Industry
Cyber insurance splits into two halves most buyers never separate
Cyber insurance is the least standardized line you will buy: the two halves of a policy, the consent provision, and the numbers that decide a claim.
The most useful thing a cyber policy gives a small business is a phone number and permission to use it.
At two in the morning, someone finds the files encrypted or the payroll transfer went to the wrong account. The difference between a bad week and a catastrophic quarter is whether anyone knew who to call and in what order.
That is not how cyber coverage is sold, and it is why so many businesses own a policy that will pay less than it should.
What to take away
- Property and liability policies are built on broadly common forms.
- Nearly every cyber policy is built from two stacks, and they answer different questions.
- Most cyber policies operate through approved response vendors, and most contain a provision requiring the insurer's consent before you incur costs.
- The retroactive date deserves the same attention here as in any other claims-made line: intrusions are frequently discovered long after they began.
This is the least standardized line you will buy
Property and liability policies are built on broadly common forms. Cyber is not. Wordings differ substantially between insurers, and the same insurer's wording differs between years. Two policies with the same name on the front can define an incident differently, structure their triggers differently, and place their sub-limits in different places.
Two consequences:
"Do you have cyber insurance" is a nearly useless question. What matters is what yours does. Nobody asks that about a general liability policy, because everyone assumes the forms are broadly alike. Here they are not.
Comparing quotes on price alone is close to meaningless here. In lines with a common form, price comparison is at least comparing similar things. In this one it is not.
The two halves
Nearly every cyber policy is built from two stacks, and they answer different questions.
First-party, your own losses. Typically arranged around:
- Incident response. Forensic investigation, specialist legal advice, notifying affected people, credit or identity monitoring where required, and communications support. For most small businesses this is the part that actually gets used.
- Business interruption. Lost income while systems are unusable. Often extended, sometimes only by endorsement, to outages at a vendor you depend on.
- Data restoration. The cost of rebuilding data and systems, which is a different thing from the income you lost while they were down. Physical damage to premises and hardware is a commercial property question, and the two policies measure an interruption differently.
- Extortion-related costs. Handling and responding to a demand. Payments to attackers raise serious legal questions, including sanctions considerations, and are dealt with through counsel: one more reason the sequence of phone calls matters. The federal StopRansomware guidance is worth reading in a quiet week rather than a loud one.
- Funds transfer fraud and social engineering. Money leaving the business because someone was deceived. This is the single most common loss for small businesses, and it is very frequently sub-limited well below the headline.
Third-party: claims made against you. Usually arranged around privacy liability, network security liability, the costs of a regulatory inquiry, media-related liability for content you publish, and obligations you have taken on contractually in relation to payment card data.
Work out which half your actual risk sits in before comparing anything. A business holding sensitive client records has a third-party problem. A business that would simply stop trading if its systems went dark has a first-party problem. Most have both, in different proportions.
The application is not paperwork
Cyber applications ask detailed questions about your security controls: multi-factor authentication, how backups are taken and whether they are separated from the network, endpoint protection, patching, email filtering, privileged access, staff training, payment verification procedures.
Those answers are representations about your business. Depending on the wording, they can be stronger.
If you claim multi-factor authentication on remote access and do not have it, you create a coverage problem that surfaces at the worst possible time. If a control lapses mid-term or a project turns something off "temporarily", tell your broker. Do not leave it for renewal.
There is an upside to this that has nothing to do with insurance. The application questionnaire is a compact list of the controls insurers have watched actually reduce losses. Working through it is a worthwhile exercise even if you never buy the policy, and it is increasingly the gate that determines whether you can buy one at all.
The panel, the clock, and the consent provision
Most cyber policies operate through approved response vendors, and most contain a provision requiring the insurer's consent before you incur costs. This is where well-meaning businesses damage their own claims.
The instinct after a breach is to call your IT provider, then your regular lawyer, and start fixing things. Under many wordings, costs incurred before notification and consent may not be recoverable, and the specialist firms on the panel do this work constantly, which is worth more than familiarity at three in the morning.
So the decisions to make now, while nothing is on fire:
- Find the notification hotline in your policy, and check whether reporting has a required timeframe.
- Put the number, the policy number, and the insurer's name in your incident response plan.
- Keep that plan somewhere that survives the incidentprinted, or on a device that is not on the network in question.
- Tell the people who might discover a problem first, including whoever is on call, that the insurer gets notified before any vendor is engaged.
- Make sure at least two people know all of the above.
The mechanics that decide the claim
| Mechanic | What to find out |
|---|---|
| Waiting period on interruption cover | How long an outage must last before that coverage engages at all |
| Sub-limits by category | Which categories carry a smaller ceiling: social engineering and extortion very often do |
| Trigger basis and retroactive date | Cyber is commonly claims-made; the retroactive date decides how far back it reaches |
| Prior knowledge provisions | What happens to something you were already aware of before inception |
| Dependent business interruption | Whether an outage at a vendor is contemplated, and which vendors |
| Conditions attached to controls | What the wording says if a stated control was not operating at the time |
| War and state-backed attack wording | An actively changing area; ask specifically what your version says |
| Consent and panel provisions | Whether you may use your own vendors, and what approval requires |
The retroactive date deserves the same attention here as in any other claims-made line: intrusions are frequently discovered long after they began. The general mechanics of trigger dates and reporting windows are covered in the policy reading and renewal guide.
Mechanics that decide the claim
- Waiting period on interruption cover
- Sub-limits by category
- Trigger basis and retroactive date
- Prior knowledge provisions
- Dependent business interruption
- Conditions attached to stated controls
- Consent and panel provisions
Questions to answer before you talk to anyone
These determine what you need far better than any product summary.
- What data do you actually hold?Customer records, employee records, health-related information, payment data. Each carries different notification obligations under state and sometimes federal law. Injury records generated by the workers' compensation system are a category small employers routinely forget they hold.
- What stops if your systems stop?Can you invoice? Take orders? Access the schedule? For how long could you run on paper?
- Who depends on you?If you hold clients' data or run a system they rely on, your outage is their loss, and your contracts may already say so.
- What do your client contracts require?Many now specify security obligations and insurance requirements, and those clauses are written by people who assume you read them.
- Where does money leave the business?Payment authorization, vendor bank detail changes, and payroll are the pathways social engineering actually uses.
- Where do your backups live, and when did you last restore from one?An untested backup is a belief, not a control, and the small business cybersecurity material NIST publishes describes what a defensible answer looks like.
What the policy will not do
Cyber insurance will not secure your systems or restore a reputation. It generally does not fund security improvements you planned to make anyway. It also will not resolve contractual obligations to your customers, which continue running while your systems are down.
If a customer complaint is about the service you provided, not the incident, that is a professional liability question, and a different policy answers it.
The controls remain your job. Insurance funds the response and the liability; it does not replace the work. Businesses that treat the policy as a substitute for backups and access control tend to discover the difference at the same moment they discover the sub-limit.
Bottom line
Read the two halves and decide which is your real exposure. Answer the application honestly and treat it as a security checklist. Find the hotline and put it somewhere offline. Then check the waiting period, the sub-limits, and the retroactive date, because those three, not the headline figure, decide what this policy does on the night you need it.
Common questions
We are small and hold very little data. Is this line relevant?
Frequently yes, and for a reason that surprises people: the loss most likely to reach a small business is money leaving through a deceived payment, not a large data breach. That category is usually sub-limited, so it deserves reading even where the data exposure is genuinely small.
Our IT provider says we are secure. Does that change anything?
It changes the likelihood, not the exposure, and it does not answer the insurance questions. The application will ask what is actually in place rather than what someone believes, and the answers may be treated as representations you have made.
What is the first call after an incident?
The number in the policy, before the IT provider and before anyone else. Most wordings require notification and vendor approval before costs are incurred, and reversing that order is the most common way a well-insured business damages its own claim.
Does the policy pay a ransom?
Some wordings address extortion costs, subject to a sub-limit and to a process. Whether a payment can lawfully be made at all raises separate questions, including sanctions considerations, which is why this runs through counsel and the insurer rather than through you.
In this guide
- Cyber insurance exposure base: revenue, records, industryThe cyber insurance exposure base is revenue, records held and industry. How to measure each from your own systems before a broker or an underwriter asks.
- What a cyber insurance calculator actually does with the numbers you enterCyber insurance calculator pages compute nothing here. What any such tool does with your inputs, why the output is not a quote, and its one honest use.
- Cyber insurance examples with the reasoning laid bareCyber insurance examples, all invented, each built around the one clause that decides it: consent, waiting period, sub-limit, retroactive date, controls.
- Five cyber insurance mistakes, from new risks to renewalCyber insurance mistakes in the order they occur: unreported changes, the headline limit, extortion demands, breach notices and the retroactive date.
- Cyber insurance insurers: a shortlist, not a rankingSearching for the best cyber insurance insurers? This is a shortlist, not a ranking, with five carriers and guidance on policy wording, panels and quote terms.
- 5 points on cyber insurance rules that matterCyber insurance rules sit in three rulebooks: your data, your sector, the policy. This page names the offices that hold each one, not their contents.
- How to review a cyber insurance policy: application, business changes, three numbersThis review reanswers last year's cyber application from evidence, lists changes in data, systems, vendors, and contracts, then checks three policy numbers.
