A cyber claim rarely fails because the business had no cover. It fails because one clause in the wording took the cover away, and nobody read that clause until after the attack.
Those clauses are cyber liability exclusions. They list the losses an insurer will not pay for, even when the rest of the policy fits. Every cyber insurance policy has them, and the wording changes from one insurer to the next. This guide explains the exclusions that most often catch businesses out and shows you how to check your own policy before you sign.
What cyber liability exclusions do
Think of a policy in two halves. The first half lists what the insurer pays for, such as incident response, lost income and claims from customers. The second half lists the exceptions. When the two halves clash, the exceptions usually win.
For example, a recruitment agency with 30 staff buys cover for data breaches. A breach happens. The agency then finds that the attacker got in through a laptop running software the maker stopped updating years ago, and the wording has a clause about that. The breach cover was real. The exclusion still decided the outcome.
So read the cyber liability exclusions as carefully as the cover. They tell you what you really bought.
War, state attacks and outages
These two exclusions sit in almost every wording, and insurers keep adding detail to them.
War and state-backed attacks
Many policies exclude losses from war. Newer wordings often go further and exclude some cyber attacks that a government carries out or directs. The exact test varies. Some wordings look at how widely the attack spread. Others ask whether the attack hit services a country depends on.
For example, a freight forwarder gets caught in a malware outbreak that governments later blame on a foreign state. Whether the policy pays can turn on a few lines in that clause. Ask your broker to explain how your insurer's war wording works and who decides where an attack came from.
Infrastructure and utility outages
Most policies also exclude failures of the big shared systems: the power grid, the internet backbone and telecoms networks. Many policies treat an outage at your own IT supplier differently. Some give cover for that under "dependent business interruption", often with a lower limit.
For example, a hotel loses bookings for two days. If the cause was a regional power cut, the infrastructure exclusion may apply. If the cause was an attack on its booking software provider, dependent business interruption cover may respond. Check which suppliers your wording includes.
Old incidents, old software and missing controls
This group causes the most arguments, because each one links back to what the business knew or promised.
Prior known incidents and the retroactive date
Policies usually exclude any incident you knew about before cover started. Many also have a retroactive date. The insurer only covers events that began after that date.
For example, an online shop spots odd log-ins in March and buys cover in April. In June, it finds out an attacker has been inside since February. The prior knowledge clause and the retroactive date can both bite. Tell the insurer about anything suspicious when you apply.
Unpatched and end-of-life software
Some wordings exclude or limit losses from software that you left unpatched, or that the maker no longer supports. A few use a "neglected software exploit" clause. Under that kind of clause, cover can shrink the longer a known fix sits unapplied.
For example, a law firm runs an old file server because one case system needs it. An attacker uses a flaw that the maker fixed months earlier. The firm may get a reduced payment, or none, depending on the wording.
Controls you declared and then stopped using
Your application forms part of the contract. If you said you use multi-factor authentication (MFA) on email and remote access, the insurer expects that to stay true.
For example, a dental practice declares MFA on all email accounts. Later, a manager turns it off on one account because the prompts feel annoying. A criminal takes over that account and sends fake invoices. Many insurers can reduce or refuse that claim. Keep declared controls switched on, and keep proof.
Betterment, fines and contract promises
These cyber liability exclusions look less dramatic, yet they surprise people at claim time.
- Betterment. Policies pay to put systems back as they were. They usually exclude the cost of making them better. For example, an architecture firm that swaps an old server for a faster cloud setup after an attack will often pay for the upgrade itself.
- Fines and penalties. Many policies cover regulatory fines only "where insurable by law", which means only where the local law allows a fine to be paid by insurance. The law differs by country. A clinic in one market may get help with a fine that a clinic in another market cannot. Your broker or lawyer can confirm the position where you trade.
- Contractual liability. Policies cover the legal liability you would face anyway. Many exclude extra promises you made in a contract. For example, a software company agrees to pay every cost a client suffers after any breach, with no cap. The policy may only cover the share the law would put on the company.
How to check the exclusions in your cyber insurance policy
You can review the main cyber liability exclusions in an afternoon. Follow these steps, and use our policy wording review checklist as you go.
- Ask for the full wording, plus any endorsements. The summary page leaves out detail.
- Find the exclusions section and write each clause in one line of plain English.
- Mark the ones that touch your business. For example, a firm with an old server should flag any end-of-life software clause.
- Check the retroactive date and the war and infrastructure wording. Ask your broker to explain both.
- Compare your application answers with how you work today. Fix gaps, or tell the insurer, before renewal.
- Read the claims conditions as well. Late notice can harm a claim as much as an exclusion. Our incident notification checklist covers the steps.
Step 5 is where most problems hide. PrismX keeps each declared control linked to its evidence and flags evidence before it goes stale. For example, a patch attestation counts for three months, so you see when it needs renewing. If ransomware worries you most, read what ransomware cover to look for. For the cover side of the policy, see cyber insurance coverage explained.
Cyber liability exclusions decide what your policy really pays, so learn them before you need them. Read the wording, match it to how your business runs, and keep your declared controls true.
Want your controls and evidence ready for an insurer to review? Book a pilot conversation with the PrismX team.