What Cyber Liability Insurance Covers
Two layers of protection — what happens to your business, and what you owe others when something goes wrong.
First-Party Coverage — Protecting Your Business
First-party coverage pays for direct losses your business suffers following a cyber event — from breach response costs to lost revenue.
Data Breach Response
Forensic investigation to find the breach, legal counsel, regulatory notifications, credit monitoring for affected individuals, and PR crisis management. Typically covers all 50 states' notification requirements.
Ransomware & Cyber Extortion
Ransom payments to threat actors (subject to OFAC sanctions screening), professional negotiation, decryption and system restoration costs. Requires proof of encrypted backups at most carriers.
Business Interruption
Lost income and extra expenses when a cyber event takes your systems offline. Triggered by both attacks and accidental system failures (system failure coverage). Subject to a waiting period — typically 8–12 hours.
Cyber Crime / Funds Transfer Fraud
Covers losses from fraudulent wire transfers initiated by social engineering or BEC. Often a sublimited coverage; verify the sublimit matches your typical wire transfer amounts.
System & Data Restoration
IT costs to restore, recover, or recreate data and systems damaged or destroyed by a cyber event. Includes third-party forensic and recovery specialists.
Third-Party Coverage — Claims Against You
Third-party coverage pays when others sue or regulators investigate you because your security failure impacted them.
Network Security Liability
Claims by third parties alleging your security failure allowed malware to spread to their systems or enabled unauthorized access to their data.
Privacy Liability
Claims by individuals or regulators alleging violation of their privacy rights — including CCPA, HIPAA, GDPR, and other state or federal privacy laws.
Regulatory Defense & Fines
Legal defense costs and covered fines/penalties from regulatory investigations following a data breach. Coverage of fines varies by jurisdiction and policy form.
Media Liability
Claims of defamation, copyright infringement, or invasion of privacy arising from your online content, social media, or website.
Common Exclusions
Standard cyber policies don't cover everything. Understanding exclusions before a claim is essential — not after.
Most policies exclude losses attributable to acts of war or nation-state cyberattacks. Some carriers now offer limited coverage through a war buyback endorsement — ask specifically about this.
Physical harm to people or tangible property is covered under general liability, not cyber. Cyber events that cause physical consequences (e.g., medical device hacks) may need specialty coverage.
Cyber insurance is claims-made coverage. Known incidents or circumstances that existed before the policy's inception date are excluded.
Losses arising from deliberate or fraudulent acts by the insured are not covered. This applies to insider threats acting at the direction of the business.
Outages caused by your cloud or internet provider are often sublimited or excluded. Some policies offer dependent business interruption coverage — verify before you bind.
If you've assumed extra liability in a contract (beyond what the law would impose), that additional exposure generally isn't covered.
Critical Sublimits to Negotiate
These coverage areas are often sublimited — meaning they pay out less than your full policy limit. Know the numbers before you sign.
Often $250K–$1M vs. your full policy limit. One of the most frequently claimed coverages — make sure the sublimit reflects your actual wire transfer exposure.
8–12 hours is standard. Some carriers offer shorter waiting periods for additional premium — worth negotiating if downtime costs are high.
Some carriers require proof of offline or immutable backups as a condition of ransomware payment coverage. Confirm these requirements before a loss.
Coverage for fines varies by state, regulator, and policy form. HIPAA fines, for example, may have separate sublimits or be excluded depending on the carrier.
Also see: Ransomware glossary · Social engineering glossary
Get a Cyber Liability Pricing Indication
Preliminary pricing for your business — subject to underwriting, carrier eligibility, market appetite, and policy terms.
Get my preliminary indication →Frequently Asked Questions
How What Cyber Liability Insurance Covers should be reviewed before binding
What Cyber Liability Insurance Covers should be reviewed inside the full cyber policy, not as a one-line feature. Cyber coverage is built from definitions, exclusions, conditions, sublimits, retentions, waiting periods, approved vendors, and notice requirements. A strong proposal explains how those parts work together in a real claim.
The review should focus on the events the business could actually face: ransomware, unauthorized access, business email compromise, privacy notification, system restoration, dependent vendor failure, regulatory inquiry, and customer or client allegations. That is where wording differences become meaningful.
First-party costs
Look for forensics, breach counsel, notification, credit monitoring, data restoration, extortion response, business interruption, extra expense, and crisis communications.
Third-party claims
Review privacy liability, network security liability, media liability, regulatory defense, contractual allegations, and defense-within-limits wording.
Cybercrime and fraud
Funds transfer fraud, social engineering, invoice manipulation, and computer fraud can be separate, sublimited, or condition-heavy. Payment verification procedures matter.
What we document for What Cyber Liability Insurance Covers
A complete cyber recommendation should leave a clean trail: why the limit was selected, which markets were compared, what controls affected eligibility, which sublimits were accepted, and what the insured should improve before renewal. That record matters because cyber claims are operational events, not just insurance paperwork.
We also separate what is known from what still needs underwriting confirmation. Carrier appetite, rating, issuing paper, state availability, subjectivities, taxes, fees, and final forms can change before binding. The buyer should understand those moving parts before treating any indication as final.