CyphrQ
Menu

Cyber Insurance Coverage: What to Buy and What Gets Excluded

What cyber insurance covers: first- and third-party cover, business interruption, extortion, exclusions, underwriter questions and sizing a limit.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

What does cyber insurance cover? Cyber insurance coverage pays for two kinds of loss after an incident. First-party cover pays your own costs, such as forensics, data recovery, lost income while systems are down and extortion. Third-party cover pays claims others bring against you, such as lawsuits and regulatory inquiries. What it excludes, and what it makes you prove, matters as much as the limit.

This is not insurance, legal or financial advice. It is a plain-language reading by CyphrQ.ai of what regulators and the insurance market publish, with links so you and your broker can check it. I don't name or rank insurers or products.

Why buy cyber insurance at all?

Because a serious incident turns into bills quickly, and many of them land in the first week: investigators, lawyers, notification, and the revenue you lose while you rebuild. A policy moves part of that cost to an insurer and often comes with a response team you can call at 2 a.m.

It is also a large and growing market. The US insurance regulators' association, the NAIC, reports that US direct written premium for cyber insurance reached about $9.46 billion in 2025, up 3.5% from 2024. Domestic insurers reported 5.84 million policies in force, a 33% increase, and insurers reported 56,323 claims, 20% more than in 2024 (NAIC 2026 Report on the Cybersecurity Insurance Market).

What insurance does not do is protect you. The UK's National Cyber Security Centre (NCSC) puts it plainly: cyber insurance "will not prevent a cyber breach/attack" (NCSC cyber insurance guidance). Treat it as the last control in the chain, not the first.

What is the difference between first-party and third-party cyber insurance coverage?

The US Federal Trade Commission's small-business guide, developed with the NAIC, splits cover into the two halves most policies use (FTC: Cyber insurance).

First-party cover (your own costs) Third-party cover (claims against you)
Typical items in the FTC list Legal counsel on notification and regulatory duties; recovery and replacement of lost or stolen data; customer notification and call centre services; lost income from business interruption; crisis management and PR; cyber extortion and fraud; forensic investigation; fees, fines and penalties related to the incident Payments to affected consumers; claims and settlement costs from disputes or lawsuits; defamation and copyright or trademark infringement losses; litigation and regulatory inquiry costs; other settlements, damages and judgments; accounting costs
Who it protects Your balance sheet You, against customers, partners and regulators
Question to ask Does it pay from the first hour, or only after a waiting period? Does the insurer have a duty to defend you, or only to reimburse you?

The FTC also suggests checking whether the insurer will defend you in a lawsuit or regulatory investigation ("duty to defend" wording), whether the policy sits in excess of other insurance you hold, and whether there is a breach hotline open every day at all hours.

A policy line that says "fines" is worth a follow-up question: ask your broker whether the policy can pay fines and penalties in each country you trade in, and get the answer in writing.

Does cyber insurance cover ransomware and lost income?

Business interruption pays the income you lose, and extra costs you incur, while an incident keeps you from trading. Read three things: the waiting period before cover starts, how the loss is calculated, and whether an outage at a supplier you depend on counts. The NCSC also warns that your existing property or business interruption policies "may provide some level of coverage for cyber-related losses" or "may specifically exclude certain cyber-related incidents", so check those before you buy a standalone policy (NCSC).

Extortion cover pays costs tied to a ransom demand. Read it together with business interruption, because downtime and rebuilding can cost more than the demand. Paying is a legal and ethical decision with sanctions questions attached, so agree in advance who decides and on what advice. The attack side is covered in how ransomware attacks unfold.

Incident response costs pay for forensics, lawyers, notification and PR. Ask whether the policy lets you choose these firms or expects you to use the insurer's own list. If you already retain an incident response firm, check before you sign. Your incident management plan should name who calls the insurer and when, and match the policy's own notification condition.

Which cyber insurance exclusions catch businesses out?

Read the exclusions before the limits. These are the ones to look for.

War and state-backed attacks. Lloyd's of London, the insurance market, issued Market Bulletin Y5381 on 17 August 2022. From 31 March 2023, at inception or renewal, all standalone cyber-attack policies in its risk codes CY and CZ must include a clause excluding losses from state-backed cyber-attacks, in addition to any war exclusion, unless Lloyd's agrees otherwise (Lloyd's Market Bulletin Y5381). The bulletin's reason is systemic risk: an attack can spread so widely that "losses have the potential to greatly exceed what the insurance market is able to absorb."

In practice: Lloyd's says many managing agents already used clauses tailored to both war and non-war state-backed cyber-attacks, and it now expects those wordings to be legally reviewed. Clauses differ, so read the one in your own policy rather than assume it matches an older war exclusion.

Infrastructure outages. The US Government Accountability Office reported in June 2022 that "insurers are excluding coverage for losses from cyber warfare and infrastructure outages" (GAO-22-104256). Ask whether a failure at your power, telecoms or internet provider is covered, and whether a cloud outage counts as one.

Misstated security controls. The application form is part of the contract. The NCSC warns: "If you're claiming that security measures are in place when they're not, the insurer may not be obliged to pay any claims" (NCSC). The answer "yes, we have MFA" has to be true on the day of the incident, everywhere you said it was.

Unpatched systems and prior acts. Ask whether the wording excludes or reduces cover for losses through a known vulnerability left unpatched past a set time, and whether incidents that began before the policy started (a retroactive date) are covered. These terms vary between wordings, so get the answer in writing for yours.

What do cyber insurers ask before they cover you?

Underwriters price the risk from your answers on an application form. The control questions in our breach value calculator follow typical underwriting questions, so they give a fair picture of what you are likely to be asked:

  • Multi-factor authentication (MFA) for remote access, for privileged accounts and for email.
  • Endpoint detection and response (EDR), software that watches devices for attack behaviour, on all endpoints.
  • Email security filtering, and phishing training for staff.
  • Patching of critical vulnerabilities within a set window (the calculator asks about 14 days).
  • Privileged access management, meaning controlled, logged admin accounts.
  • Backups that are immutable or offline, protected by their own MFA, with restores that have been tested.
  • A tested incident response plan and round-the-clock monitoring.

The NCSC's own list of seven questions is a good companion. Its last question is the one buyers skip: "What must be in place to claim against (or renew) your cyber insurance policy?" (NCSC). The NCSC also notes some insurers offer discounts for Cyber Essentials certification in the UK.

How much cyber insurance cover do you need? Sizing the limit

The limit is the most you can recover. Too low and a severe incident outruns it. Too high and you pay for cover you will never use. Our free breach value calculator gives you a starting range to take to a broker. Here is what it does, and what it doesn't.

Annual loss estimate. The calculator starts from a published base rate for your sector's chance of a significant incident in 12 months and a published loss per incident for your revenue band (median and 95th percentile). Each control you answer "No" to raises the chance or the size of the loss by a multiplier. You can also enter your own low, likely and high figures for downtime, response cost, notification and fines. It combines the three points into one average and multiplies by the chance, giving an expected annual loss for both views: the published benchmark and your own scenario.

Cover limits to discuss with a broker. The calculator shows a range. The bottom is the larger of the two average single-incident losses. The top is the larger of the two high cases, the "severe single incident". As an illustration from the calculator's own settings: a financial firm with $50 million revenue that answers "Yes" to every control and enters no scenario figures gets a 6.8% chance of a significant incident, an expected annual loss of about $120,000, and a cover range of about $1.77 million to $9.1 million. Your answers will move all three.

Asset exposure view. You can list up to five critical assets, such as a payments platform or a customer database. For each, the calculator works out exposure (daily downtime cost times restore days, plus records times cost per record), weights the chance by data class and whether the asset faces the internet, and rates annual risk as High, Medium or Low against your revenue. It flags assets whose exposure exceeds their stated value, which is often the asset to discuss with your insurer first.

What it is not. It is not insurer pricing. The multipliers for each "No" answer are our assumptions, the base rates come mostly from US data, and it does not model lawsuits or third-party settlements beyond the fines and notification costs you enter. Everything runs in your browser and nothing is sent anywhere. Use it to prepare the conversation, then let the broker and underwriter do the pricing.

Going deeper: for security and IT teams

Security teams usually meet cyber insurance twice: when the application form arrives, and when the incident happens. Both deserve engineering discipline.

Read the exclusion as a specification. Lloyd's Y5381 sets five minimum requirements for the state-backed exclusion. It must (1) exclude losses from war, declared or not, where the policy has no separate war exclusion; (2) exclude losses from state-backed cyber-attacks that significantly impair a state's ability to function or its security capabilities; (3) be clear whether it excludes computer systems outside an affected state; (4) set out a robust basis for agreeing how an attack is attributed to a state; and (5) define all key terms (Lloyd's Y5381). Lloyd's accepts any of the four model clauses the Lloyd's Market Association issued as LMA21-043-PD. Ask which of the four your policy uses. The differences sit in points 3 and 4, and those decide whether a mass malware event that also hit a government network leaves your claim intact.

Attribution is a live question in your incident. If the exclusion depends on attribution to a state, your forensic report becomes evidence in the coverage discussion. Agree with legal counsel, early in the incident, how indicators and threat-actor naming are recorded, and keep facts separate from vendor speculation about who did it.

Government backstops are narrower than many assume. The GAO found that the US Terrorism Risk Insurance Program is limited in covering catastrophic cyber losses, because attacks "must be violent or coercive in nature to be certified" as terrorism (GAO-22-104256). GAO recommended that CISA and Treasury's Federal Insurance Office assess whether a federal response is warranted. Do not assume a public scheme picks up what your policy excludes.

Make every application answer evidential. For each control on the form, keep the evidence an insurer's investigator would ask for, dated near renewal:

  • MFA: identity provider policy exports showing enforcement for all remote access, admin roles and email, with the exception list and why each exception exists.
  • EDR: console coverage report versus the asset inventory, so "all endpoints" is a number, not a belief.
  • Patching: time-to-remediate for critical vulnerabilities, with the known-exploited ones tracked separately. The CVE, CVSS, EPSS and KEV guide covers how to prioritise.
  • Backups: immutability setting, separate credentials, and the last restore test with time taken.
  • Incident response: last tabletop date and who attended.

Wire the insurer into the playbook. Add the insurer's notification channel, policy number and panel firms to your incident runbook, next to your regulator clocks. Regulators' reporting windows, which can start before the insurer is told, are compared in our country-by-country table. Note any consent requirement before you appoint outside firms or pay a ransom, and who in your organisation can give it.

Questions for your broker or underwriter:

  • Which state-backed exclusion clause is in the wording, and how is attribution agreed?
  • Does business interruption cover a supplier or cloud outage, and what is the waiting period?
  • Are fines, penalties and regulatory defence costs covered in each country we operate in?
  • Is a claim reduced if a control we declared was missing on one system?
  • Is the liability section claims-made, and what is the retroactive date?

Key takeaways

  • Cyber insurance has two halves: first-party cover for your own costs, and third-party cover for claims against you. Check both.
  • The NAIC reports about $9.46 billion of US cyber premium in 2025 and 56,323 claims, 20% more than in 2024.
  • Lloyd's has required state-backed cyber-attack exclusions in standalone cyber policies since 31 March 2023. Read which clause your policy uses.
  • Your application answers are part of the contract. The NCSC warns an insurer may not pay if declared controls were not in place.
  • Size the limit from your own exposure. The breach value calculator gives a starting range for a broker conversation, not a price.

A cyber insurance buying checklist

  1. List what your existing property and business interruption policies say about cyber.
  2. Run the breach value calculator with your own figures and note the cover range and your top gaps.
  3. Fix or document the gaps before the application, and keep evidence for every "Yes".
  4. Read the exclusions first: state-backed attacks, infrastructure outages, unpatched systems, prior acts.
  5. Check incident support: hotline, panel firms, and whether you can use your own.
  6. Put the insurer's notification steps into your incident runbook.
  7. Review the policy with legal, finance and security together, as the NCSC suggests, before you sign.

Sources