines or expenses after card data are compromised. Network-security and privacy-liability coverage can respond to some of these claims, along with legal defence costs. Regulatory fines or penalties are covered only where the law permits them to be insured.
This distinction changes how the loss develops. A firm can restore its own systems and still face subsequent liability work. Conversely, a firm may have little third-party exposure but suffer a large interruption because its production, billing or scheduling systems are unavailable. The financial consequences of one incident are therefore a bundle of paths rather than one invoice.
The practical loss journey looks like this:
The diagram shows why policy analysis must follow both the incident and the relationship. The digital dependency is upstream of the firm’s own loss, but it is not automatically a covered party or a covered cause. Customers and partners are downstream claimants, but their claims may involve different triggers and defences. Other insurance lines may provide an additional route—or may reveal an unintended exposure that no one priced as cyber.
A second distinction concerns how the product is purchased. Standalone cyber policies are designed specifically for cyber risks. Cyber cover can also appear as an endorsement, an added term attached to another commercial policy. Standalone coverage has grown rapidly and is purchased mainly by large corporations, which tend to have more data and financial resources at risk. Packaged cover can be useful for a firm that needs a broader commercial programme, but the policyholder must understand which cyber risks were added, which remain in the original line, and how the limits interact.
Contingent business interruption illustrates why the firm’s own perimeter is not enough. Suppose a cloud or information-technology provider suffers a cyber incident and a customer cannot operate. The customer did not lose control of its own network, but it lost income because a supplier could not deliver a necessary service. Contingent interruption cover extends the logic of business-interruption insurance to that dependency. It is not standard in every cyber policy, and it may apply only to named providers or specified categories of supplier. A firm that relies on a provider outside the policy’s defined set can face the very interruption it thought the cover was meant to address.
Fraud presents a different boundary. A business-email compromise or social-engineering scam may cause a direct financial transfer without an attacker penetrating the organisation’s network. In that case, the loss may fall under a crime policy rather than cyber insurance. If the fraudulent activity involves network intrusion, a data breach or ransomware, cyber cover may respond. Some insurers offer cybercrime as an endorsement, but direct coverage may be subject to sub-limits and high retentions. The question is not whether fraud used digital communication. It is what happened, what caused the loss, and which policy defines that cause.
For a policyholder, a useful reading sequence is therefore: identify the immediate loss; identify the event that caused it; identify the system or supplier involved; identify who else was harmed; then check the trigger, limit, retention and exclusion for each relevant policy. This is more demanding than asking whether cyber insurance is present, but it avoids a false sense of security produced by a broad product name.
Where the boundaries move
Insurance contracts need boundaries because an insurer has to estimate the exposure it is accepting and hold capital against it. Cyber policies commonly exclude risks that are difficult to model, difficult to attribute, or capable of producing catastrophic losses. War, terrorism and hostile acts by nation-states are common examples, although some products cover particular war-related cyber attacks. Physical damage and bodily injury may sit in traditional property and casualty lines rather than in a cyber policy. Disruption to defined infrastructure, such as an electricity grid or undersea cable, may also be excluded or limited.
These boundaries can be hard for a non-specialist to interpret because the same event can contain several causes. A power outage may be outside cyber cover if it is treated as a general infrastructure failure, but the analysis may differ if the outage was directly caused by a cyber incident affecting the insured’s own system. A destructive attack can begin with stolen credentials, move through software, stop a production line and damage equipment. The contract may need to answer whether the relevant cause is cyber intrusion, physical damage, operational failure, war, or some combination.
The boundary is also affected by overlap. Crime policies usually address financial losses from fraud or theft. Property policies address physical damage and, depending on their wording, business interruption. Liability policies address claims by others. Directors-and-officers, kidnap-and-ransom and other specialist policies may add further routes. A cyber incident can activate more than one policy because it creates more than one type of harm. That can help a policyholder obtain partial recovery, but it can also produce competing definitions, contribution disputes and multiple deductibles.
The systemic importance of overlap becomes clearer when the insurer’s intention is considered. An insurer may deliberately write a cyber policy with an exposure limit and a premium reflecting the risk. It may not have made the same calculation for every property, liability or professional-indemnity policy written years earlier. If those older wordings are silent about cyber, claims can arrive through them even though the insurer did not intend to provide affirmative cyber cover.
This is “silent cyber”: cyber coverage is neither clearly included nor clearly excluded. It is not simply a situation in which the policyholder cannot find a convenient sentence. It is an exposure-management problem. Unclear wording can make it difficult for a board or supervisor to know how much cyber risk sits within a portfolio, whether that risk is within the approved appetite, or whether the premium and capital allocation reflect it.
The 2017 NotPetya attack made the issue visible. Although the event was a cyber attack, the BIS Financial Stability Institute report says that around 85% of insured losses were reported through property claims that did not explicitly include or exclude cyber attacks. That figure belongs to the reported NotPetya experience; it is not a universal share for all cyber incidents. Its significance is the route it reveals: a cyber event can generate material claims in a line that was not designed or priced as cyber insurance.
Regulators and the industry have responded by seeking clearer affirmation or exclusion. An affirmative policy states that a defined cyber exposure is included. An exclusion states that it is not covered, subject to the wording’s precise scope. Either approach is more visible than leaving the question undecided. But clarity does not mean that every dispute disappears. State-backed attack exclusions can raise difficult attribution questions, and the BIS report notes that some exclusionary language has not yet been tested in court. A policy can be explicit and still require careful interpretation.
The same problem is beginning to appear around artificial intelligence. AI may be involved in a phishing campaign, a deepfake impersonation, a software failure, a faulty decision or a data problem. Depending on the facts, a claim could touch cyber liability, errors and omissions, directors and officers, property or product liability. Older policies may not have been written with AI-related causes in mind. “Silent AI” is a useful warning that new technology can create uncertainty across existing lines before a dedicated product exists.
Clear wording also has a trade-off. When an insurer identifies an accumulation-prone exposure, it may add an exclusion, introduce a sub-limit, require coinsurance, increase the retention or offer a separate endorsement. These measures can protect the insurer’s solvency and make the intended exposure more measurable. They can also reduce the policyholder’s recovery at the moment of a large loss, make the product more expensive, or leave a protection gap. Prudential clarity can therefore improve the reliability of the insurance book while making the individual policy less generous.
That trade-off is not an argument for vague cover. Ambiguity transfers uncertainty to the claims process, where it can damage trust and reveal exposure only after an event. Explicit limits and exclusions let policyholders decide what risk they retain or need to address elsewhere. They also allow insurers and supervisors to aggregate the exposure more honestly. The hard question is whether the remaining risk has a viable home.
For a firm, that means treating exclusions as design information, not as fine print to be read only after a loss. A policy that excludes a cloud provider’s outage may still be useful for an attack on the firm’s own systems, but the firm needs a separate continuity plan for the cloud dependency. A crime policy may be more relevant to a payment scam that never compromised the network. A property policy may govern physical damage, while a cyber policy governs restoration or liability. The firm’s actual resilience depends on the combination and on the gaps between them.
For an insurer, the same map runs in the opposite direction. It must ask where cyber exposure appears across the portfolio, including policies not labelled cyber; how many insureds rely on the same provider; whether a single event can trigger several lines; and whether reinsurance treats those claims as related. The EIOPA Financial Stability Report notes that much available EEA cyber coverage is affirmative, likely reflecting efforts to minimise or avoid silent cyber. That is progress in visibility, not proof that accumulation has been solved.
The product boundary also explains why the corporate safety net cannot be evaluated apart from the digital system it covers. A policy may respond correctly to a firm’s direct costs and still leave the firm unable to operate because its supplier’s loss is outside the trigger. It may pay a restoration bill while a separate liability claim continues. It may provide a clear limit for affirmative cyber while an apparently unrelated property book carries silent exposure to the same event. Coverage is a set of interfaces: between event and trigger, firm and supplier, policy and policy, and insurer intention and actual claim behaviour.
The next problem follows directly. Once an event can cross policy boundaries, the number of claims may depend less on how many attacks occurred than on how many organisations share the affected dependency. That is the point at which a policy question becomes an accumulation question: how one cloud outage, software vulnerability or managed-service failure can turn many separate policies into one correlated loss.