An incident is a bad time to read your cyber insurance policy for the first time. That’s when a team trying to get back online discovers which costs are covered, who they need to call, and what required approval before they spent the money.

We’re security practitioners, not insurance brokers or underwriters; this is general education to help you ask better questions, and your policy’s terms determine coverage.

Cyber insurance can address more than ransomware. Here are six topics to bring to your broker (the person who shops for and places your policy) when applying for or renewing a policy, starting with the terms that make those conversations easier.

Terms to know before you ask

Cyber policies use a lot of insurance vocabulary. To make the terms easier to grasp, some of the explanations below compare them to car, health, homeowners, or dental insurance. Those comparisons are rough illustrations, not exact equivalents: cyber policies define these terms in their own ways, and the definitions in your policy are the ones that apply.

Term	In plain terms
Carrier	Another word for the insurance company.
First-party coverage	Pays your organization’s own costs, such as investigators, restoring systems, and lost income.
Third-party coverage	Pays when someone else, such as a customer, partner, or regulator, makes a claim against you. It usually covers legal defense and settlements.
Retention	Works like the deductible on car or health insurance: the amount you pay out of pocket before the policy starts paying. Ask which expenses count toward it and whether it applies once per incident or separately to each type of coverage.
Limit	The most the policy will pay.
Sublimit	A smaller cap for one type of loss inside the overall limit. Think of a homeowners policy with a $500,000 limit that only pays $1,500 for stolen jewelry. Ask whether it is part of, or in addition to, the overall limit.
Aggregate limit	The most the policy will pay for all claims combined during the policy period, usually a year, similar to the annual maximum on a dental plan. Ask which coverages share it.
Waiting period	A deductible measured in hours instead of dollars: how long your systems must be down before lost-income coverage starts. Ask how long it is and whether income lost during those first hours is covered.
Coinsurance	Like a health plan that pays 80% after the deductible: you pay a percentage of the covered loss. Ask whether it applies and what your share is.
Endorsement	An add-on page that changes the policy, similar to a rider. It can add, restrict, or remove coverage, so read endorsements alongside the main policy.
Panel vendors	The carrier’s approved incident response providers (such as law firms and forensic investigators), similar to in-network doctors for a health insurance plan. Ask whether you can use your own incident response firm or lawyer, and what approval you need first.

1. Data breach response

This is the “someone got our data, now what?” part of the conversation. Costs to discuss include:

• Forensic investigation: technical experts who figure out how the attacker got in, what they accessed, and for how long
• Legal review, usually through a “breach coach,” a lawyer who specializes in data breaches and helps you work out who you’re legally required to notify
• Notification and services for affected individuals, such as letters, call centers, and credit or identity monitoring
• Crisis management, such as public relations help after a breach

Ask your broker:

• Can we use our own incident response firm and outside counsel, or do we have to use the carrier’s panel?
• If customers leave after a breach, is that lost income covered, and what has to happen for that coverage to apply?

If you handle health data, card data, or consumer financial data, work with counsel to identify legal and contractual notification deadlines. Those clocks don’t wait for a claims decision.

2. Computer attack and ransomware

Ransomware costs more than the ransom. Getting back to business means investigating the attack, restoring systems, and absorbing the downtime. Ask about:

• Business income loss: lost profit and continuing expenses while systems are down; ask how the policy calculates the loss and covers the recovery period
• Forensic accounting: accountants who calculate that lost income so the claim can be paid
• Contingent business interruption: income you lose when a supplier or vendor you depend on gets hit, even though your own systems are fine
• Cyber extortion, including the ransom payment and the expert help deciding whether to pay at all
• System and data restoration

Ask your broker:

• What’s the waiting period before business income coverage kicks in?
• Does contingent business interruption cover any vendor or only ones named in the policy, and does it include suppliers that aren’t technology companies?
• Is there coinsurance on any of this?
• If someone uses our computers or cloud accounts to mine cryptocurrency and runs up our bills (“cryptojacking”), is that covered?
• Will the policy help pay to improve our security after an attack (sometimes called “betterment” or “future loss avoidance”), or only to put systems back the way they were?

Restoration coverage helps fund the work of getting systems back. It doesn’t make backups restorable if they were never tested, and it doesn’t make them survive if the attacker encrypted them along with everything else.

3. Fraud and social engineering

This is where we spend a lot of our incident response time. “Social engineering” means tricking a person rather than hacking a system, and policy definitions matter here: money stolen when an attacker sends fake instructions to your bank and money sent by an employee who was fooled into approving a payment can fall under different coverages, with different limits. Terms to ask about include:

• Computer fraud, where an attacker uses your systems to move money
• Funds transfer fraud, where an attacker sends fake instructions directly to your bank to move your money
• Social engineering fraud or misdirected payments, where someone on your team is tricked, usually by a convincing email or phone call, into sending money to the wrong account
• Invoice manipulation, where an attacker in your mailbox changes payment details and your customer pays the criminal instead of you
• Telecommunications fraud, such as an attacker running up charges on your phone system

Ask your broker:

• What is the sublimit for social engineering fraud? Is it smaller than the overall policy limit?
• Does coverage require us to have followed a verification procedure, such as calling the requester back at a number we already had on file, before releasing a payment?
• Is this covered on the cyber policy, a separate crime policy (insurance for theft and employee dishonesty), or neither?

If the answer to that verification question is yes, the procedure needs to exist and people need to actually follow it. Skipping a required verification step can put the claim at risk. Our post on the first 24 hours after business email compromise and our payment fraud prevention service go deeper on this.

4. System failure

Not every outage is an attack. A bad software update, a botched migration, or a failed change can take a business offline just as effectively. July 2024’s global outage from a faulty update to widely used security software was the reminder most people needed: no attacker, enormous downtime.

Some policies extend business income coverage to unintentional system failures, not just malicious ones.

Ask your broker:

• Does business income coverage apply when an outage isn’t caused by an attack?
• Does that extend to outages at our cloud and software providers, or only systems we run ourselves?

5. Cyber liability

This is about claims against your organization: the cost of defending them and paying covered settlements or judgments. Ask about:

• Data compromise and privacy liability for people harmed by a breach, or by your organization not following its own privacy policy
• Network security liability when your compromised systems hurt someone else, for example by spreading malware to a customer or a partner
• Electronic media liability for content on your website or social media that infringes a copyright or trademark or damages someone’s reputation
• Regulatory defense and fines, subject to policy terms; some states don’t allow insurance to pay government fines, so coverage can depend on where you operate
• PCI fines and assessments, the penalties card brands and banks can charge after a breach of payment card data; ask which part of the policy addresses them

Ask your broker:

• Do any of our customer or vendor contracts require a specific cyber liability limit, or require us to add them to our policy as an “additional insured”? Can the policy meet those requirements?
• Is regulatory defense covered, and which fines are insurable in the states and countries where we operate?
• Are PCI assessments covered, and under what limit?
• Do legal defense costs come out of the same limit that pays settlements? If they do, a long lawsuit can use up coverage before a settlement is reached.

Pull your top customer contracts before this conversation. Have your broker review the insurance requirements and involve counsel for questions about your contractual obligations.

6. Identity theft

Businesses, and the owners behind them, are targets for identity theft too. An attacker who opens credit in your company’s name can take months to unwind. Some policies offer identity recovery services or expense reimbursement, but who is protected and which costs qualify vary by product.

Ask your broker:

• Is business identity theft covered?
• Is any personal identity recovery coverage available for owners or other individuals, and who qualifies?
• Does it include a specialist to manage the cleanup, reimbursement for cleanup costs, or legal help if someone tries to collect debts an identity thief ran up in our name?

The fine print that decides claims

Beyond these coverage topics, a few things show up again and again when a claim gets complicated:

• Your application answers. Underwriters (the people at the carrier who decide whether to offer you a policy and at what price) ask whether you require multi-factor authentication (MFA), run endpoint detection and response (EDR) software that watches computers and servers for signs of an attack and helps contain it, and keep backups that attackers can’t change or delete. Inaccurate answers can affect coverage or lead the carrier to try to rescind the policy, meaning cancel it as if it never existed. In 2022, Travelers asked a court to rescind a policy after ransomware hit a server that had no MFA. The insured’s CEO had signed an application stating MFA was in use across the enterprise. The parties agreed to rescission, and the court declared the policy void from the start, leaving no coverage for the attack. Answer accurately, have someone technical review the answers before an executive signs them, and keep evidence that the controls you describe actually exist. If the true answer is “partially,” say so and fix it.
• Panel vendors and consent. Check how quickly your policy requires you to notify the carrier, and whether you need its approval before hiring outside help. Calling your own incident response firm first can leave those costs uncovered.
• Retentions and sublimits. For illustration, a $1 million policy might have a $50,000 retention and a $100,000 social engineering sublimit. If that $50,000 retention applies to social engineering, a $40,000 covered fraud loss would be entirely yours. Even a $300,000 covered fraud loss would get no more than the $100,000 sublimit, with the actual payment depending on how the retention applies. Those figures are not a quote or recommendation. Ask your broker to walk through how the applicable retention, sublimit, and aggregate interact for a sample loss.
• Exclusions. Exclusions are situations the policy won’t cover. Ask how exclusions for matters such as war, widespread internet or power outages, or incidents you knew about before the policy started affect the scenarios your business is concerned about.
• Pre-event services. Many carriers include risk management services with the policy: training, assessments, vulnerability scans, breach coach consultations. Ask which services are included and how to access them.

Insurance can help fund recovery. Your team still needs a plan.

This is the part that matters most from where we sit. A cyber policy is a financial backstop. It doesn’t make anyone at your organization know who calls the carrier’s hotline, where the policy number lives, who has authority to take systems offline, or which regulator needs a notice by when.

Security preparation supports the same risks you discuss with your broker. These controls can reduce risk and support response; they do not establish or guarantee coverage:

Coverage area	Related security preparation
Data breach	A list of your systems and where sensitive data lives; logs that record enough to reconstruct what happened
Computer attack	Phishing-resistant MFA, such as security keys or passkeys; EDR software; and tested backups kept where attackers can’t reach them
Fraud	Payment verification procedures, monitoring for suspicious mailbox activity, and login rules that block risky sign-ins
System failure	A review process before updates and changes, a list of the vendors you can’t operate without, and step-by-step recovery instructions
Cyber liability	Contract review, privacy notices that match your actual practices
All of the above	A written incident response plan that names your carrier, panel firm, and breach coach

That’s where Cyber CPR comes in. Coaching reviews the controls your insurance application asks about, so you can document what is in place and where the gaps are. Preparation builds an incident response plan with your carrier’s notification requirements, approved providers, and hotline written directly into it. Response runs a tabletop exercise, a guided walkthrough of a realistic incident, where calling the insurance carrier is part of the scenario, so your team rehearses notification and response coordination before a real incident.

If your organization has obligations under HIPAA, PCI DSS, the FTC Safeguards Rule, state privacy law, or customer contracts, that preparation needs to fit those requirements. A tailored security assessment or ongoing Virtual CISO support helps build a security program around those obligations and document the controls behind your application answers.

Bring these questions, your current policy or quote, and any customer insurance requirements to your broker before your next application or renewal. For help documenting security controls or preparing your incident response plan, contact us or call (608) 448-6075.