Cyber Insurance Products, Coverage, and Policy Provisions
Architecture of a cyber policy
Cyber coverage splits into first party and third party. First party includes incident response (forensics, counsel, notification, credit monitoring), data restoration, business interruption and contingent/dependent business interruption, cyber extortion, and social engineering or funds transfer fraud. Third party includes network security and privacy liability, media liability, and regulatory defense, with fines and penalties covered only where insurable. Key provisions: claims-made and reported triggers, retroactive date, waiting periods (commonly 8–12 hours for business interruption), retention or self-insured retention, per-occurrence versus aggregate limits, sublimits, defense inside or outside the limit, panel vendors, and consent-to-settle.
Traps
- Assuming all cyber forms are alike: affirmative versus silent/non-affirmative coverage, and heavily manuscripted wordings, vary widely.
- Confusing a limit with a sublimit, or per-claim with aggregate; defense costs inside the limit erode it.
- Overlooking exclusions: war and state-backed attacks, critical infrastructure failure, bodily injury and property damage, prior known acts, unencrypted devices, and contractual liability. Ransom payments raise sanctions questions.
- Assuming business interruption pays without proof of actual loss or without serving the waiting period.
Worked example
Per-occurrence limit $10M; extortion sublimit $2M; dependent BI sublimit $1M; retention $500K; defense inside the limit. A ransomware event produces a $2.5M demand, $1.2M in forensics and legal, and $3M of business interruption. Covered: extortion capped at $2M; response costs $1.2M; BI capped at $1M. Gross covered $4.2M, less $500K retention, net $3.7M-notice how sublimits, not the headline limit, drove the outcome.