First-party vs third-party cyber coverage

First-party cyber coverage pays for your own losses after an incident: investigators, lawyers, notification, data recovery, lost income and extortion. Third-party cyber coverage pays when someone else claims you caused them harm: customers whose data was exposed, a partner whose network you infected, a regulator, a card brand. A cyber policy usually contains both, but each part has its own trigger, its own limit and often its own retention, so a breach can start a first-party claim on day one and a third-party claim a year later.

The difference in one table

The vocabulary comes straight from general insurance: a first-party policy responds to loss of your own property or income, a third-party policy to your legal liability to others. The cyber market just packages both on one form.

What the first-party half covers

When something goes wrong, the order of events is predictable, and the Federal Trade Commission's data breach response guide describes it. It tells businesses to contain the breach without powering machines off before forensic experts arrive, to consider independent forensic investigators and outside privacy counsel, to notify law enforcement, regulators, affected businesses and individuals, and to consider offering at least a year of free credit monitoring when Social Security numbers or financial data are exposed.

Each step there is a bill, and the first-party coverage maps to it:

• Forensic investigation and breach counsel to find the cause and scope and to advise on notification duties.
• Notification and monitoring, covering letters, a call center and credit or identity monitoring. Every state, the District of Columbia and three territories have breach notification laws, according to the National Conference of State Legislatures, and the rules differ by state. See data breach notification laws and what they cost.
• Data and system restoration, including rebuilding databases and reinstalling software.
• Business interruption and extra expense, covered in cyber business interruption and dependent system failure, including outages at a vendor you depend on (dependent business interruption).
• Cyber extortion, the negotiator and, where lawful, the payment (ransomware and cyber insurance: how claims work).
• Funds transfer fraud and social engineering, usually the smallest sublimit on the policy (business email compromise and funds transfer fraud coverage).

First-party coverage is mostly about speed. The insurer's panel of vendors exists so that a forensic team can be on the call within hours, which is why most forms require you to use it or get consent first. The cost is a retention you pay before the insurer does, plus a waiting period before lost income is recognized.

What the third-party half covers

Third-party coverage starts when a claim arrives. Forms typically break it into several parts:

• Privacy liability. Suits by customers, patients or employees over exposed personal information, including class actions.
• Network security liability. Claims that your failure to secure your systems let an attacker harm someone else: malware passed to a client, a denial-of-service attack launched from your network, a compromised vendor portal.
• Regulatory proceedings. Defense costs and, where the law allows insurance for them, fines and penalties. Health data is the clearest example (HIPAA breaches and cyber insurance for healthcare providers), and state attorneys general and privacy regulators also act (state privacy laws and what they mean for business insurance).
• Payment card assessments. Contractual charges from card brands and processors. These are contract claims rather than tort claims, which is why the wording matters (payment card fines and assessments: does cyber insurance pay?).
• Media liability. Claims over content you publish online.

Three terms in this half drive outcomes. First, whether the insurer has a duty to defend or only reimburses defense costs. Second, whether defense costs sit inside the limit, so that every dollar of legal fees shrinks what is left to settle. Third, the consent-to-settle clause: some forms contain a hammer clause that caps what the insurer pays if you refuse a settlement it recommends.

Third-party claims also tend to arrive slowly. AM Best, summarized by Insurance Journal on June 30, 2026, said third-party cyber claims were trending up about 30% and typically have a longer tail than first-party losses.

Timing: why claims-made wording matters here

Nearly every cyber form is a claims-made policy. For the first-party half, the trigger is generally your discovery of the incident during the policy period. For the third-party half, it is the claim being made and reported during the policy period or an extended reporting period.

That gap creates a trap. Suppose you discover a breach in November and your policy expires in January. The lawsuit may arrive in September of the next year, after you have switched carriers or the old policy has lapsed. Most forms let you give a notice of claim of circumstances: a written notice during the policy period describing the incident and the claims you reasonably expect. If you give it, later claims arising from those facts attach to the policy that was in force at the time. If you do not, the new insurer will likely exclude them as a known prior incident. Ask your broker how your form handles this before you need it.

A hypothetical: a card-data breach at a small online retailer

Say a 40-person online retailer discovers that attackers placed code on its checkout page. The table shows which half of the policy responds at each stage; it is an illustration, not a typical claim.

The retailer had $2 million in total limits in this example. If breach response, legal fees for the class action and a card assessment all draw on one aggregate, the money may be gone before the lawsuit settles. That is why the structure of the limits, not the headline number, deserves the broker's attention.

Questions to ask before you buy

1. Does breach response have its own limit, or does it share the aggregate with liability?
2. Is the insurer obligated to defend, and do defense costs reduce the limit?
3. How does the form define the first-party trigger: discovery, or actual unauthorized access?
4. What is the business interruption waiting period, and does it cover a vendor's outage and non-malicious system failure?
5. Are regulatory fines and card assessments covered, and are they sublimited?
6. How does the policy treat a notice of circumstances, and what extended reporting period is available?
7. Does the contractual liability exclusion carve back for your payment-card and vendor agreements?

Key takeaways

• First-party coverage reimburses your own response costs, lost income and extortion payments; third-party coverage defends and pays claims others bring against you.
• The first-party half responds in days, the third-party half often a year or more later, so claims-made timing and notice of circumstances matter.
• Check whether breach response has a separate limit and whether defense costs erode the liability limit.
• Card assessments, regulatory fines and funds transfer fraud are the usual places for sublimits and gaps.
• Use the cyber insurance readiness checklist and cyber insurance: what it covers for a business to compare quotes line by line.