What Does Cyber Insurance Cover?

Cyber insurance covers the cascade of costs that follow a breach or cyberattack — and there are more of them than most owners expect. The policy splits into two halves: what it costs you to respond and recover (first-party), and what you owe others harmed by the incident (third-party). Knowing both halves is how you tell whether a policy actually matches your exposure.

First-party coverage: your own costs

These cover the direct costs to your business when you're hit:

Breach response and forensics. Specialists investigate what happened, what data was affected, and how to contain it. This is the first and often most urgent expense.

Notification costs. Most jurisdictions legally require notifying affected individuals after a data breach. For a sizable breach, the notification process alone is expensive. Data breach response guide.

Credit and identity monitoring. Providing affected individuals with monitoring services, often expected or required.

Business interruption. Lost income and extra expenses while your systems are down due to a cyber incident — increasingly important as businesses depend entirely on their systems.

Data restoration. The cost to recover or rebuild data and systems corrupted, deleted, or locked by an attack.

Cyber extortion / ransomware. Response costs for ransomware events, including negotiation, recovery, and (where applicable and permitted) ransom handling. Ransomware risks.

Third-party coverage: your liability to others

These cover what you owe people harmed by the breach:

Legal defense and settlements. When affected customers, partners, or others sue over exposed data or the incident, the policy covers your defense and any settlement or judgment.

Regulatory fines and penalties. Where insurable, fines from regulators for a data breach or privacy violation.

Liability for failure to protect data. Claims that your business failed to safeguard the information entrusted to it.

Cyber insurance vs general liability.

What cyber insurance typically does NOT cover

• Upgrading your security — it pays for the incident, not to improve your systems afterward (beyond restoration).
• Future lost profits beyond the covered interruption period.
• Intentional or fraudulent acts by the insured.
• Bodily injury and physical property damage — those remain general liability and property.
• Prior known incidents not disclosed.
• Failure to maintain required security controls — some policies condition coverage on basic safeguards being in place.

Why coverage varies so much

Cyber is a newer, fast-evolving line, and policies differ more than in mature lines like auto. Two "cyber" policies can cover meaningfully different things — one might include strong ransomware and business interruption coverage, another might sublimit them heavily. This is exactly why comparing coverage (not just price) matters more in cyber than almost anywhere else, and why a broker who understands the differences earns their value. How to compare quotes.

The analogy

Cyber coverage is like the response after a major plumbing failure floods an office. There's the immediate emergency crew (forensics and breach response), the cleanup and restoration (data recovery, business interruption), the notification to everyone affected (the building, neighbors, insurers), and the liability if the flood damaged a tenant's property (third-party claims). A policy that only paid for the emergency crew but not the cleanup or the liability would leave you badly exposed — which is why you check that a cyber policy covers the whole cascade, not just the first call. What is cyber liability.