The Ultimate Guide to Cyber Insurance

Cyber insurance is the number one policy business owners and C-level leadership should consider to protect against the financial repercussions of cyber threats and data breaches. This comprehensive guide provides the key components of a cyber insurance policy in plain English. At the end, you’ll find a detailed explanation of terms involved and common exclusions.

The Role of Cyber Insurance

Cyber insurance serves as a financial safety net, designed to mitigate the risks associated with our dependence on computers. It is a line of defense for businesses against the financial strain of cyber incidents, ensuring continuity in the face of a catastrophic hack.

Decoding Cyber Insurance Terms

Per Claim Limits: This cap on the payout for a single claim ensures that insurers can manage risk effectively. For example, if a cyber attack results in a loss of $200,000 but the per claim limit is $150,000, the insurer will cover up to $150,000.
Aggregate Limit: The ceiling on the total payout within a policy period. If a series of cyber incidents exhausts this limit, the business must bear any additional costs.
Financial Rating: Reflecting an insurer’s fiscal health, this rating gauges the insurer’s ability to fulfill its obligations. You want an A- or better from AM Best ratings.
Deductible: The insured’s share of the loss, this amount must be paid before the insurer’s coverage begins. It’s a risk-sharing mechanism that can influence the policy’s premium.

First Party Coverages

Data Breach Event Response & Recovery: Handles the costs of identifying and rectifying a breach, as seen in the Ascension hospitals breach caused by malicious file download. this coverage would handle the costs of identifying and rectifying the breach.
Business Interruption: Compensates for income lost during downtime, similar to disruptions caused by ransomware attacks in 2024.
Contingent Business Interruption: Covers losses if a third-party provider, like a cloud service, suffers an outage.

Third Party Coverages

Information Privacy Liability: Protects against claims from third parties affected by a privacy breach, like the Ticketmaster data breach.
Network Security Liability: Shields against claims related to network security failures.
Regulatory Liability: Handles potential fines and penalties from regulatory bodies due to compliance failures.

Special Provisions and Exclusions

War Exclusion Carve-back: Ensures coverage extends to acts of cyber terrorism, despite standard exclusions for acts of war.
Prior Knowledge Exclusion: Excludes coverage for incidents known to the insured before the policy’s inception, emphasizing the importance of transparency.

Cyber insurance is an essential component of a comprehensive risk management strategy. With cyber threats becoming more sophisticated, the need for robust protection is undeniable. Understanding the nuances of your cyber insurance policy can make all the difference in safeguarding your business’s future.

Expert Advice: Discussing Cyber Insurance with Your Agent

Generalist insurance agents, while knowledgeable, may not always be up to date with the nuances of cyber insurance. Here’s why it’s crucial to have a detailed discussion with your agent about cyber insurance:

Specialized Knowledge: Cyber insurance requires a deep understanding of technology, data privacy laws, and specific online risks.
Tailored Coverage: Ensure the policy is tailored to your business’s unique needs.
Policy Updates: Verify that the offered policies are the most current and include recent updates.
Exclusions: Understand all exclusions to prevent unexpected gaps in coverage.
Claims Experience: An agent with cyber claims experience will have practical insights into policy responses.

To ensure you’re getting the best possible coverage, consider the following tips:

Ask for Examples: Request real-world scenarios to coverage.
Clarify Terms: Ask for explanations in simple language if needed.
Review Regularly: Regularly update your coverage to keep pace with changing cyber risks.
Consider a Specialist: Consult with a cyber insurance specialist if your business relies heavily on digital operations.

Remember, the right insurance agent will welcome your questions and be able to explain your coverage options clearly. It’s better to ask and fully understand your policy now than to discover a coverage gap when it’s too late.

Bonus terms and exclusions you should ask your cyber broker about:

Additional First-Party Coverages

Funds Transfer Fraud: If someone tricks the system into sending money where it shouldn’t, this coverage helps get that money back.
Social Engineering: This is when someone is tricked into giving away secret info or company money. The insurance helps cover the losses.
Invoice Manipulation Coverage: If a hacker changes the details on an invoice to steal money, this part of the policy helps cover the loss.
Criminal Reward: If the company offers a reward for information that leads to catching a cyber thief, this coverage can pay for that reward.
Utility Fraud: This covers losses if someone hacks into things like the electricity or water bill and uses your utilities without your permission.
Cryptojacking: If hackers use the company’s computers to mine cryptocurrency without permission, this coverage helps with the costs.
Telecommunications Fraud: This helps cover losses if someone illegally uses the company’s phone or internet services.
Bodily Injury (First Party): If someone gets hurt because of a cyber issue, like an employee injured by malfunctioning equipment, this coverage helps with the costs.
Property Damage (First Party): If the company’s property is damaged due to a cyber event, this helps pay for repairs.
Court Attendance Costs: If employees must go to court because of a cyber issue, this helps cover the costs of being there.
Bricking Coverage: If a hacker’s attack turns the company’s devices into useless “bricks,” this helps replace or repair them.

Additional Third-Party Coverages

PCI DSS Liability: If the company doesn’t follow credit card security rules and something goes wrong, this coverage helps with the fallout.
Bodily Injury Liability: If a cyber issue causes harm to someone outside the company, this coverage helps protect the business.
Property Damage Liability: If the company’s cyber problem damages someone else’s stuff, this coverage helps pay for it.
Media Liability: If the company’s online content, like a blog post or tweet, gets into legal trouble, this coverage helps sort it out.

Special Provisions and Exclusions

War Exclusion Carve-back: Normally, war isn’t covered, but this says if there’s a cyber attack that’s like an act of war, the insurance will still help.
Prior Knowledge Exclusion: If the company knew about a cyber problem before getting the insurance and didn’t say anything, this means the insurer won’t cover it.
Mandatory Reporting of Circumstances: If the company thinks something bad might happen, they must tell the insurer, or they might not be covered later.

If you made it this far, you’ve become a cyber insurance master, so congratulations. Be sure to subscribe to get more exciting cybersecurity and cyber insurance content. For more cybersecurity tips, check out our guide on the 14 steps to protect your business’ data.

Schedule a free 15-minute consult with Joe Erle to go over your cyber insurance needs and audit your current program.