Cyber Risks

Analyzing Cyber Risk Coverage

Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.
By: | March 13, 2015 • 10 min read

Many companies are now taking a close look at the protections provided by cyber risk insurance policies — some for the first time — as data breach incidents and related cyber risks continue to increase and gain publicity, and as government agencies become more actively involved in policing the corporate response.


Although cyber coverage is a relatively new product in the insurance marketplace, there are now roughly 50 insurance carriers that offer it (although the amounts of coverage available often are limited).

These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage.  Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.

These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage.

While this provides some challenges to buying coverage, especially for the uninitiated, it often provides more room for negotiation of the terms of cyber policies than many other types of coverage.

Most cyber policies currently in the marketplace offer some combination of traditional liability coverage protecting against claims by third parties, and first-party coverage protecting against losses suffered by the insured.

There also are important terms and conditions of cyber policies that can have a significant impact on available coverage.  While no company can reasonably expect to secure every available component of coverage, awareness of differences among the policies being offered is critical to maximizing premium dollars spent.

While not exhaustive, some of the important features to be mindful of when shopping for cyber coverage include:

Third-Party (Liability) Coverages

Privacy liability coverage. This includes liability to the insured’s customers, clients and employees for breaches of their private information which can be a major component of liability in the case of a data breach.

Seeking trigger language that focuses on the insured’s failure to protect confidential information, regardless of the cause (e.g., “any failure to protect”), rather than language requiring an intentional breach, is advisable.

Also, some (but not all) cyber policies also provide coverage for the insured’s failure to disclose a breach in accordance with privacy laws.

Policies that include defense from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.

Regulatory actions. There is substantial variance among cyber policies regarding whether and to what extent they provide coverage for regulatory and other governmental actions. Even where covered, some policies require that the action be initiated by a formal “suit” in order to trigger the defense obligation.

This limitation typically would preclude defense of the investigative stage of government actions — which often is the most expensive stage for the entity being investigated.

Policies that include defense from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.

It also bears noting that civil fines and penalties are covered under many cyber policies, and companies should be mindful of this if an insurer seeks to exclude such coverage.

Notification costs. This coverage includes the costs of notifying third parties potentially affected by a data breach. There is an ever-increasing and constantly evolving landscape of breach notification laws on a state-by-state basis.

This coverage is included in most cyber policies.  However, many policies, often by endorsement, limit the number of individuals that must be notified and the method(s) of notification.  Some policies also may vest some control over the notification process (which is often sensitive to the insured) with the insurer.

These limitations could leave a company absorbing at least some of the notification costs if a breach occurs, and may require it to relinquish some control over the notification process.


Crisis management. This coverage includes the costs of managing the public relations outfall from most data breach scenarios. Most, but not all, cyber policies contain some form of this coverage.

The insured sometimes is required to choose from a pre-determined list of vendors.  In most cases, if the insured chooses another vendor, the insurer is not required to pay for the services.  However, this restriction may be negotiable.

Call centers. This coverage may be included within the notification and crisis management coverages, may be a stand-alone coverage, or may not be provided at all.

Because this tends to be one of the higher costs associated with data breaches, it is important to identify whether this coverage is expressly provided and any applicable limitations (including the number of affected persons who are eligible to receive call center services, the hours and locations of the call center, and the specific services the call center staff will provide).

Credit/identity monitoring. This coverage is included in most cyber policies, but again, may be limited for the number of affected individuals that can receive the services and the prescribed vendors that are available.

Transmission of viruses/malicious code. As its name suggests, this coverage protects against liability claims alleging damages from transmission of viruses and other malicious code or data. Not all cyber policies have this coverage.

However, before making it a priority, a company should consider the extent to which its operating systems realistically have the potential to be a source of this type of liability.

First-Party Coverages

Theft and fraud coverage. Covers certain of the costs of theft or destruction of the insured’s data and theft of the insured’s funds.

Forensic investigation. Covers the costs of determining the cause of a loss of data.

Network/business interruption. Covers the costs of business lost and additional expense due to an interruption of the insured’s computer systems. Some cyber policies require that the interruption be caused by an intentional cyber attack and some do not.

There typically are limitations to this coverage, including a requirement that the interruption last a minimal length of time before coverage incepts, and the total length of an interruption that will be covered.  This coverage may also include contingent business expenses.

Extortion. Covers the costs of “ransom” if a third party demands payment to refrain from publicly disclosing or causing damage to the insured’s confidential electronic data.

Data loss and restoration. This component — included in some but not all cyber policies — covers the costs of restoring data if it is lost, and in some cases, diagnosing and repairing the cause of the loss. It typically is subject to a substantial retention, and may be limited in terms of the cause of the data loss at issue.

The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage.

Other Key Provisions

Trigger — loss or claim. Cyber policies typically are triggered either by an event that results in the loss of data, or a “claim” arising from the event that is made against the insured (or made against the insured and reported to the insurer) during the policy period.

The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage.  Thus, the loss type policy is preferable, even though this coverage may be more expensive.

Trigger — defense. In some cyber policies, the defense obligation is triggered by a “suit,” which requires a lawsuit or written demand against the insured. This definition may preclude defense of a claim that has yet to ripen into a lawsuit or written demand (where much of the defense costs on a particular matter may be spent).


If available, less restrictive defense language is preferable.  As noted above, in some cyber policies, the “suit” limitation does not apply to governmental actions (such as investigations), which make this language somewhat more acceptable to some companies.

Defense — choice of counsel. In some cyber policies, defense costs are covered only to the extent that the insured chooses from the insurer’s (sometimes short) list of “panel” law firms. If the insured chooses a different firm, its defense costs probably will not be covered.

Given the substantial costs likely to be associated with a significant data breach (which could exceed the limits of the policy), the insured ideally will have substantive input in the choice of counsel.

Accordingly, policies with more balanced choice of counsel language (e.g., the insured and the insurer shall mutually agree on defense counsel and if they cannot agree, the insured shall choose counsel for which the insurer shall pay up to a set hourly rate) are preferable.

Retroactive coverage. Cyber policies often contain a “retroactive date.” Losses arising from events prior to the retroactive date will not be covered.  Insurers often fix the retroactive date at the initial date of coverage by the insurer, although the insured may be able to negotiate a retroactive date further back in time.

Acts and omissions of third parties. Acts or omissions of third parties may not be covered expressly, or even may be excluded, under some cyber policies.

By way of example, if a company uses the services of a third-party vendor to maintain its confidential customer or employee information in the “cloud” and the vendor experiences a data breach, the company could be sued by its customers or employees, and may not have any coverage.

Some cyber policies provide coverage for breaches of data maintained by third parties as long as there is a written agreement between the insured and the vendor to provide such services.  If a company relies on any third parties to maintain any of its confidential information, it should consider seeking a policy that expressly covers breaches of data maintained by third parties.

Moreover, any self-insured retention language applicable to this coverage should be clear that any payments made by the third party indemnifying the company for loss sustained by the breach count toward satisfaction of the retention.

Coverage for unencrypted devices. Many cyber policies exclude coverage for data lost from unencrypted devices. Cyber coverage without this limitation is preferable.

Coverage for corporations and other entities. Many cyber policies define covered persons, for liability purposes, to include only natural persons. However, entities affected by data breaches may include corporations and other business entities.

Companies should consider seeking coverage that appropriately defines the scope of entities potentially affected by a data breach.

Policy territory – occurrences outside the United States. Even if a purchaser does not operate outside the Unites States, its employees may lose their laptops, PDAs and other electronic devices containing confidential information (or have them stolen) while traveling abroad.

Many cyber policies restrict the applicable coverage territory to the United States and its territories.  Companies should ensure that its cyber policy provides coverage even if the loss or theft of confidential information at issue occurs outside the United States.

Breaches not related to electronic records. Some cyber liability policies restrict coverage to loss or theft of electronic data. However, many breaches occur as a result of loss or theft of paper (or other non-electronic) records.  Cyber policies covering both are preferable.

Location of security failure. Coverage under some cyber policies is limited to physical theft of data from company premises. This could be problematic in a number of situations, including theft of a laptop, PDA or external drive from an airport or an employee’s home.

Other policies limit coverage for data breaches resulting from password theft to situations where the theft occurs by non-electronic means.  Companies purchasing cyber policies should be wary of these types of limitations, which may not seem particularly pernicious on initial review but could be extremely costly.

Exclusions for generalized acts or omissions. Some cyber policies exclude coverage for losses arising from: (i) shortcomings in security of which the insured was aware prior to the inception of coverage; (ii) the insured’s failure to take reasonable steps to design, maintain and upgrade its security; and (iii) certain failures of security software.

Because this type of exclusionary language at least arguably is overly broad, lacking in adequate definition, and potentially subjective in application, it should be limited appropriately by negotiation or avoided altogether.


Exclusions for acts of terrorism or war. This is a common type of exclusion in cyber policies. It is unclear to what extent insurers will rely on these exclusions when data breach result from an organized attack by a foreign nation or hostile organization.

Again, the scope of these exclusions should be negotiated appropriately or, if that is not feasible, the company should consider purchasing alternative coverage.

Steve Raptis is a partner in the Washington, D.C. office of Manatt, Phelps & Phillips LLP. He counsels corporate policyholders nationwide on a broad range of insurance-related issues and represents them in complex insurance disputes. He can be reached at [email protected] or 202.585.6550.

More from Risk & Insurance

More from Risk & Insurance

Risk Focus: Cyber

Expanding Cyber BI

Cyber business interruption insurance is a thriving market, but growth carries the threat of a mega-loss. 
By: | March 5, 2018 • 7 min read

Lingering hopes that large-scale cyber attack might be a once-in-a-lifetime event were dashed last year. The four-day WannaCry ransomware strike in May across 150 countries targeted more than 300,000 computers running Microsoft Windows. A month later, NotPetya hit multinationals ranging from Danish shipping firm Maersk to pharmaceutical giant Merck.


Maersk’s chairman, Jim Hagemann Snabe, revealed at this year’s Davos summit that NotPetya shut down most of the group’s network. While it was replacing 45,000 PCs and 4,000 servers, freight transactions had to be completed manually. The combined cost of business interruption and rebuilding the system was up to $300 million.

Merck’s CFO Robert Davis told investors that its NotPetya bill included $135 million in lost sales plus $175 million in additional costs. Fellow victims FedEx and French construction group Saint Gobain reported similar financial hits from lost business and clean-up costs.

The fast-expanding world of cryptocurrencies is also increasingly targeted. Echoes of the 2014 hack that triggered the collapse of Bitcoin exchange Mt. Gox emerged this January when Japanese cryptocurrency exchange Coincheck pledged to repay customers $500 million stolen by hackers in a cyber heist.

The size and scope of last summer’s attacks accelerated discussions on both sides of the Atlantic, between risk managers and brokers seeking more comprehensive cyber business interruption insurance products.

It also recently persuaded Pool Re, the UK’s terrorism reinsurance pool set up 25 years ago after bomb attacks in London’s financial quarter, to announce that from April its cover will extend to include material damage and direct BI resulting from acts of terrorism using a cyber trigger.

“The threat from a cyber attack is evident, and businesses have become increasingly concerned about the extensive repercussions these types of attacks could have on them,” said Pool Re’s chief, Julian Enoizi. “This was a clear gap in our coverage which left businesses potentially exposed.”

Shifting Focus

Development of cyber BI insurance to date reveals something of a transatlantic divide, said Hans Allnutt, head of cyber and data risk at international law firm DAC Beachcroft. The first U.S. mainstream cyber insurance products were a response to California’s data security and breach notification legislation in 2003.

Jimaan Sané, technology underwriter, Beazley

Of more recent vintage, Europe’s first cyber policies’ wordings initially reflected U.S. wordings, with the focus on data breaches. “So underwriters had to innovate and push hard on other areas of cyber cover, particularly BI and cyber crimes such as ransomware demands and distributed denial of service attacks,” said Allnut.

“Europe now has regulation coming up this May in the form of the General Data Protection Regulation across the EU, so the focus has essentially come full circle.”

Cyber insurance policies also provide a degree of cover for BI resulting from one of three main triggers, said Jimaan Sané, technology underwriter for specialist insurer Beazley. “First is the malicious-type trigger, where the system goes down or an outage results directly from a hack.

“Second is any incident involving negligence — the so-called ‘fat finger’ — where human or operational error causes a loss or there has been failure to upgrade or maintain the system. Third is any broader unplanned outage that hits either the company or anyone on which it relies, such as a service provider.”

The importance of cyber BI covering negligent acts in addition to phishing and social engineering attacks was underlined by last May’s IT meltdown suffered by airline BA.

This was triggered by a technician who switched off and then reconnected the power supply to BA’s data center, physically damaging servers and distribution panels.

Compensating delayed passengers cost the company around $80 million, although the bill fell short of the $461 million operational error loss suffered by Knight Capital in 2012, which pushed it close to bankruptcy and decimated its share price.

Mistaken Assumption

Awareness of potentially huge BI losses resulting from cyber attack was heightened by well-publicized hacks suffered by retailers such as Target and Home Depot in late 2013 and 2014, said Matt Kletzli, SVP and head of management liability at Victor O. Schinnerer & Company.


However, the incidents didn’t initially alarm smaller, less high-profile businesses, which assumed they wouldn’t be similarly targeted.

“But perpetrators employing bots and ransomware set out to expose any firms with weaknesses in their system,” he added.

“Suddenly, smaller firms found that even when they weren’t themselves targeted, many of those around them had fallen victim to attacks. Awareness started to lift, as the focus moved from large, headline-grabbing attacks to more everyday incidents.”

Publications such as the Director’s Handbook of Cyber-Risk Oversight, issued by the National Association of Corporate Directors and the Internet Security Alliance fixed the issue firmly on boardroom agendas.

“What’s possibly of greater concern is the sheer number of different businesses that can be affected by a single cyber attack and the cost of getting them up and running again quickly.” — Jimaan Sané, technology underwriter, Beazley

Reformed ex-hackers were recruited to offer board members their insights into the most vulnerable points across the company’s systems — in much the same way as forger-turned-security-expert Frank Abagnale Jr., subject of the Spielberg biopic “Catch Me If You Can.”

There also has been an increasing focus on systemic risk related to cyber attacks. Allnutt cites “Business Blackout,” a July 2015 study by Lloyd’s of London and the Cambridge University’s Centre for Risk Studies.

This detailed analysis of what could result from a major cyber attack on America’s power grid predicted a cost to the U.S. economy of hundreds of billions and claims to the insurance industry totalling upwards of $21.4 billion.

Lloyd’s described the scenario as both “technologically possible” and “improbable.” Three years on, however, it appears less fanciful.

In January, the head of the UK’s National Cyber Security Centre, Ciaran Martin, said the UK had been fortunate in so far averting a ‘category one’ attack. A C1 would shut down the financial services sector on which the country relies heavily and other vital infrastructure. It was a case of “when, not if” such an assault would be launched, he warned.

AI: Friend or Foe?

Despite daunting potential financial losses, pioneers of cyber BI insurance such as Beazley, Zurich, AIG and Chubb now see new competitors in the market. Capacity is growing steadily, said Allnutt.

“Not only is cyber insurance a new product, it also offers a new source of premium revenue so there is considerable appetite for taking it on,” he added. “However, whilst most insurers are comfortable with the liability aspects of cyber risk; not all insurers are covering loss of income.”

Matt Kletzli, SVP and head of management liability, Victor O. Schinnerer & Company

Kletzli added that available products include several well-written, broad cyber coverages that take into account all types of potential cyber attack and don’t attempt to limit cover by applying a narrow definition of BI loss.

“It’s a rapidly-evolving coverage — and needs to be — in order to keep up with changing circumstances,” he said.

The good news, according to a Fitch report, is that the cyber loss ratio has been reduced to 45 percent as more companies buy cover and the market continues to expand, bringing down the size of the average loss.

“The bad news is that at cyber events, talk is regularly turning to ‘what will be the Hurricane Katrina-type event’ for the cyber market?” said Kletzli.

“What’s worse is that with hurricane losses, underwriters know which regions are most at risk, whereas cyber is a global risk and insurers potentially face huge aggregation.”


Nor is the advent of robotics and artificial intelligence (AI) necessarily cause for optimism. As Allnutt noted, while AI can potentially be used to decode malware, by the same token sophisticated criminals can employ it to develop new malware and escalate the ‘computer versus computer’ battle.

“The trend towards greater automation of business means that we can expect more incidents involving loss of income,” said Sané. “What’s possibly of greater concern is the sheer number of different businesses that can be affected by a single cyber attack and the cost of getting them up and running again quickly.

“We’re likely to see a growing number of attacks where the aim is to cause disruption, rather than demand a ransom.

“The paradox of cyber BI is that the more sophisticated your organization and the more it embraces automation, the bigger the potential impact when an outage does occur. Those old-fashioned businesses still reliant on traditional processes generally aren’t affected as much and incur smaller losses.” &

Graham Buck is editor of He can be reached at