Cyber exclusions tell your insured which digital losses the carrier will not pay, even when the policy carries a cyber name. The most common ones remove war and state-backed attacks, fraudulent funds transfers, fines that are uninsurable by law, contractual liability, prior known incidents, and losses tied to security measures the insured said it had but did not. For agents, CSRs, and account managers, the job is to find these exclusions before a claim does, explain them in plain terms, and document the conversation.
Many cyber insurance policies have broadened their insuring agreements over the past decade, but wording still varies widely from carrier to carrier. Two forms with the same limit can respond very differently to the same incident. That is why exclusion review belongs in every cyber placement and renewal.
What Does Cyber Insurance Cover?
Before you can explain an exclusion, you need a clear picture of the coverage it takes away from. Most standalone cyber forms respond to data breaches and network attacks by combining first-party insurance for the insured's own costs with third-party liability for claims brought by others. Exact insuring agreements depend on the carrier, so treat the list below as typical rather than standard.
- First-party costs: forensic investigation, data breach response (notification, call centers, credit monitoring), data restoration, cyber extortion and lost income after a covered system outage.
- Third-party liability: defense and damages for third-party liability claims alleging a privacy breach, failure to protect data, or transmission of malware.
- Regulatory defense: costs to respond to a regulator's investigation, and in some forms, insurable fines.
- Optional extensions: social engineering, invoice manipulation, system failure, dependent business interruption and hardware replacement ("bricking").
Many insureds assume a cyber liability insurance form covers every technology problem. It does not. A cyber policy responds to defined events, usually a security failure or privacy event, and the exclusions section narrows those events further. Asking "what does cyber insurance not cover" early in the sales conversation prevents most surprises later.
Common Exclusions in a Cyber Insurance Policy
Every cyber form reads differently, but most forms share the same exclusion themes. Review each of these against your insured's operations:
- Prior knowledge and the retroactive date. Incidents the insured knew about before binding, and acts before the retroactive date, are typically excluded. A client switching carriers or buying cyber for the first time may have no coverage for a breach that started months earlier.
- Contractual liability. Liability the insured assumed by contract, such as indemnity owed to a client, is usually excluded unless the insured would have been liable without the contract. Payment card industry assessments are a common exception handled by a separate insuring agreement.
- Intentional and dishonest acts. Fraudulent or criminal acts committed by the insured are excluded. Many forms preserve coverage for innocent insureds when a rogue employee causes the loss.
- Bodily injury and property damage. These belong in general liability and property policies, and their absence can create a gap when a cyber event damages hardware.
- Infrastructure failure. Outages of power, internet, or telecommunications providers outside the insured's control are commonly excluded.
- Intellectual property. Patent infringement and trade secret theft are often excluded or sharply limited, leaving those exposures to specialty products.
- Wrongful data collection. Newer forms exclude claims arising from tracking pixels, cookies, and similar web tracking tools that allegedly violate privacy laws.
Regulatory fines and penalties deserve a separate conversation. Policies usually pay them only "where insurable by law," and insurability depends on the jurisdiction and the type of penalty. Punitive fines are often uninsurable. Clients that handle personal data across several states or countries should involve legal counsel to understand which penalties a policy can actually pay.
The Cyber Insurance War Exclusion
This exclusion is one of the most debated clauses in the market. Traditional war exclusions were written for physical conflict. Insurers have since rewritten them to address cyber operations by nation-states, and the wording now differs widely from carrier to carrier.
The practical problem is attribution. Determining whether a ransomware group is a criminal gang or a state proxy can take months of forensic work, and the answer may never be certain. Read how the clause defines a state-backed attack, who decides attribution, and whether it carves back coverage for insureds that are collateral victims rather than the intended target. Clients in critical infrastructure or with government contracts should get special attention here.
Social Engineering and Disputed Cyber Insurance Claims
Social engineering fraud is a frequent source of claim disputes. In a typical business email compromise, an employee receives a convincing email from a spoofed vendor and wires payment to the criminal's account. Because the employee sent the money voluntarily, many forms exclude the loss unless a social engineering or funds transfer endorsement applies, often with a low sublimit.
Coverage may also sit in the client's crime insurance policy. Compare both forms, check whether either requires a callback verification procedure, and confirm which policy responds first. Overlapping "other insurance" clauses can stall a claim while the carriers sort out priority.
Business interruption coverage also generates disputes. Lost income usually begins only after a waiting period measured in hours, and some forms pay only when a security event caused the outage. A failed software update rollout or simple human error falls outside coverage unless system failure coverage was added.
How Cyber Insurance Requirements Narrow Coverage
Carriers now treat security controls as conditions of coverage, not just rating factors. The cyber insurance application asks whether the insured uses multifactor authentication for email and remote access, endpoint protection on every device, regular offline backups, and a written incident response plan. Underwriters also ask about patch management, vulnerability management, and employee phishing training.
The answers matter after a loss. Some forms contain a failure to maintain security exclusion, and a materially false answer can give the carrier grounds to deny the claim or rescind the policy. If an application says multifactor protection is in place everywhere and an incident starts on an unprotected server, the insured has a problem the exclusions page never mentions.
Cyber insurance underwriting also rewards preparation. A client with tested backup procedures and a practiced cyber incident response team is easier to place and may qualify for broader terms. Encourage clients to have their IT provider review the application before they sign it, not after.
Where Cyber Insurance Coverage Meets Other Policies
Exclusions rarely act alone. When a cyber form excludes a loss, insureds often assume another policy will pick it up, and frequently none does. The table below shows where the most common cyber insurance gaps tend to appear.
| Exposure | Where coverage may sit | Watch for |
|---|---|---|
| Damage to electronic data | Cyber policy | Property and general liability forms that exclude or sharply limit electronic data. |
| Fraudulent wire transfer | Cyber endorsement or crime policy | Voluntary parting exclusions and low sublimits |
| Breach at a vendor | Cyber policy with dependent business interruption | Coverage limited to named or IT providers |
| Bricked hardware | Cyber hardware replacement extension | Property exclusions for electronic data and malware |
| Privacy lawsuit from tracking tools | Cyber liability | Wrongful collection exclusions |
General liability forms typically define electronic data out of property damage, and many carriers attach data breach exclusion endorsements. Property forms often limit electronic data to a small additional coverage. Those limitations make the cyber form the primary source of protection, so each exclusion matters more.
Third-party vendors deserve their own review. Ask which cloud, payroll, and software providers the client relies on, and confirm whether the policy covers lost income when one of those vendors suffers an outage. Some forms cover only IT providers named on a schedule.
Running a Cyber Insurance Review With Your Insured
A structured review helps clients understand their cyber insurance terms and reduces errors and omissions exposure for your agency. Use these steps at every new placement and renewal:
- Read the exclusions and definitions sections line by line, including every endorsement that adds or removes coverage.
- Compare the application answers with the client's actual controls, and correct anything that is out of date before binding.
- List each sublimit, waiting period, and retention next to the full limit so the client sees what will actually be paid.
- Map funds transfer, data, hardware, and vendor exposures against the crime, property, and liability policies.
- Summarize the key exclusions in writing, have the client acknowledge them, and keep the summary in the file.
Hypothetical example: A dental group renews its cyber policy without updating the application, which still says every remote login requires a second verification factor. A former vendor's account without that protection is used to launch an attack that locks the practice management system. The carrier reserves its rights over the misstatement. A review that caught the outdated answer would have let the agency correct the application or help the client close the gap before renewal.
This kind of review fits naturally into your broader risk management conversations and strengthens the client's cyber risk management. It turns a long list of policy exclusions into specific decisions the client can make, whether that means adding an endorsement, tightening a control, or accepting a gap knowingly.
Cyber insurance buyers increasingly expect their agent or cyber insurance broker to explain these choices clearly. As the cyber insurance market keeps revising forms, schedule a fresh review every year rather than assuming last year's wording still applies.
Frequently Asked Questions
Does cyber insurance cover ransom payments?
Many cyber forms include cyber extortion coverage that can reimburse a ransom payment, usually with the carrier's prior consent. The insuring agreement may also cover negotiators and recovery costs. Payments to sanctioned parties can violate federal law, so carriers review each demand carefully. Ransomware attacks also trigger forensic, restoration, and business interruption costs that fall under other insuring agreements, each with its own conditions and sublimits.
Does a cyber policy pay regulatory fines?
Sometimes. Many policies cover regulatory fines only where they are insurable under the governing law, and insurability varies by jurisdiction and type of penalty. Punitive fines are often uninsurable. Regulatory defense costs are more commonly covered than the fines themselves. Clients subject to privacy laws in several states or countries should have counsel review how the fines wording applies to their operations.
What is the contractual liability exclusion in a cyber policy?
The contractual liability exclusion removes liability the insured took on solely by contract, such as a promise to indemnify a client for any data loss. If the insured would have been legally liable without the contract, coverage usually remains. Review client contracts alongside the policy so that indemnity promises do not outrun the cyber limits or the coverage grant.
What are web tracking exclusions?
Web tracking exclusions remove coverage for claims alleging that the insured collected personal data without proper consent, often through cookies, tracking pixels, session replay, or analytics tools. These claims have grown under various privacy statutes, so some carriers now exclude them or offer coverage at a sublimit. Ask clients what tracking tools their websites use before you assume a privacy claim is covered.
Does cyber coverage apply when a vendor is breached?
It depends on the form. Liability for a vendor's breach of your client's data may be covered under a cyber liability insurance policy if your client remains legally responsible for that data. Lost income from a vendor outage requires a dependent business interruption extension, which some policies limit to named IT providers. Confirm which outside providers qualify and whether the waiting period and sublimit fit the client's reliance on them.
