Plain-language guide
What Does Cyber Insurance Not Cover?
The short answer
No policy covers every loss. Yours may leave out some events. It may cap payment for some bills. It may also set rules you must follow. Read the full policy. Check any forms added to it.
Written by Joseph Boyd, MBA, Founder and Principal Advisor at Infosec Check
Published
Editorial note: this guide uses primary references and is checked when policy or legal guidance changes.
Start with four checks
Is this event covered? Look at the part that describes when coverage applies.
Is something left out? An exclusion is wording that leaves out a loss or risk.
Is there a smaller cap? A sublimit is a smaller limit for one kind of loss.
What steps are required? A condition is a rule you must meet under the policy.
Risks to ask about by name
These are questions to check, not a list of exclusions found in every policy.
| Ask about | Why it deserves a close look |
|---|---|
| Scams that trick a worker into sending money | Fraud coverage may be separate or limited |
| Events known before the policy began | Prior-knowledge and timing terms can matter |
| Deliberate wrongdoing | Intentional-act exclusions can matter |
| Failure of an outside provider | Vendor and outage coverage can differ |
| War and certain cyber operations | The wording and facts can affect the result |
| New equipment or security upgrades | Repair and improvement costs may be treated differently |
Ask which forms apply to your actual policy. A provider’s website describes products in general; your purchased forms tell you more.
The big limit may not apply to every bill
Imagine a policy has a $1 million main limit. A made-up example shows a $50,000 cap for one type of fraud. The fraud claim would still be subject to that smaller cap and the rest of the policy.
These numbers are only an example. They are not a quote or a statement about a particular insurer.
You may pay part of the cost
A deductible or retention is an amount your business may have to bear. The details differ. Ask who pays first and how the amount works for each coverage.
Can missing a security step affect a claim?
It can matter, but the answer depends on the documents, law, and facts. Avoid both of these guesses: “We have security software, so everything is covered” and “One missed step means nothing is covered.”
Keep the actual application and the facts behind your answers. Read why cyber claims may be denied or disputed.
Get answers before trouble starts
Ask for a written explanation of unclear wording. Seek qualified coverage counsel if a legal interpretation or dispute is involved.
Return to the cyber coverage hub or discuss your policy questions with Infosec Check.
Scope
This guide gives general information. It does not decide a claim or change a policy. Coverage depends on the policy, its added forms, the facts, and the law. Ask a licensed insurance professional about your coverage and a lawyer about legal questions.
Sources
Back to the cyber insurance basics hub: What Is Cyber Liability Insurance Coverage?