Glossary

First-party coverage

Insurance that pays the policyholder directly for its own losses, such as damaged property or breach response costs, rather than defending claims by others.

Also called: first-party insurance, first-party loss, first-party cyber coverage

First-party coverage pays you, the policyholder, for loss you suffer yourself. The insurer is the second party; a third party is anyone who makes a claim against you. Commercial property, business income, equipment breakdown and crime policies are all first-party. Liability policies are third-party, because they respond when someone else sues.

Cyber insurance is built on this split. The first-party side pays your own costs after an incident: forensic investigation, legal advice from a breach coach, notification and credit monitoring, data restoration, lost income during an outage, and negotiation and payment of an extortion demand. The third-party side pays defense and settlements when customers, partners or regulators come after you. One policy usually holds both, in separate insuring agreements that often carry their own sublimits and retentions.

Two details trip up buyers. First-party policies pay only what they list, so check the sublimit for ransomware and the waiting period before interruption loss begins. And there is no duty to defend: you must prove the loss, mitigate it and cooperate, typically through a sworn proof of loss. The guide on first-party vs third-party cyber coverage walks through the insuring agreements one by one.

Last reviewed October 10, 2026

In the index now

Related terms

Third-party coverage Insurance that pays defense costs and damages when an outsider, such as a customer, patient or regulator, makes a claim against the policyholder. Business income Property coverage that replaces net income and continuing operating expenses, including payroll, while a covered physical loss suspends operations. Cyber extortion A demand for payment backed by a threat to encrypt, destroy or publish your data or disrupt your systems, and the cyber policy coverage that responds to it. Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Breach coach A privacy attorney, usually from the cyber insurer's panel, who directs the first days of a data breach or ransomware response.

Related guides

Active assailant insurance: what it covers and what standard policies miss Active assailant policies pay for crisis response, lost income and liability after an armed attack that standard property and liability forms may not reach. How AI is changing commercial claims handling Where insurers use AI in commercial claims, what regulators expect from human review, and how to document and escalate a claim when software is involved. Aviation insurance for business aircraft owners and operators Aircraft hull and liability, why the CGL excludes aircraft, the pilot and use warranties that void claims, and what charter users and airport businesses need. Bailee coverage: insuring customers' property in your care Bailee's customers coverage pays for customers' property held for service or repair. Legal liability vs direct forms, the processing exclusion, valuation, gaps. System failure, cloud outages and the CrowdStrike lesson How cyber policies treat non-malicious outages and cloud failures, what the 2024 CrowdStrike and 2025 AWS outages showed, and which policy words decide payment. Commercial property insurance: what it covers and what it doesn't How the standard ISO commercial property policy works: covered property, causes of loss, built-in extensions and limits, valuation, and the gaps to close.

Related en español

Cómo presentar un reclamo de seguro para su negocio, paso a paso A quién avisar, qué le exige la póliza primero, qué documentos enviar y qué plazos debe cumplir la aseguradora una vez reportado el reclamo. Seguro de propiedad comercial: qué cubre y qué no Cómo funciona la póliza ISO estándar de propiedad comercial: bienes cubiertos, causas de pérdida, extensiones y sus límites, valuación y los huecos por cerrar.