Cyber security insurance, cyber risk insurance, cyber liability: what the names mean

One broker calls it cyber security insurance. Another calls it cyber risk insurance, and your accountant calls it cyber liability. If you have ever wondered whether you need all three, you are in good company. The short answer: these are names for the same family of cover.

This guide explains what each name means, the two halves of most cyber policies, and the difference between a stand-alone cyber policy and cyber cover added to another policy. By the end, you will know which questions to ask before you buy.

Cyber security insurance, cyber risk insurance and cyber insurance: one family

People use several names for the same kind of policy:

• Cyber insurance is the most common name, and the one most insurers use.
• Cyber security insurance is the name many business owners type into search engines. It links the cover to the security work you do.
• Cyber risk insurance is common among risk managers and in larger companies. It frames the cover as one way to handle a business risk.
• Cyber liability insurance is an older name. It started with cover for claims from other people, and many people still use it for the whole policy.

The label on the front matters far less than the wording inside. For example, two quotes for a 25-person marketing agency might carry different names. One says "cyber liability" and the other says "cyber risk". The second could include more cover, or less. You only find out by reading what each section pays for.

Insurers usually organise that cover into two halves: first-party and third-party.

First-party cover: your own losses

First-party cover pays for losses your own business suffers after an attack. Many policies include some or all of these:

• Specialists who investigate the attack and remove the attacker.
• Restoring or rebuilding data and systems.
• Lost income while your systems are down, often called business interruption.
• Costs of a ransomware event, where the policy and the law allow it.
• Telling customers that their data may have leaked.
• Public relations help to protect your reputation.

For example, ransomware locks the systems of an online furniture shop on a Friday night. The shop cannot take orders all weekend. First-party cover could pay for the forensic team, the rebuild and part of the lost sales, within the policy's limits. Most policies also set a waiting period, a number of hours before business interruption cover starts. That period varies by insurer, so check your wording.

Third-party cover: claims from other people

Third-party cover pays when someone else blames you for their loss. This is the "liability" part that gave cyber liability insurance its name. It often covers:

• Legal defence costs when customers or partners make a claim.
• Damages or settlements you must pay.
• Costs linked to a regulator's investigation, where the law allows the insurer to pay them.
• Claims that you passed malware on to a client or partner.

For example, an accountancy firm emails a client's tax file to the wrong person. The client's data leaks, and the client makes a claim against the firm. Third-party cover would help pay for the lawyers and any settlement, within the policy limit.

Many stand-alone cyber policies include both halves. Some older or smaller policies lean heavily toward one. Ask your broker to show you both sections side by side.

Stand-alone cyber or cyber added to another policy

You can buy cyber cover in two main ways.

Stand-alone cyber. This is a dedicated policy with its own limit, its own wording and often access to a breach response team. It tends to give the widest cover, because the insurer built it for cyber events.

Cyber added to another policy. Some insurers add a cyber section to a business package, a property policy or a professional indemnity policy. This can work well, but the cyber limit is often smaller, and it may share one limit with the rest of the policy.

A common example is professional indemnity plus cyber for technology companies. Picture a software company that builds booking systems for hotels. A bug in its code could cost a client money, and professional indemnity handles that. An attacker could also break into its own systems and steal client data, and cyber cover handles that. Many insurers offer both in one combined policy for tech firms, sometimes called technology errors and omissions. Check which section responds to which event, because gaps can appear between the two.

Here is a second example. A small retailer finds a short cyber extension in its shop package. It pays for data recovery but leaves out business interruption and ransomware costs. That retailer should compare it with a stand-alone quote before renewal.

How to check what your cyber security insurance really pays for

Whatever the name, cyber security insurance only helps if the wording fits your risks. Use these steps to see what you are buying:

1. Find the insuring clauses and sort each one into first-party or third-party.
2. Note the limit and the excess for each section, and check whether any sections share a limit.
3. Read the exclusions, especially for war, unpatched systems and outages at large internet or utility providers.
4. Check the conditions, such as how fast you must report an incident and which controls you promise to keep in place.
5. Ask your broker to confirm anything unclear in writing.

Our policy wording review checklist walks through each of these steps. For a wider look at what policies pay for, read cyber insurance coverage explained.

Insurers also look closely at your controls before they offer terms. PrismX helps you gather that evidence and turns it into a signed submission pack that your broker and the insurer can both review. It prepares the information, and the insurer decides eligibility, pricing and cover.

The name on the policy matters less than what sits inside it. To get your evidence ready for your next cyber insurance policy, book a pilot conversation with the PrismX team.