What Is Cyber Insurance?

Cyber insurance transfers part of the financial consequence of a security incident to an insurer. It is risk transfer rather than risk reduction: the policy does not make an incident less likely, only less expensive.

The market has changed substantially. Premiums rose, coverage narrowed, and underwriting moved from a short questionnaire to detailed technical requirements — which means insurability is now a security programme driver in its own right.

What policies typically cover

First party — incident response and forensics, legal advice, notification costs, credit monitoring, business interruption, data restoration, and in some policies extortion payments.

Third party — liability for claims by affected individuals or partners, regulatory defence costs, and in some jurisdictions fines where insurable. The split matters because limits and deductibles frequently differ between them.

The exclusions that decide claims

War and hostile act exclusions, which have been litigated over state-attributed attacks and remain the most consequential uncertainty in the market. Failure to maintain stated security standards.

Known unremediated vulnerabilities. Unencrypted data, in some policies. Acts of insiders. And prior knowledge, where the organisation was aware of the circumstances before the policy began.

Conditions you can breach without realising

Notification within a stated period, frequently short. Use of panel vendors for response, forensics and legal — engaging your own firm without approval can reduce or void coverage.

Insurer consent before making an extortion payment. Cooperation with their investigation. And maintaining the controls described in the application, which is the condition that turns underwriting answers into ongoing obligations.

Underwriting now sets a security floor

Insurers commonly require multi-factor authentication on remote access and privileged accounts, endpoint detection and response, offline or immutable backups with testing, patching within stated timeframes, email filtering, and awareness training.

Without those, coverage may be unavailable or priced prohibitively. For many organisations this has been a more effective driver of basic controls than any regulation, which is worth using rather than resenting.

The application is a representation

Answers on the application are relied upon. Overstating controls is the most reliable way to have a claim denied, and in serious cases to face allegations of misrepresentation.

Which makes the application worth completing carefully, with evidence, by people who know the actual state rather than the intended one. A declined application is recoverable; a denied claim after a major incident is not.

Limits, sublimits and what they actually cover

A stated policy limit is rarely available for any single category. Sublimits commonly cap business interruption, extortion payments, notification costs and regulatory defence separately, and the sublimit rather than the headline figure is what applies.

Waiting periods before business interruption cover begins, and how interruption loss is calculated, are equally consequential and equally buried. Reading those against a realistic scenario — systems unavailable for two weeks — is the way to establish what the policy is worth.

Where to start

Read your own most recent application and check whether every control you asserted is genuinely in place today and evidenced. That document is what your claim will be assessed against.

See why it will not pay and coverage and risk transfer. GuardsArm runs security risk assessments.