A ransomware attack shuts down your operations for a week.
A data breach exposes thousands of customer records. An employee falls for a phishing email and wires $200,000 to a fraudulent account. A vendor’s compromised software infects your network.
These are not hypothetical scenarios. They are happening to businesses of every size, in every industry, every day. IBM’s 2024 Cost of a Data Breach Report notes that the global average cost of a data breach reached over $4.8 million, representing a 10% increase from the prior year and “the biggest jump since the pandemic.” Driving this increase were rising costs associated with lost business and post-breach response costs. Close to half of all breaches involved the personally identifiable information (PII) of customers, like tax identification numbers, emails, phone numbers, and home addresses, with intellectual property (IP) records coming in at over 40%.
Cyber insurance has emerged as an essential tool for managing these risks. But unlike more established lines of insurance, such as commercial general liability, property, and professional liability, to name a few, cyber insurance is still a relatively new and developing product with coverage varying dramatically from carrier to carrier. And the gap between what business owners think their cyber policy covers and what it actually covers can be dangerously wide.
North Carolina has taken recent steps to recognize the growing importance of this coverage. In 2025, the General Assembly enacted HB 737. Among other things, it added cybersecurity insurance as a covered policy type under the NC Insurance Guaranty Association Act. This means that if a regulated insurer that issued your cyber policy becomes insolvent, the Guaranty Association may provide a limited safety net for your first- and third-party cyber losses. It is a welcome development, but it underscores a more basic point: you need to understand what your cyber policy covers before the incident occurs.
This article breaks down the key components of a cyber insurance policy, identifies the most common exclusions and pitfalls, and provides practical guidance for business policyholders navigating this rapidly evolving coverage landscape.
The Two Sides of Cyber Coverage: First-Party and Third-Party
Cyber insurance policies generally provide two broad categories of coverage, and understanding the distinction between them is critical.
First-Party Coverage: Your Own Losses
First-party coverage pays for losses your business incurs directly as a result of a cyber incident. This is the coverage that helps you respond to and recover from the event. Typical first-party coverages include:
- Breach response costs. This is often the most immediately valuable coverage. It pays for the costs of investigating the incident, identifying what data was compromised, engaging forensic experts, and complying with breach notification laws. North Carolina requires businesses to notify affected individuals “without unreasonable delay” when certain personal information is compromised, and the costs of notification, including credit monitoring services, can be substantial.
- Business interruption. If a cyber incident forces your business to suspend or reduce operations, business interruption coverage reimburses you for lost income and continuing fixed expenses during the period of interruption. This coverage parallels the business interruption provisions in traditional property policies, but it is triggered by a cyber event rather than physical damage. Given that business interruption often accounts for substantial ransomware claim costs, this is one of the most important and most scrutinized components of a cyber policy.
- Data restoration. This coverage pays for the cost of restoring, recreating, or recovering data and software that has been damaged, destroyed, or encrypted in a cyber attack. If your systems are hit by ransomware and your backups are inadequate, data restoration costs can be enormous.
- Cyber extortion/ransomware. Most cyber policies provide some coverage for ransom payments and related negotiation costs. However, this is one of the most rapidly changing areas of cyber insurance. Many carriers now impose ransomware sublimits, meaning the maximum the policy will pay for a ransomware event may be significantly lower than the overall policy limit. Some carriers also impose conditions, such as requiring the policyholder to use a carrier-approved negotiator or to obtain the carrier’s consent before paying a ransom.
- Funds transfer fraud. Some cyber policies include coverage for losses resulting from the fraudulent transfer of funds, such as when an employee is tricked into wiring money to a fraudulent account through a business email compromise scheme. This coverage is sometimes provided under the cyber policy, sometimes under a separate crime or fidelity policy, and sometimes not covered at all. The overlap (or gap) between cyber and crime policies in this area is one of the most common sources of coverage disputes.
Third-Party Coverage: Claims Against You
Third-party coverage pays for your liability to others arising from a cyber incident. It responds when someone else, such as a customer, a business partner, or a regulatory agency, makes a claim against you. Typical third-party coverages include:
- Privacy liability. If your business experiences a data breach and affected individuals or entities bring claims against you for the unauthorized disclosure of their personal information, privacy liability coverage pays for defense costs and damages.
- Regulatory defense and penalties. Data privacy regulations, including North Carolina’s Identity Theft Protection Act, the federal Health Insurance Portability and Accountability Act (HIPAA), and an increasing number of state privacy laws, can result in investigations and penalties when businesses fail to protect personal data. Regulatory coverage pays for the cost of defending against regulatory investigations and, in some cases, for fines and penalties (though coverage for penalties is subject to significant limitations and varies by jurisdiction).
- Network security liability. If your compromised network is used to attack a third party, network security liability coverage responds to claims brought against you for the resulting damage. An example would be if malware spreads from your systems to a customer’s or vendor’s systems.
- Media liability. Some cyber policies include coverage for claims arising from the policyholder’s online content, including defamation, copyright infringement, and invasion of privacy.
What Your Cyber Policy Likely Does Not Cover
Understanding what is excluded is just as important as understanding what is covered. The following are common exclusions and limitations in cyber policies that frequently surprise policyholders:
- Acts of war and state-sponsored attacks. Virtually all cyber policies contain a “war exclusion” that excludes losses arising from acts of war. As state-sponsored cyber attacks have become more common and more destructive, insurers have refined and expanded these exclusions. Some policies now include specific “cyber war” or “hostile cyber activity” exclusions that may apply even when the attack is not part of a declared armed conflict. For businesses, this means that a devastating cyber attack may be excluded if the insurer can attribute it to a nation-state actor.
- Systemic and catastrophic event exclusions. Insurers are increasingly concerned about “accumulation risk” the possibility that a single event, such as a major cloud provider outage or a supply chain attack, could trigger claims from thousands of policyholders simultaneously. Some policies now include exclusions or sublimits for “systemic” or “widespread” events that affect large numbers of insureds.
- Prior known events. Cyber policies are typically “claims-made” policies, meaning they cover claims first made during the policy period. Most also contain a “prior knowledge” or “prior acts” exclusion that denies coverage if the policyholder was aware of the circumstances that gave rise to the claim before the policy’s inception date. Businesses that are aware of a vulnerability or a prior incident at the time they purchase or renew a cyber policy risk having a subsequent claim denied on this basis.
- Failure to maintain minimum security standards. Many cyber policies are underwritten based on the policyholder’s representations about its cybersecurity posture, including whether it uses multi-factor authentication, maintains offline backups, conducts employee training, and follows established security frameworks. If the policyholder fails to maintain the security standards it represented in the application, the insurer may deny a claim on the basis of a material misrepresentation. Insurers are increasingly moving toward continuous monitoring of policyholders’ security posture, making this a live and evolving issue.
- Regulatory fines and penalties (in some jurisdictions). Whether cyber insurance can legally cover regulatory fines and penalties varies by jurisdiction and by the nature of the fine. Some states prohibit insurance coverage for penalties, on public policy grounds, while others allow it. Policyholders should not assume that their cyber policy will cover all fines and penalties without reviewing the specific policy language and the applicable law.
- Bodily injury and property damage. Cyber policies generally exclude coverage for bodily injury and tangible property damage. If a cyber attack causes physical harm — for example, by disabling safety systems in a manufacturing plant or a medical device — the resulting bodily injury or property damage claims would typically need to be addressed under the policyholder’s CGL or other liability policies, not the cyber policy. The intersection of cyber risk and physical harm is a growing area of concern, particularly for businesses in manufacturing, healthcare, and critical infrastructure.
Practical Steps for Business Policyholders
1. Read Your Policy
Read the full policy, including all endorsements, sublimits, conditions, and exclusions. If you do not understand the policy language, engage experienced insurance coverage counsel to review it.
2. Understand the Interplay Between Your Cyber Policy and Your Other Policies
Cyber risk does not fit neatly into a single policy. Losses from a cyber event may implicate your cyber policy, your CGL policy, your property policy, your crime/fidelity policy, your professional liability policy, and your D&O policy. Coverage for the same event may be available under multiple policies, or it may fall into a gap between policies. Understanding where these overlaps and gaps exist is essential to maximizing your protection.
3. Pay Attention to Sublimits
A cyber policy with a $5 million aggregate limit may have a $500,000 sublimit for ransomware, a $250,000 sublimit for funds transfer fraud, and a $1 million sublimit for business interruption. The sublimits, not the aggregate limit, are what matter most often when a claim arises. Review all sublimits and assess whether they are adequate for your business’s risk profile.
4. Comply with Your Application Representations
The cybersecurity measures you represented in your insurance application are not just underwriting criteria they may become conditions of coverage. If you represented that you use multi-factor authentication across all systems and you do not, you are creating a basis for the insurer to deny a claim. Treat your application representations as ongoing obligations.
5. Have an Incident Response Plan and Make Sure Your Policy Supports It
Most cyber carriers provide access to a panel of pre-approved breach response vendors like forensic firms, breach notification companies, public relations consultants, and legal counsel. Using these panel vendors can streamline the claims process and may be required by the policy. However, policyholders should understand who these vendors are and whether they will serve the policyholder’s interests effectively. In some cases, policyholders may prefer to use their own trusted advisors and should negotiate that flexibility into the policy at the time of purchase or renewal.
6. Review and Update Your Coverage Annually
Cyber risk is not static. Your business’s technology environment, data holdings, regulatory obligations, and threat exposure change constantly. A cyber policy purchased two years ago may not address the risks your business faces today. An annual review is essential.
Ward and Smith’s Insurance Counseling and Recovery Team helps business policyholders navigate the complexities of cyber insurance coverage from policy review and gap analysis to claims advocacy and coverage litigation. Our Data Privacy and Security practice complements this work by advising clients on cybersecurity compliance, data breach response, and regulatory obligations. Together, these practices provide comprehensive counsel for businesses managing cyber risk.
