Cyber insurance examples with the reasoning laid bare

Six invented incidents follow. No business, person, insurer, or amount in them is real, and none of them ends with a figure.

They are here because cyber claims are decided less by what happened than by what was done in the first few hours and by one clause in the wording nobody read. Each example is built around that clause.

Read them for the shape. Then find the same clauses in your own policy, because the point of an example is to make the wording easier to locate, not to predict an outcome.

What to take away

One: the call to the IT firm

A small firm's files are encrypted on a Friday afternoon. The owner rings the outside IT provider, who starts rebuilding from backups over the weekend and bills for the work. On Monday the owner remembers the policy.

The clause: consent and panel provisions. Many cyber wordings require the insurer to be notified and to approve vendors before costs are incurred, and route response work through approved specialists. Work done before notification may sit outside what the policy will reimburse, however sensible it was.

The tempting first move was the right technical instinct and the wrong sequence. The hotline in the policy was the first call, and the IT provider the second, after approval.

Two: the outage that ended too soon

A retailer's systems are down for most of a working day after an intrusion, then restored. Sales for that day are lost. The business claims for the interruption.

The clause: the waiting period on business interruption cover. That coverage typically engages only once an outage has lasted longer than a stated period, and an outage shorter than that produces no recoverable interruption loss at all, however expensive the day was.

What the example surfaces: that the waiting period is a policy-specific number to read before you buy, and that data restoration costs and interruption loss are separate heads of cover with separate triggers.

Three: the bank details that changed

A bookkeeper receives an email, apparently from a regular supplier, asking that future payments go to a new account. Two payments are made before the supplier phones to ask where the money is.

The clause: the sub-limit for social engineering or funds transfer fraud, and any conditions attached to it. This category of loss is very commonly capped well below the headline limit, and some wordings require that a verification procedure was followed before the loss is covered at all.

What the example surfaces: that the headline limit is not the number that applies here, and that a written callback procedure for payment changes is both a control the insurer asks about and a condition it may enforce.

Four: the intrusion that started last year

A consultancy discovers that a system was accessed months earlier and data taken over a long period. The policy was bought this year, from a new insurer, after switching to save money.

The clause: the retroactive date and any prior-knowledge provision on a claims-made policy. If the intrusion began before the retroactive date, or if circumstances were known before inception, the current policy may not respond, and the previous one may no longer be in force to receive the claim.

What the example surfaces: why continuity of the retroactive date is worth more than the saving from switching, and why the question at renewal is never only "is it cheaper". Claims-made cover behaves the same way in professional liability, where the retroactive date is most of the argument at every renewal.

Five: the control that was switched off

On its application a company confirmed multi-factor authentication on all remote access. During a systems project it was disabled for a group of accounts and never re-enabled. The intrusion used one of those accounts.

The clause: whatever the wording says about representations and about conditions tied to stated controls. Depending on the policy, a control declared on the application and not operating at the time of loss can range from a factor in the claim to a bar on it.

What the example surfaces: that the application is part of the contract, that a mid-term change to a declared control is a conversation with the broker rather than a detail for renewal, and that this is the clause most worth reading before you sign anything.

Six: the vendor that went dark

A company's own systems are untouched. Its cloud provider suffers an outage and the company cannot trade for two days.

The clause: dependent business interruption, sometimes called contingent cover. Whether an outage at a third party is contemplated at all, which vendors qualify, and whether the same waiting period applies are all policy-specific. Some wordings include it by default, some by endorsement, and some name the categories of vendor that count.

What the example surfaces: that "our systems are fine" is not the same as "we are fine", and that the list of vendors you depend on is a document the broker needs before the renewal conversation starts, for the reasons set out in the renewal reading guide.

The four things every example has in common

The overview of the line explains the two halves of a cyber policy and the consent provision that governs the first hours. State law sets notification duties to affected people and regulators. Your state attorney general's office publishes the rule for where you are.

Where a claim is made against you rather than by you, the general liability guide describes how liability cover is structured across the program.

Common questions

Are these based on real cases?

No. They are constructed to isolate one clause each. Real incidents involve several clauses at once, which is why they need a broker and, often, a lawyer.

Which clause should I read first?

Consent and panel provisions, because they govern what you may do in the first hour, and the first hour is when the damage to a claim is usually done.

Where can I read a plain account of the first few days?

The FTC's data breach response guide sets out the sequence in ordinary language. It is not a substitute for the hotline in your policy, and it will not tell you what your wording covers, but it makes the shape of the week easier to picture.

Does a small business need an incident response plan?

A one-page version: the hotline, the policy number, the insurer's name, who is authorized to call, and a rule that nobody engages a vendor first. Keep it somewhere that survives the incident.

Who decides whether the clause applies to my facts?

The insurer takes a position, and if you disagree, a lawyer in your state who reads policies. Your state insurance department handles complaints about how an insurer conducted itself, but does not rule on what the wording means.