Cyber liability insurance
Cyber liability insurance is business coverage for losses caused by a cyber incident. Depending on the policy, it can pay your own costs for legal advice, investigation, customer notification, data recovery, downtime, extortion or fraud, and it can cover claims brought by customers, vendors or regulators. Limits, retentions and exclusions vary from policy to policy.
Also called: cyber insurance, cyber liability
Whether a cyber policy pays after ransomware, a phishing wire fraud or a vendor breach depends on what it actually contains. Cyber policies "are not standardized and vary from carrier to carrier," according to the NAIC cyber insurance guide (opens in a new tab), so two quotes with the same name can respond very differently. The pieces that decide a claim are the insuring agreements, the limits and retention, any sublimits, the exclusions, the claims-made terms and the notice conditions.
How a cyber claim gets paid
Coverage splits into two halves. First-party coverage pays the business's own costs, such as legal, forensic, notification, restoration, business interruption, crisis management, extortion and fraud expenses. Third-party coverage responds to claims, settlements, judgments, regulatory inquiries and defense costs when customers, vendors or regulators come after the business, according to the FTC (opens in a new tab).
Ransomware shows why the numbers matter. Average ransomware claim cost rose 150% from early 2018 to late 2019, and claim frequency rose 180%, according to New York DFS Circular Letter No. 2 (opens in a new tab). The example below applies that 150% increase to an illustrative $100,000 loss; the retention and limit are also illustrative, not market averages.
Hover or tap a row to highlight it.
| Step | Amount |
|---|---|
| Earlier covered loss | $100,000 |
| 150% increase ($100,000 x 1.50) | $150,000 |
| Later covered loss | $250,000 |
| Retention the business pays | $25,000 |
| Insurer payment ($250,000 minus $25,000) | $225,000 |
| Aggregate limit left for the rest of the policy period | $775,000 |
That result assumes the whole $250,000 is covered and the retention is the only deduction. A ransomware sublimit, an exclusion, or defense costs that erode the limit would change both the payment and what remains.
Limits, retentions and other terms that change the payout
Most cyber policies are claims-made, commonly have aggregate limits, often contain sublimits, and typically let defense and other expenses erode the limits, per NAIC working group materials (opens in a new tab). These are the terms to compare across quotes:
- Per-claim and aggregate limits. One caps a single claim; the other caps everything paid in the policy period.
- Sublimits. Separate caps for ransomware, social engineering, business interruption, notification, funds-transfer fraud or regulatory expenses can sit well below the headline limit.
- Retention or deductible. The amount the business absorbs before the insurer pays.
- Claims-made wording and retroactive date. Coverage generally follows when the claim is made and reported, and a retroactive date can exclude events that happened before it.
- Business interruption waiting periods and time limits. These set when downtime losses start counting and for how long.
- Defense treatment. Defense costs may sit inside or outside the liability limit.
- Approved vendors and consent. The policy may require insurer-approved lawyers, forensic firms and notification vendors, or consent before costs are incurred.
- Security conditions and territory. Required controls, encrypted or unencrypted data, and incidents involving foreign customers, vendors or systems can affect coverage.
Pricing depends on the coverages chosen, limits, retention, data classification, security infrastructure, governance, payment-card controls, interruption coverage, retroactive coverage, claims history and endorsements, according to an FTC analysis of cyber policies (opens in a new tab).
Where the term appears, and how it differs from cyber insurance
You meet the term on a stand-alone commercial cyber policy or a cyber endorsement to a business package, general liability, professional liability or crime policy. Look at the quote or application, the declarations page for the policy period, aggregate limit and retention, the insuring agreement, exclusions such as war, infrastructure failure, unencrypted data or failure to maintain required security, and conditions on notice and cooperation. It also turns up in binders, renewal proposals, endorsements, claim letters and certificate requests.
"Cyber insurance" is the broader marketplace term for both first-party and third-party cyber coverage. "Cyber liability insurance" often means only the third-party portion, but insurers and brokers also use it for a package containing both, according to the NAIC Journal of Insurance Regulation (opens in a new tab). The insuring agreements on your policy settle which one you have. Cyber exposure can also sit as "silent" risk inside non-cyber policies such as general liability or errors and omissions, per New York DFS (opens in a new tab). For how cyber fits with the other policies a business carries, see our guide to what insurance a small business needs.
Questions to ask an agent or insurer
- Does the policy include both first-party and third-party coverage, and which insuring agreements apply? One pays your own recovery costs; the other answers claims by customers, vendors or regulators.
- What are the aggregate limit, each-claim limit, retention and sublimits for ransomware, funds-transfer fraud, business interruption, notification, forensic work and regulatory expenses? Sublimits can leave you paying costs even when the headline limit looks large enough.
- Is the policy claims-made, what is the retroactive date, and what notice deadline applies? Older events can fall outside coverage, and late notice can affect a claim.
- Does the insurer have a duty to defend, and must it approve lawyers, forensic investigators, notification vendors, ransom payments or settlements first? Unapproved costs may not be fully reimbursed.
- Which security controls, vendor arrangements, territories and data types are required or excluded? These conditions can decide claims involving vendors, foreign operations, unencrypted data or payment-card information, as the Connecticut Department of Banking (opens in a new tab) also notes.
Frequently asked questions
These are the questions business owners raise most when cyber coverage comes up.
Does general liability insurance cover cyber attacks?
Most commercial property and general liability policies do not adequately cover cyber risks, according to the NAIC (opens in a new tab). Notification, restoration, interruption or ransomware costs can fall outside an existing policy, so check its wording and endorsements with your agent.
Is cyber liability insurance required by law?
Connecticut and New York do not require every small business to buy it. Separate cybersecurity duties apply to some businesses, such as the three-business-day event reporting for insurance licensees under Conn. Gen. Stat. § 38a-38 (opens in a new tab) and the 72-hour notice for DFS-regulated entities under 23 NYCRR Part 500 (opens in a new tab). Contracts with customers or lenders can also ask for proof of coverage.
Why can two cyber quotes look so different?
A single cyber form may contain up to 15 separate insuring agreements, per the NAIC Journal of Insurance Regulation (opens in a new tab). Limits, sublimits, defense treatment and exclusions can differ substantially from one quote to the next.