Guides
Cyber insurance: what it covers for a business
What a cyber policy pays for after a breach, ransomware attack or email fraud, how limits and retentions work, and what the policy leaves out.
Cyber insurance pays for the cost of a computer-security event: the forensic investigators, lawyers and notification vendors you hire after a breach, the income you lose while systems are down, an extortion demand in a ransomware attack, and the claims that follow when someone else's data is exposed. There is no standard ISO form for it. Every carrier writes its own wording, so what you actually own depends on the coverage grants, the sublimits and the exclusions, not on the product name.
The two halves of a cyber policy
Think of the policy as two coverages stapled together. The first-party half reimburses your own losses and expenses: investigating the incident, restoring data, replacing lost income, paying a ransom where the law allows it. The third-party half defends and pays when customers, patients, partners or regulators come after you. The split matters because each half has its own limit, retention and conditions. first-party vs third-party cyber coverage walks through the differences in detail.
Most policies also bundle services. A claims hotline, a panel of forensic and legal vendors and a breach coach (usually a privacy attorney who directs the response) are often worth more in the first 48 hours than any single coverage line. Travelers says its policyholders get tools and resources both before and after a breach, and Coalition advertises a separate limit for breach response so that response costs do not use up the limit for other coverages.
Coverages you will see
Names vary by carrier, but the menu is fairly consistent.
| Coverage | What it typically pays for | What to check |
|---|---|---|
| Breach response | Forensic investigation, breach counsel, notification letters, call center, credit or identity monitoring, crisis communications | Separate limit or inside the aggregate; whether you must use the insurer's panel vendors |
| Business interruption and extra expense | Lost net income and continuing expenses while systems are down, plus the cost of getting running again | Waiting period (measured in hours), whether non-malicious system failure counts, whether a vendor's outage counts |
| Cyber extortion | Negotiator fees and, where lawful, the ransom itself | Ransomware sublimit or coinsurance; see ransomware and cyber insurance: how claims work |
| Data and system restoration | Rebuilding data, reinstalling software, sometimes replacing hardware rendered useless | Whether "betterment" (upgrades made while rebuilding) is covered |
| Funds transfer fraud and social engineering | Money wired to a criminal after a spoofed or hijacked instruction | Usually a small sublimit and a verification condition; see business email compromise and funds transfer fraud coverage |
| Privacy and network security liability | Defense and settlements when others sue over exposed data or a transmitted virus | Whether defense costs erode the limit; contractual liability carve-backs |
| Regulatory defense and penalties | Responding to a regulator's inquiry; fines and penalties where insurable by law | The words "where insurable"; which regulators are named |
| Payment card (PCI) costs | Assessments from card brands and processors | Often a sublimit; see payment card fines and assessments: does cyber insurance pay? |
| Media liability | Claims over website and social content (infringement, defamation) | Overlap with the personal and advertising injury part of your commercial general liability policy |
Travelers' CyberRisk page, for instance, lists forensic investigations, litigation expenses, regulatory defense and fines, crisis management, business interruption, cyber extortion and betterment. That is a typical set, not a universal one.
How the policy is built
Claims-made and reported. Almost every cyber form is a claims-made policy. The claim, or the discovery of the incident, must be reported while the policy is in force or in a short extended period. A retroactive date limits coverage for events before a certain day, and a breach that sat undetected for months can fall on the wrong side of it.
Retention. The retention is your deductible, and it often differs by coverage and by revenue band. Business interruption usually adds a time deductible on top.
Limits. A single aggregate for the whole policy is common. Some forms give breach response its own limit; some let defense costs reduce the limit. Read the limits page together with the sublimit schedule, because the headline "$1 million" can shrink to $100,000 for ransomware, funds transfer fraud or regulatory fines.
Consent and vendors. Most forms require the insurer's prior consent before you hire vendors or settle. Hiring your own IT firm the night of an attack, without calling the hotline, is a common way to create a dispute over who pays.
What a cyber policy usually does not cover
Exclusions differ, but several recur. common cyber insurance exclusions covers them in full; the short list:
- War and state-backed attacks, in wording that carriers have revised repeatedly in recent years (war and state-backed attack exclusions in cyber policies).
- Bodily injury and physical property damage, which belong to your liability and property policies.
- Failure of power, telecom or internet infrastructure outside your control, unless the form carves it back.
- Incidents you knew about before the policy began.
- Losses tied to security controls you represented on the application but did not maintain (the cyber insurance application: what underwriters ask and how to answer).
- Betterment, the value of trade secrets and future lost profits, unless specifically endorsed.
Why your other policies are not enough
Business owners often assume a general liability or property policy picks this up. The standard ISO commercial general liability form, CG 00 01, excludes damages arising out of loss of, damage to or inability to access electronic data, and ISO publishes endorsements that remove data-related liability further. On the property side, the ISO business income form CP 00 30 (10 12 edition) gives only $2,500 for interruption of computer operations. A commercial crime insurance: what it covers and what it excludes policy may respond to some funds transfer fraud but often not to the response costs. And if you sell technology services, Cyber insurance vs tech E&O: which policy pays when explains why your own cyber loss and your client's claim against you sit under different policies. Manuscript and carrier-specific forms differ, so check yours.
Standalone, primary, excess and endorsement
The NAIC's 2025 report on the cybersecurity insurance market, which uses 2024 data, shows how the market is built. Reporting changed that year from a standalone/package split to primary, excess and endorsement. Primary policies produced 65% of premium and 41.6% of the roughly 4.37 million policies reported by U.S.-domiciled insurers. Endorsements were 55.1% of policies but only 4% of premium. Many small businesses therefore own cyber as an endorsement to a business owner's policy, with a limit well below what a standalone policy offers. Total U.S. direct written premium was about $9.14 billion in 2024, down 7% from 2023, and nearly 50,000 claims were reported. The NAIC counted 28,555 claims closed without payment against 9,941 closed with payment. Those figures do not say why, but they are a reminder that reporting an incident and collecting on it are different things.
A hypothetical: ransomware at a small accounting firm
Say a 30-person accounting firm in the middle of tax season finds its file server encrypted and a ransom note on the screen. This is an illustration, not a typical claim.
- The managing partner calls the policy's incident hotline, not the firm's IT contractor. The insurer assigns a breach coach and a forensic firm.
- Forensics confirms how the attackers got in, whether client files were copied, and whether the backups are intact.
- The coach decides who must be notified under state breach laws (data breach notification laws and what they cost).
- If backups are usable, the firm restores and the data restoration and business interruption coverages pay the rebuild and the income lost after the waiting period.
- If they are not, a negotiator and counsel assess whether a payment is lawful (paying a ransom: sanctions risk and reporting rules).
- Months later, a client sues over the exposure of tax returns, and the third-party half responds, subject to the retention.
The firm's recovery depended on three things the policy form could not change: how recent its backups were, whether it reported promptly and whether it stayed within the panel.
Getting ready to buy
Underwriters price and accept cyber on controls: multi-factor authentication, backups, endpoint detection and patching. MFA, EDR and backups: the controls cyber insurers now require and what drives the cost of cyber insurance cover what they ask and how it moves price. The cyber insurance readiness checklist helps you gather the answers before the application arrives. For context on market direction, Marsh reported on July 23, 2026 that U.S. cyber rates fell 2% in the second quarter. Pricing still depends heavily on your own controls and revenue.
Key takeaways
- A cyber policy combines first-party coverage for your own response and income losses with third-party liability, on a carrier-specific form with no ISO standard.
- Limits, sublimits, retentions and panel-vendor rules decide what you collect. A headline limit means little until you read the schedule.
- General liability and property forms exclude or sharply limit data losses, so those policies are not a substitute.
- Call the policy hotline first after an incident, and report promptly, because the form is claims-made and usually conditions payment on the insurer's consent.
- Many small businesses carry cyber only as an endorsement; compare its limit to your realistic response and downtime costs.