Glossary term
Cyber Insurance
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Cyber liability insurance
Cyber insurance is cover that pays part of the costs of a cyber incident, such as response, restoration, legal bills, notification and lost income, subject to terms, limits and security conditions.
Explanation
Policies commonly include first-party cover for the insured's own losses, such as forensic investigation, data restoration, lost income and extortion payments where the law permits, and third-party cover for claims from customers or regulators. Insurers ask detailed questions about controls before quoting. Multi-factor authentication, tested backups, endpoint detection and patching often decide whether cover is offered and at what price. Exclusions matter: war or state-backed attacks, failure to maintain stated controls and prior known incidents may be excluded, and sub-limits cap some heads of loss. Cyber insurance risk has two sides. Insurers face accumulation, where one event hits many clients at once, and buyers face gaps between what they assume is covered and what the wording says. Insurance transfers part of the financial loss. Insurance moves part of the financial loss to the insurer, but the outage, the reputational damage and the legal duties stay with the insured.
Example
A mid-sized logistics company is hit by ransomware and loses eight days of operations. Its policy pays for forensic investigators, restoration and legal advice, and reimburses lost income after a waiting period. The insurer declines part of the claim because the company had said that multi-factor authentication covered remote access, when one system had been missed.
Not to be confused with
- Professional indemnity insurance
- Professional indemnity covers claims for negligent advice or services; cyber insurance covers losses from security incidents, although the two can overlap.