Cyber insurance has evolved from a niche product into an essential component of enterprise risk management. As cyber attacks grow in frequency and severity, organizations are recognizing that security controls alone cannot eliminate risk. Cyber insurance provides a financial safety net that covers the costs of breach response, business interruption, regulatory penalties, and legal liability when security incidents occur.
However, the cyber insurance market is complex and rapidly changing. Premiums have fluctuated significantly in recent years, underwriting requirements have become more stringent, and policy language can exclude the very scenarios organizations most need coverage for. This guide helps businesses understand what cyber insurance covers, how to navigate the application process, and how to maximize the value of their policies.
What Does Cyber Insurance Cover?
Cyber insurance policies are broadly divided into first-party and third-party coverages:
First-Party Coverage
First-party coverage pays for the organization's own losses resulting from a cyber incident:
- Incident response costs: Forensic investigation, legal counsel, public relations, and crisis management services. Many policies provide access to a pre-approved panel of incident response firms.
- Business interruption: Lost revenue and extra expenses incurred while systems are unavailable due to a cyber incident. This is often the largest component of a cyber claim.
- Data restoration: Costs to recover or recreate data that was destroyed or corrupted during an attack.
- Ransomware payments: Coverage for ransom payments (where legally permissible) and the costs associated with negotiation. Policies increasingly include sub-limits and requirements for law enforcement notification.
- Notification costs: Expenses for notifying affected individuals, as required by breach notification laws. This includes mailing costs, call center operations, and credit monitoring services.
- Regulatory fines and penalties: Coverage for fines imposed by regulators such as the FTC, HHS (HIPAA), or EU data protection authorities (GDPR). Coverage varies by jurisdiction, as some fines are not legally insurable.
Third-Party Coverage
Third-party coverage protects against claims made by others affected by a cyber incident:
- Privacy liability: Defense costs and settlements arising from lawsuits by individuals whose personal information was compromised.
- Network security liability: Claims from third parties harmed by a security failure in your network, such as a breach that spreads to a customer's systems or a denial of service attack launched from your compromised infrastructure.
- Media liability: Claims arising from content published online, including defamation, copyright infringement, and invasion of privacy.
- Technology errors and omissions: Claims from customers alleging that a failure in your technology product or service caused them harm.
Common Exclusions
Understanding what is excluded from cyber insurance policies is as important as understanding what is covered:
- War and state-sponsored attacks: Many policies include a "war exclusion" that may be invoked for attacks attributed to nation-state actors. The NotPetya litigation (in which insurers denied claims under war exclusions) highlighted the ambiguity of this clause. Newer policies are developing more specific "cyber war" definitions, but coverage remains inconsistent.
- Prior known incidents: Policies do not cover incidents that began before the policy inception date, or incidents the insured was aware of but failed to disclose.
- Unencrypted data: Some policies exclude or sublimit coverage for breaches involving data that was not encrypted, incentivizing organizations to implement encryption controls.
- Infrastructure failures: Outages caused by power failures, natural disasters, or non-cyber-related system failures are typically excluded from cyber policies (though they may be covered under other insurance lines).
- Social engineering fraud: Business email compromise (BEC) and invoice fraud may require separate coverage or endorsements, as standard cyber policies may not cover voluntary wire transfers made under false pretenses.
The Underwriting Process
Cyber insurance underwriting has become significantly more rigorous. Insurers now evaluate an organization's security posture in detail before providing coverage:
Application Requirements
Modern cyber insurance applications ask detailed questions about security controls:
- Multi-factor authentication: MFA deployment across email, VPN, privileged accounts, and remote access. This is often a prerequisite for coverage.
- Endpoint detection and response: Whether EDR is deployed across all endpoints, including servers.
- Backup practices: Whether backups exist, are tested regularly, and are stored offline or in immutable storage that ransomware cannot encrypt.
- Patch management: How quickly critical vulnerabilities are patched, particularly for internet-facing systems.
- Email security: Whether email filtering, DMARC, and anti-phishing controls are in place.
- Incident response planning: Whether a documented and tested incident response plan exists.
- Security awareness training: Whether employees receive regular security training, including phishing simulations.
Technical Assessments
Many insurers now supplement questionnaires with technical assessments. External attack surface scanning services like SecurityScorecard, BitSight, and Panorays evaluate an organization's externally visible security posture. Some insurers require penetration testing or security audits for larger policies.
Cost Factors
Cyber insurance premiums vary widely based on multiple factors:
- Industry: Healthcare, financial services, and retail organizations pay higher premiums due to the volume of sensitive data they handle and the regulatory environment they operate in.
- Company size: Premium generally correlates with revenue and the number of records held. Larger organizations pay more due to greater exposure.
- Security posture: Organizations with mature security programs, MFA, EDR, and well-tested incident response plans receive more favorable pricing.
- Claims history: Prior cyber incidents increase premiums, similar to other insurance lines.
- Coverage limits: Higher coverage limits and lower deductibles increase premium costs. Organizations must balance coverage needs with budget constraints.
As a rough benchmark, small businesses might pay $1,000 to $5,000 annually for $1 million in coverage, while mid-market companies pay $10,000 to $50,000 for similar limits. Large enterprises with complex risk profiles can pay $100,000 to $500,000 or more.
Maximizing Your Cyber Insurance Value
To get the most from your cyber insurance investment:
- Engage a specialized broker: Cyber insurance is complex. Work with a broker who specializes in cyber risk and can navigate the market to find the best coverage for your specific risk profile.
- Read the policy carefully: Understand exclusions, sublimits, and conditions that could affect coverage. Pay particular attention to war exclusions, retroactive dates, and notification requirements.
- Improve security controls: Better security reduces premiums and improves coverage terms. Prioritize the controls insurers evaluate most heavily: MFA, EDR, backups, and incident response planning.
- Establish relationships before an incident: Familiarize yourself with your insurer's claims process, approved incident response firms, and breach counsel. During an active incident is not the time to read your policy for the first time.
- Test your incident response plan: Regular tabletop exercises that include your insurance broker and legal counsel ensure everyone understands their role during an incident, including how and when to notify your insurer.
- Review and update annually: Your risk profile changes as your business evolves. Review coverage annually to ensure limits, sublimits, and endorsements align with current risks.
Cyber insurance is not a substitute for good security. It is a complement that transfers residual risk after controls are in place. Organizations that invest in both strong security programs and appropriate insurance coverage are best positioned to survive the financial impact of a significant cyber incident.
