What is cyber insurance?
Cyber insurance, also called cyber liability insurance, covers the financial consequences of security incidents and data breaches. In exchange for a premium, the insurer pays defined costs after a covered event, up to the policy's limits and above its deductible, which cyber policies usually call the retention. In risk management terms it is the standard example of risk transfer: it moves part of a risk's financial impact to another party. It doesn't make an attack less likely, shorten an outage or move accountability for the organization's data to anyone else.
What policies typically cover
Coverage is usually split into two parts.
- First-party coverage pays the organization's own costs: forensic investigation, advice from breach counsel, notifying affected people and offering credit monitoring, restoring data and systems, income lost during a business interruption, public relations and cyber extortion, which can include ransom payments where they are lawful.
- Third-party coverage pays for claims against the organization: lawsuits from customers or partners whose data was exposed, regulatory investigations and, where the law allows them to be insured, fines and penalties, plus payment card assessments after a card data breach.
Policies vary widely, and sublimits often cap items such as ransomware or social engineering fraud well below the headline limit. Coverage terms belong in the incident response plan, because many policies require prompt notice to the insurer and the use of pre-approved forensic firms and law firms.
Underwriting and required controls
Insurers price and accept risk based on what the applicant tells them and what they can see from outside, such as exposed services found by external scans. After heavy ransomware losses, many insurers made certain controls a condition of coverage:
- MFA for email, remote access and privileged accounts
- EDR on endpoints and servers
- Offline or immutable backups that are tested
- Prompt patching, especially of internet-facing systems
- Security awareness and phishing training
- Privileged access management and locked-down remote desktop access
The application is a set of attestations. If the organization claims MFA everywhere and investigators later find a server without it, the insurer may reduce or deny the claim, or try to rescind the policy for misrepresentation. Answering the questionnaire accurately is a security task, not just paperwork.
Common exclusions
- Incidents that began before the policy's retroactive date or were already known when it was bought.
- War and state-backed attacks. Disputes after the 2017 NotPetya attack over whether war exclusions applied to a state-attributed cyberattack led many insurers to spell these exclusions out, and the Lloyd's market has required its standalone cyber policies to carry a state-backed attack exclusion since March 2023.
- Failures of infrastructure the organization doesn't control, such as power grids or internet backbones.
- Betterment, meaning upgrades beyond restoring systems to their previous state.
- Bodily injury and property damage, which other policies normally cover.
Paying a ransom can also break sanctions laws if the recipient is a sanctioned group, and the US Treasury's sanctions office has warned both victims and the firms that help them, insurers included, about that exposure.
Cyber insurance vs. other treatments
- Mitigation lowers likelihood or impact with controls. Insurance changes who pays, not what happens, although the controls insurers require are mitigations in their own right.
- Acceptance still applies to the retention and to anything above the limit, which the organization carries itself.
- Outsourcing transfers work to a provider; insurance transfers money.
Cyber insurance on the CompTIA Security+ exam
Cyber insurance is the textbook example of the transfer treatment in SY0-801 objective 5.2. When a scenario says an organization bought a policy to cover breach costs, the answer is transfer, not mitigation or acceptance, because the attack is no more or less likely afterward. A related trap asks who remains accountable after a breach: insurance shifts cost, but the organization still owns its data and its notification duties. Insurance also belongs in incident preparation under objective 4.7, where the insurer's notice requirements and approved response firms should already be written into the incident response plan.