What is cyber insurance?
Cyber insurance is a type of business insurance that covers your financial losses from cyber incidents like data breaches, ransomware attacks, system outages, and other digital disruptions. It's also known as "cyber liability insurance" or "cyber risk insurance."
In the US, cyber incidents are hitting businesses hard and consistently. The average cost of a data breach in the United States is $5.09 million — the highest globally — and 39% of American businesses experienced a cyber attack in 2024. For small and medium businesses, a single breach can be catastrophic. 60% of SMBs close within 6 months of an attack. Cyber insurance exists because many businesses can't absorb this financial shock alone.
Key point: Cyber insurance reimburses you for direct costs (forensic investigation, ransom negotiation, notification costs) and third-party claims (lawsuits from affected customers). You're buying protection for a type of liability and operational crisis, not a physical asset.
What does cyber insurance cover?
Most cyber insurance policies split coverage into two main categories: costs to YOUR business (first-party) and claims FROM OTHERS (third-party).
First-party coverage (costs to your business)
This covers direct costs you incur in response to a cyber incident:
- Incident response and forensic investigation — The cost of hiring experts to investigate the breach, determine what was compromised, and identify the attacker.
- Data recovery and restoration — Costs to recover lost or corrupted data and restore systems to normal operation.
- Business interruption losses — If your systems are down, you lose revenue. This covers the income you would have earned during the outage.
- Ransomware payments — Some policies reimburse ransom payments if you decide to pay. Note: US authorities increasingly advise against payment, and some payments may be subject to sanctions screening.
- Notification costs — All 50 US states require notification of individuals following a breach. Cyber insurance covers letters, email campaigns, and call center costs.
- Credit monitoring — Providing monitoring services to individuals affected by the breach (often 1-3 years).
- Public relations and crisis management — Costs to hire PR firms to manage reputational damage and public communication.
Third-party coverage (claims from others)
This covers legal claims and regulatory action arising from the incident:
- Regulatory defence and fines — Defence costs if you face investigations by US regulators (state AGs, FTC, SEC). Covers fines and penalties up to specified limits based on your jurisdiction and industry.
- Legal defence costs — Attorneys to defend you against lawsuits from affected customers or partners.
- Settlements and judgments — Compensation you're ordered to pay to affected parties after losing a lawsuit.
- HIPAA penalties and defence — If you're a healthcare provider or business associate, coverage for HIPAA investigation, fines, and breach notification costs.
- PCI DSS fines — If you process card payments and suffer a breach, payment networks may fine you. Cyber insurance can cover these.
- Media liability claims — Claims that your business defamed someone or invaded privacy through your digital systems or online presence.
Most policies come with coverage limits (e.g., $1 million total), deductibles (you pay the first $10,000 of any claim), and sub-limits (e.g., ransomware covered up to $500,000, even if total limit is $1 million).
What doesn't cyber insurance cover?
Insurance is defined as much by what it excludes as by what it includes. Here are the most common cyber insurance exclusions:
- Acts of war or nation-state attacks — Most policies exclude attacks by governments or military forces. This "war exclusion" is standard across insurance.
- Unpatched known vulnerabilities — If a security patch was available and you didn't apply it, the insurer may deny claims from attacks exploiting that specific vulnerability.
- Bodily injury or property damage — Cyber insurance covers digital losses. If a cyber attack leads to physical harm, that's typically covered by your general liability policy, not cyber.
- Long-term reputational damage — Cyber insurance covers short-term crisis costs (PR, notification). Permanent loss of customer trust or market share isn't covered.
- Loss of future revenue — Business interruption covers revenue lost during the incident. It doesn't cover future lost business due to reputational harm.
- Prior known claims — If you knew about a potential claim before buying the policy, it's excluded.
- Voluntary shutdowns — If you choose to shut down your systems without insurer approval, resulting losses may not be covered.
- Social engineering (sometimes) — Some policies exclude or heavily sub-limit losses from social engineering attacks (e.g., CEO fraud). Check your policy carefully.
Read the fine print: Exclusions vary significantly between insurers. A breach that one insurer covers, another may exclude. Always ask your broker to highlight exclusions relevant to your business and state.
How does a cyber insurance claim work?
Step 1: Incident occurs — You discover a breach, system outage, or suspected attack.
Step 2: Contact insurer immediately — Call your insurer's claims hotline right away. Most US policies require prompt notification. Delaying notification may void coverage.
Step 3: Insurer appoints incident response team — The insurer will typically have a preferred team of forensic experts, legal counsel, and PR firms. Some policies let you choose your own; others require you to use the insurer's panel. The insurer pays the IR team directly.
Step 4: Containment and investigation — The IR team stops the attack (if ongoing), investigates what happened, identifies what data was compromised, and documents findings.
Step 5: Claim assessment — The insurer reviews the incident and IR findings to determine what's covered under your policy. They'll assess whether exclusions apply, whether costs are reasonable, and whether the claim is within coverage limits and deductibles.
Step 6: Payout — Once approved, the insurer reimburses you for covered costs or pays vendors directly.
Important: Good cyber insurance policies don't just provide money—they provide people. Your policy includes access to forensic investigators, legal counsel familiar with breach notification law, and PR specialists. These are often more valuable than the dollar payout because they know how to handle incidents efficiently and protect you from regulatory action.
US regulatory landscape
The US operates under a patchwork regulatory framework where cyber insurance is influenced by federal, state, and industry-level requirements. All 50 states have data breach notification laws requiring notification to affected individuals within specific timeframes. HIPAA (healthcare), SEC disclosure rules (public companies), state regulations like California's CCPA/CPRA and New York's NYDFS cybersecurity requirements, and PCI DSS (payment processing) all drive up cyber insurance costs. Cyber insurance helps cover defence costs and fines from these varied requirements.