Guides
Common cyber insurance exclusions
The cyber policy exclusions that matter most, from prior knowledge and war to infrastructure, contracts and web tracking, and the carve-backs that help.
Cyber policy exclusions fall into four groups: losses other policies are meant to cover (bodily injury, property damage, employment claims), conduct the insurer will not underwrite (known problems, intentional acts, war), events too big or too correlated to price (infrastructure failure, widespread attacks), and risks the insurer wants you to control (unpatched software, ransomware). There is no ISO standard form, so the wording differs by carrier. The skill is reading each exclusion together with its exceptions, because the carve-backs often decide whether you are covered.
How to read the exclusions
Cyber policies are built in layers: insuring agreements, definitions, exclusions, exceptions to the exclusions, then conditions. A loss has to clear every layer. Three habits help.
- Read the definitions the exclusion uses. An exclusion for "Infrastructure" means little until you read what the policy says Infrastructure is.
- Look for "arising out of." Wording that excludes anything based upon, arising out of or attributable to a subject is broad. Phrases that apply only to a specific coverage part, or only after a court finding, are narrower.
- Check the schedule. Many of the limits that behave like exclusions are not in the exclusions section at all. They appear as sublimits, coinsurance percentages and endorsements on the declarations (sublimit).
To see real wording, this guide uses Chubb's publicly posted Cyber Enterprise Risk Management Version 2.2 policy documents (UK form 01/22). That is an international wording governed by English law that does not apply to claims brought in the United States or Canada, so it illustrates structure, not what a U.S. policy says. Your own form controls.
The common exclusions, with the usual exceptions
| Exclusion | What it does | Watch for |
|---|---|---|
| Prior knowledge and prior or pending proceedings | Removes claims from wrongful acts the control group knew about before the policy began, and from litigation already pending | The retroactive date and the application's warranty questions; see the cyber insurance application: what underwriters ask and how to answer |
| Intentional or dishonest acts | Removes losses from criminal, fraudulent or knowingly illegal conduct | Whether it applies only after final adjudication or an admission, and whether one executive's conduct is imputed to the company |
| Bodily injury and property damage | Leaves physical harm to your property and liability forms | Whether any limited coverage is added back for harm caused by a security failure |
| War and state-backed attack | Removes losses from war, and in many forms from cyber operations by or for a state | war and state-backed attack exclusions in cyber policies explains attribution tests and "major detrimental impact" language |
| Infrastructure failure | Removes power, telecom, internet and similar outages outside your control | Where the form draws the line between infrastructure and cloud services |
| Contractual liability | Removes liability you assumed by contract, warranty or guarantee | The carve-backs for liability you would have anyway, indemnities to clients for their data, and card brand assessments |
| Insured versus insured | Removes claims by one insured against another | Carve-backs for employee privacy claims |
| Employment practices and discrimination | Leaves these to an employment practices liability policy | Narrow exceptions for employee data breaches |
| Intellectual property, patents and trade secrets | Removes infringement and misappropriation claims | Media liability sections often restore copyright and trademark claims for content |
| Fines and penalties | Pays regulatory fines only where the law allows insurance for them | "Where insurable" language and sublimits |
| Wear and tear, betterment | Does not pay to upgrade systems beyond what you had | An endorsement for betterment costs |
| Government seizure or shutdown | Removes loss from authorities confiscating systems or ordering closure | Carve-back when the order responds to an attack on your system |
The Chubb form is a handy example of several. Its prior knowledge exclusion looks to what a member of the "Control Group" knew or could have foreseen. Its conduct exclusion applies only where the conduct has been established by a final court judgment after appeals are exhausted, or by written admission, which means defense continues until a court finds intentional wrongdoing. And its contract exclusion preserves coverage for liability you would have had without the contract, for an indemnity to a client about the client's customers' personal data, and for payment card loss. payment card fines and assessments: does cyber insurance pay? explains that last carve-back.
An exclusion read line by line: infrastructure
Chubb's exclusion 4.9 removes claims arising out of any failure, interruption, degradation or outage of Infrastructure, in the broad "arising out of" style described above. Definition 3.30 says Infrastructure means any of these, operated or supplied by a third party: electricity, gas, fuel, energy, water, telecommunications or other utility; internet infrastructure including DNS, a certificate authority or an internet service provider; satellite; or a financial transaction or payment platform. Separately, the form defines a "Shared Computer System" as systems run by a third party for cloud hosting, SaaS and similar services, and says that term does not include Infrastructure.
What does this mean in practice? If your cloud host fails, you are on the covered side of the line. If your ISP, DNS provider or a payment network fails, you are on the excluded side. Another major carrier draws the line differently. Beazley's FAQ on its 2023 wordings says its infrastructure exclusion reaches the backbone components of internet and communications networks and that internet service providers and cloud service providers are not listed in its definition. Two carriers, two lines. System failure, cloud outages and the CrowdStrike lesson explains why this matters when a provider goes down.
Newer exclusions and limits that act like them
Carriers have added terms that are not exclusions in the strict sense but limit what you collect.
- Widespread events. Chubb's October 2021 product sheet describes a Widespread Events endorsement that sorts incidents into limited-impact events and widespread events, such as software supply chain or zero-day exploits, with its own limits, retentions and coinsurance. Beazley's 2023 FAQ describes a catastrophic cyber event endorsement that applies a 50% sublimit to first-party loss for stand-alone cyber insureds with revenue under 100 million (dollars, euros or pounds) in two scenarios: a cloud provider outage exceeding 72 hours, or contagion malware in an operating system with a major detrimental impact on a state. Those documents are older, and current wording may differ. The wider market debate is in systemic cyber risk and cyber catastrophe bonds.
- Neglected software. Chubb's product sheet describes a 45-day grace period to patch published vulnerabilities, after which the policyholder takes on progressively more of the risk at the 46-, 90-, 180- and 365-day points. If your IT team cannot patch quickly, this clause changes your exposure more than any exclusion.
- Ransomware coinsurance and sublimits. A form can cover ransomware but pay only a percentage or a smaller limit. See ransomware sublimits and coinsurance in cyber policies.
- Web tracking and wrongful collection. Bloomberg Government reported on September 11, 2025 that insurance attorneys saw cyber insurers adding exclusions for web tracking claims and, in some cases, requiring a "cyber event" instead of a broader "privacy breach" as the trigger. Coalition's November 5, 2025 research said 77% of the wrongful collection claims reported to it traced back to tracking tools embedded on websites. If your website runs advertising pixels or session replay, ask what your form says. Biometric claims are a related issue (Biometric privacy (BIPA) lawsuits and insurance).
- Professional services. A cyber policy may exclude liability arising from the technology services you sell. A software or IT firm needs the carve-backs described in Cyber insurance vs tech E&O: which policy pays when.
Conditions that behave like exclusions
Not every denial comes from the exclusions section. A claim can fail because notice was late, because you hired a vendor without consent, or because the application misdescribed your controls (insurance applications: why accuracy matters and what misrepresentation costs). If the application says multi-factor authentication covers all remote access and the investigation shows one unprotected account, expect a coverage question. Keep a record of the controls you described, and update the carrier when they change.
A hypothetical: reading a quote
Say a 35-person design firm with a public website receives a quote with a $1 million limit. The broker's summary says "ransomware covered," but the schedule shows a $250,000 ransomware sublimit with 25% coinsurance, a widespread event sublimit of $500,000 and a web tracking exclusion. The firm uses advertising pixels, has a payment page on its site and relies on a hosted accounting system. This is invented to show the process.
- Ask the broker to price removal of the tracking exclusion or confirm what the pixels expose.
- Check the widespread event definition against the hosted accounting vendor.
- Compare the ransomware terms to what a week of downtime costs, using cyber business interruption and dependent system failure.
- Confirm the contract exclusion preserves card brand assessments for the payment page.
The first quote looks like $1 million of cover. After the schedule, the realistic ransomware recovery is closer to a quarter of that, less coinsurance.
Key takeaways
- Read each exclusion with its definitions and exceptions. The carve-backs often decide coverage.
- Sublimits, coinsurance and endorsements on the schedule limit recovery as much as the exclusions section.
- Exclusions that matter most to small and mid-size businesses today are infrastructure failure, contractual liability, ransomware terms, neglected software and web tracking.
- Different carriers draw lines in different places, so compare wording on infrastructure, widespread events and contracts, not just price.
- Keep your application answers accurate and your controls current, since broken warranties can defeat a claim without an exclusion applying.