A phishing email tricks an accounts payable staffer into wiring a supplier payment to a fraudulent account. A ransomware attack encrypts a medical practice's entire patient record system, and the attackers want a ransom to restore access. A retailer's point-of-sale system is quietly breached for six weeks, and 12,000 customer card numbers are exfiltrated before anyone notices.
Talk to an expertGet a quote
Core coverage
Cyber policies divide into two tracks. First-party coverage responds to your direct costs after an incident. Third-party coverage responds to claims made against you by others. Understanding the split is the key to buying the right limits.
A specialist firm identifies how the attacker got in, what they accessed, and how long they were in your system. Ransomware detected on an internal server, and the forensic team traces entry to a phishing email.
Mass notification campaigns, call centre staffing, and credit monitoring for affected individuals. 10,000 customer records exposed, and state law sets a deadline to notify them.
With the insurer's consent and where lawful: ransom payment, professional negotiators, and data restoration costs. Attackers encrypt patient records and demand a ransom for a decryption key.
Lost net income and extra expense while systems are down after a cyber event, once the waiting period (often 8 to 12 hours) has passed. An e-commerce site is offline for five days following a breach, against a daily revenue loss of $12,000.
Defence and settlement of lawsuits from individuals whose data was compromised. A class action filed after 50,000 customer records were exposed in a data breach.
Legal defence for regulatory investigations, and, where the law and the policy allow, fines and penalties. A HIPAA investigation after a PHI breach, where penalties for uncorrected willful neglect can exceed $2 million a year.
Claims brought when your own compromised systems are used to attack somebody else, plus media liability for defamation or copyright arising from digital content.
Cyber and technology errors and omissions are different policies, and a business that sells software or technical advice usually needs both. Our brokers can quote them together rather than leaving the seam between them for a claim to find, and can read the professional liability wording against your client contracts at the same time as the cyber schedule, alongside the wider business insurance stack where more than one policy is in play.
Who is buying
Any business that stores, transmits or processes data carries cyber exposure. Some industries carry it harder than others. Pick the closest match and we will tell you how an underwriter reads it.
PHI triggers HIPAA's mandatory breach reporting and significant regulatory penalties. Healthcare operators face some of the highest per-record breach costs of any sector.
Professional services firms, manufacturers running connected OT and IoT, and small businesses all carry this exposure too. Small businesses are breached often, in part because security controls are thinnest there. Size is not a defence.
A cyber policy typically responds to the incident and to its consequences. It does not respond to the quality of the product or the advice you sold. That line is where businesses discover they bought one policy and needed two.
Some examples of where the line falls:
Covered: Attackers encrypt your systems and you pay a forensic firm, a negotiator and a notification vendor. First-party cover typically responds.
Not covered: Your software has a defect that costs a client money. That is technology errors and omissions, not cyber.
Covered: A regulator opens an investigation after customer records are exposed and you need defence counsel. Third-party cover typically responds.
Not covered: An owner or executive knowingly steals data and sells it. Intentional illegal acts by the insured are generally uninsurable.
Timing matters as much as the trigger. Third-party cyber cover is usually written on a claims-made basis, often with a retroactive date, and first-party cover is usually triggered by discovery, so a breach that began before the retroactive date can fall outside the policy even though you discovered it inside the period. That is why retroactive date continuity matters more than price when you move carrier, and it is worth understanding how a claims-made policy responds before you switch on the strength of a quote alone.
The gaps
Cyber policies are specific. Assuming your existing coverage fills these gaps is how businesses end up uninsured at the worst possible moment. Eight that matter on a cyber schedule.
WHAT YOU NEED
Tech E&O or professional liability. A claim about the product or the advice you sold is a different policy.
WHAT YOU NEED
The war exclusion. Wordings vary widely and some are broad enough to catch a criminal attack attributed to a state. Discuss it before binding, not after.
WHAT YOU NEED
Multi-factor authentication, patching and staff training are conditions now rather than discounts. A control you said you had and did not is a coverage argument.
WHAT YOU NEED
Anything you knew about before inception. Check retroactive date continuity every time you move carrier.
WHAT YOU NEED
General liability. A cyber policy does not respond to somebody being hurt or to physical damage.
WHAT YOU NEED
Deliberate wrongdoing by you or your senior management is generally uninsurable. A rogue employee's act is different: many policies cover the resulting breach, so check the conduct exclusion.
WHAT YOU NEED
The cost of rebuilding a system better than it was. The policy restores you to where you were, not to where you wish you had been.
WHAT YOU NEED
Service credits and liquidated damages you signed up for are a commercial promise, not an insured loss.
The war exclusion and the social engineering sub-limit are the two that most often separate a policy that responds from one that argues. Both are readable at quote stage and expensive to discover later. Speak to our team about which wording your business actually needs, and ask about cover for employee injury at the same time if you are carrying staff.
Two tracks
Cyber cover is bought as one policy and used as two. Almost every buying mistake on this page comes from sizing one track and assuming the other followed.
Forensic investigation, notification, credit monitoring, ransom and negotiators, lost income while systems are down, and crisis PR. This half is spent in the first weeks and it is spent whether or not anybody ever sues you. Forensic investigation alone can run well into six figures, and notification costs rise with every record.
Privacy lawsuits from the individuals whose data was exposed, regulatory defence and, where insurable, fines, network security liability when your systems are used to attack somebody else, and media liability. This half arrives months later and can run into the millions before a single settlement is reached.
Social engineering losses, which means wire fraud and increasingly deepfake instruction, are often excluded unless endorsed, and where included are usually sub-limited. Some carriers cap it at $100,000 on a $2 million policy. It is the single most common gap between the cover a business thinks it bought and the cover it has.
None of this is unusual and none of it is hidden. It is written in the schedule, and reading the schedule is the job. Our brokers read sub-limits, war exclusion language and retroactive dates in the quotes that come back, and read the certificate request against your contract when a client wants proof of cover.
Speak to our teamEndorsement check
Each line below is something an underwriter will ask about, and each one changes the schedule. Nothing here is a quote and nothing here is priced. It shows which parts of a cyber policy your business actually has to negotiate.
What your schedule has to carry
Tick what applies and the cover it implies appears here.
Take this to your renewal. A broker can tell you in one call which of these your current schedule already answers, and at what sub-limit.
Speak to our teamCost
There is no flat answer, and any number quoted without seeing your controls is a guess dressed up as a price. Underwriters are scrutinising controls far more closely than they used to. Six inputs move a cyber premium more than anything else.
How many records you hold and what kind. Health and card data price differently from a mailing list, because the notification obligation and the regulator behind it are different.
Multi-factor authentication, endpoint detection, offline backups and a documented incident response plan. This is the input a business can actually change, and it is the one underwriters look at first.
Healthcare, finance and retail carry mandatory reporting regimes and named penalties. The regulator is part of the rate.
Revenue sets the business interruption exposure, and how much of it depends on systems being up sets how fast that exposure accrues.
Prior incidents, and whether the findings were remediated. A closed-out incident with evidence reads very differently from an open one.
The policy limit, and separately the social engineering, regulatory and dependent business interruption sub-limits underneath it. Each one is priced.
Three marks is an input that moves a cyber premium more than the others here. It is a relative weighting drawn from how underwriters behave, not a rate, and not a quote.
Many small businesses carry $1 million in cyber limits. That sounds like a lot until you stack it: forensic investigation, notification for every affected record, regulatory defence, income loss during downtime, and third-party liability if clients sue. A mid-sized breach can consume a $1 million policy before the class action is filed. Cyber business interruption is also a distinct trigger from property business interruption, and the limits need to reflect the actual exposure under each. Our brokers can work through that calculation with you before a submission goes out.
Talk to an expertProcess
We understand your business first, then take it to the carriers who want to write it. An advisor walks you through the options and what they cost. No two files are the same, so what follows is the shape of a placement rather than a script.
What you do, where, with how many people, and what your contracts oblige you to carry. Those answers decide which markets will look at the file at all, and how much of the rest of this applies to you.
One set of information goes to underwriters with genuine appetite for your work rather than whoever happened to quote last renewal. An advisor talks you through what comes back and what it costs.
A client wants proof of cover before you start, and this is how COIs get issued here. We read the certificate request against your contract, so any endorsement it needs is requested from the carrier before the certificate is issued.
No federal law mandates it, but contracts increasingly do. Client agreements, vendor onboarding and data processing terms routinely require it at a stated limit, and some state regulators expect it of licensed firms. In practice it is required by whoever you want to do business with rather than by statute.
First-party responds to your own costs after an incident: forensics, notification, ransom, lost income. Third-party responds to claims made against you by other people: privacy lawsuits, regulatory action, network security liability. Most policies carry both, at different limits, and sizing one does not size the other.
Only if the policy includes it. Social engineering and funds transfer fraud cover is often an optional endorsement or sits on a crime policy, and where included it is usually sub-limited; some carriers cap it at $100,000 on a $2 million policy. Read the sub-limit before you rely on it.
Cyber extortion cover typically pays the ransom and negotiator with the insurer's prior consent, sometimes under a ransomware sub-limit or coinsurance, and data restoration usually sits in its own insuring agreement. Whether a payment can lawfully be made is a separate question, and sanctions screening is part of the claims process.
Yes. Outsourcing the systems does not outsource the liability to the people whose data you hold. It also adds a dependency, because an outage inside your provider's network can stop your business. Dependent business interruption cover is what answers that.
It depends entirely on the war exclusion wording, which varies widely between carriers. Some are narrow and some are broad enough to catch a criminal attack later attributed to a state. This is a wording to compare before binding rather than after.
Start from your record count for the notification floor, then add forensics, income loss and third-party liability on top. Many small businesses carry $1 million, and a mid-sized breach can use that up before a class action is filed. The right answer depends on your data and on how much of your revenue stops when systems do.
They change what carriers will offer and on what terms. Multi-factor authentication, endpoint detection, offline backups and a documented incident response plan are conditions of cover with most markets now rather than optional extras. We will tell you which controls the underwriters looking at your file are actually asking about.
Get started
Tell us what data you hold and how you move money, and we will go to market for terms that address both. If your current policy carries a social engineering sub-limit or a war exclusion, we will read both with you before you renew.
This page is general information, not a coverage determination. What your policy covers is governed by its own terms, conditions, and exclusions.
