Cyber insurance coverage explained: what a policy pays for

Most business owners buy cyber cover and only read the policy after something goes wrong. By then the questions are urgent: will the insurer pay for the IT firm, the lost sales, the lawyer? This guide explains cyber insurance coverage in plain English, so you know what a policy pays for before you need it.

I will walk through the two halves of a typical policy, the gaps that catch people out, and the numbers in the schedule that decide how much you get back. Every policy differs by insurer and wording, so treat this as a map. Your broker can confirm the detail for your own cover.

First-party cyber insurance coverage: your own costs

First-party cover pays for the damage to your own business. This is the part most owners picture when they think of a cyber claim.

Many policies include these sections:

• Incident response. A breach coach, IT forensics to find out what happened, and lawyers to advise on your duties.
• Data and system restoration. The cost of rebuilding systems and restoring data from backups.
• Business interruption. Lost profit and extra costs while your systems are down.
• Cyber extortion. Help with a ransomware demand, including specialist negotiators. Whether a policy pays a ransom depends on the wording and the law where you operate.
• Notification costs. Writing to customers whose data was exposed, and offering them credit monitoring.

For example, picture a dental practice with three surgeries. Ransomware locks its booking system on a Monday morning. The insurer's response team brings in forensics, the IT firm restores the system from backups, and the business interruption section helps with the income lost from cancelled appointments. Each of those costs sits under a different section of the same policy.

Third-party cover: when others claim against you

Third-party cyber insurance coverage pays when someone else says your incident harmed them. It usually covers your legal defence costs plus any damages or settlement.

Common sections include:

• Privacy and network security liability. Claims from customers or partners after their data leaks from your systems, or after malware spreads from your network to theirs.
• Regulatory defence. The cost of dealing with a data protection regulator after a breach. Many policies pay fines and penalties only where the law allows insurance for them, so check your wording.
• Media liability. Claims about content you publish, such as defamation or copyright issues on your website.
• Payment card costs. Assessments from card brands if you take card payments and suffer a breach.

For example, an online shop that sells sports gear loses customer names, addresses and order histories in a breach. Customers complain to the regulator, and a group of them hire a lawyer. The third-party sections of the cyber insurance policy pay for the shop's defence and, subject to the wording, any settlement.

What a cyber insurance policy often leaves out

Every policy has exclusions. These are the ones I see catch businesses out most often:

1. Known incidents before the policy started. If you knew about a breach before you bought cover, the policy will usually exclude it.
2. Missing controls you promised. If your application said every user has MFA and some accounts lacked it, the insurer may challenge the claim.
3. Infrastructure failure. Outages at power grids, internet providers or other utilities often fall outside cover.
4. War and state-backed attacks. Many wordings now carry detailed war exclusions. Read them closely.
5. Betterment. The policy restores your systems to how they were. Upgrades on top usually come out of your own pocket.
6. Funds transfer fraud. Fake invoice and payment diversion losses often sit in a separate section with a smaller limit, or need adding as an extra.

For example, a travel agency with 70 staff wires a supplier payment to a fraudster after a convincing email. The agency assumes its cyber cover will pay. Then it finds that social engineering fraud was an optional extension it never bought. Our guide to the exclusions in cyber liability policies goes deeper on each one.

Limits, sublimits and waiting periods: the numbers that decide a claim

The sections tell you what cyber insurance coverage you have. The schedule tells you how much. Three numbers matter most:

• The overall limit. The most the insurer pays across all claims in the policy year.
• Sublimits. Smaller caps inside the overall limit for certain sections, such as extortion, regulatory costs or social engineering fraud.
• The waiting period. For business interruption, the policy starts paying lost income only after your systems have been down for a set number of hours. The length varies by insurer.

You also carry a deductible. This is the amount you pay yourself before the insurer pays.

For example, a logistics firm has a healthy overall limit but a much smaller sublimit for social engineering fraud. A single fake invoice could use up that sublimit in one go. The firm's broker spots the gap at renewal and asks the insurer for a higher sublimit. The headline limit looked fine. The sublimit told the real story.

How to check your own cyber insurance coverage

You can check your cover without a law degree. Set aside an hour and work through these steps:

1. Find the schedule and the wording. The schedule lists your limits, sublimits, deductible and waiting period. The wording explains each section.
2. List your three worst days. For example, ransomware, a customer data leak and a fake supplier invoice. Find the section that responds to each one.
3. Check the sublimit for each of those sections. Compare it with what that bad day would really cost you.
4. Read the exclusions with your own business in mind. Note anything that touches your systems, your suppliers or your sector.
5. Check the conditions. Many policies require you to tell the insurer within a set time and to use their approved response firms. Missing a condition can put a claim at risk.
6. Confirm your application answers still hold. If you said all staff use MFA, make sure that is still true today.

Our policy wording review checklist turns these steps into a list you can print and tick off.

Step 6 is where many claims go wrong. Insurers accept and price risk based on what you told them. PrismX helps here: it keeps your controls and evidence current, tracks the policy clocks if an incident happens, and gives your insurer a signed submission they can review.

Good cyber insurance coverage is cover you understand before the bad day arrives. Pull out your policy this week, match each section to a real risk, and raise the gaps with your broker before renewal. If you want a clear, current picture of your cyber risk to share with your insurer, book a pilot conversation with PrismX.