What does a cyber insurance policy cover?

Cyber criminals use a variety of attack tactics and techniques to extort or manipulate organizations for financial gain. Cyber insurance coverage protects organizations against the robust set of attacks hackers have at their disposal.

Cyber insurance is not designed as a one-size-fits-all, unlike other standard business risk policies, such as General Liability and Property. Whether you are evaluating the adequacy of your current cyber coverage or in the market to add cyber coverage insurance, work with an experienced broker who can help you understand the nuances between policies, and carefully review policy details and coverages.  All policies are not created equal.

Not all cyber liability insurance policies are created equal, and cyber insurance coverage can vary between carriers and policies. To adequately protect your organization against digital risks, look for coverage that will make your organization whole if you experience one of the most common cyber events.

As with most insurance policies, there are specific exclusions that a cyber insurance policy may not cover. Things that may be exclusions in your cyber insurance policy include: 

• Resulting loss of future revenue (that is to say, loss of revenue or income that extends beyond the indemnity period - the period in which cyber policies will provide business interruption and extra expense coverage, typically 180 days)

• Cyber attacks can result in brand or reputational damage, and while cyber insurance coverage can extend to reputational harm, that doesn't extend to a company's valuation

• Errors and Omissions liability - cyber policies will provide third-party protection for claims arising from a security failure, data breach and/or privacy liability. Still, they may not respond to a claim against you for a violation of your reasonable standard of care with your professional services. Specific industries can purchase Technology E&O to mitigate this risk.

• Cyber insurance does not cover employment, discrimination, and directors & officers-related claims. You’ll need a separate policy for management liability insurance.  

For an extensive list of coverage exclusions, it is best to work with a qualified cyber insurance broker to review specific policy language and any unique requirements for your region or industry.

Unfortunately, many companies still don't have cyber insurance. Some estimates say that only 10 to 15% of small and medium-sized businesses have cyber insurance. These same businesses may think that they are too small to become the target of a cyber attack.

However, Cyber criminals are finding it more profitable to target small and midsize organizations due to their ability to automate attacks and because the rush to support hybrid work models has left more businesses vulnerable. In fact, many smaller organizations with limited resources may overlook significant security risks or lack the means to address them. Additionally, the technologies that support distributed workforces provide threat actors with new ways to infiltrate any company's network.

Threat actors are no longer looking only to monetize employee or customer data; they take advantage of an organization's reliance on it. Typically, a ransomware attack involves encrypting or deleting some or all of an organization's critical information or data and holding it hostage at a high price. Even an organization's relationship with third-party vendors such as IT service providers, customer relationship management (CRM) platforms, and cloud computing providers has become a commodity to exploit. Many organizations rely on third-party vendors for critical business services, and as such, if the vendor experiences a security breach, its partner organizations could well be impacted.

For the vendor and technology organizations, third-party and errors and omissions (E&O) liability also be costly. Even if they are not to blame for the breach, notification and litigation processes can be expensive in both time and money.

We found existing cyber insurance policies lacking, so we created our own. We are proud to offer what, we believe, is the most comprehensive cover for technology risks of all forms.  Coalition's Active Cyber Insurance provides policyholders with technology and expert support before, during, and after an incident. Coalition is the only cyber insurance provider with a dedicated in-house claims and incident response team. Coalition Incident Response (CIR) will help remediate the event that allowed the attacker to gain access to your network, conduct forensic analysis, and restore the infected mailboxes. Additionally, the $0 SIR for CIR endorsement amends coverage to eliminate your Self Insured Retention (SIR) for the costs of services provided by our in-house incident response team.But a cyber incident is much more than a digital investigation. Our cyber insurance coverage includes the legal, incident response, forensics, and PR costs following a breach and the costs to notify your customers and provide credit monitoring. Additionally, we cover the financial losses associated with a security incident — whether paying a ransom, funds transfer fraud losses, or lost funds while your business is offline. Many cyber insurance policies exclude coverage for property damage, bodily injury, pollution losses, or bodily liability that might result from a cyber attack. Coalition offers coverage by endorsement for all three of property damage, bodily injury, and pollution.