Cyber Insurance exclusions vary significantly between insurers.

The policy wording should always be reviewed because an exclusion under one policy may be covered, restricted or treated differently under another.

Known circumstances and deliberate conduct #

Cyber policies may exclude incidents, circumstances or vulnerabilities that were known before the policy commenced and were not appropriately disclosed.

Policies can also restrict cover for intentional, fraudulent or dishonest acts committed by certain insured persons. The treatment of employee dishonesty varies by wording.

Property, infrastructure and contractual liability #

Cyber Insurance is generally not designed to insure the physical loss or damage of computer hardware itself. Physical property may instead fall within Business Insurance or another property policy, depending on the circumstances.

Some policies restrict losses arising from failures of infrastructure or utilities that are outside the insured organisation’s control. The treatment of cloud providers, telecommunications failures and other third-party technology providers varies.

Liability assumed solely under a contract may also be restricted where the insured would not otherwise have been legally liable.

Cybersecurity requirements #

Policies can contain conditions or exclusions connected with particular cybersecurity controls.

The wording matters. It should not simply be assumed that any incident involving an outdated system or security weakness is automatically excluded.

Other common limitations #

Depending on the insurer, policies may also contain exclusions or limitations relating to:

• War and cyber warfare
• Government action
• Bodily injury
• Property damage
• Intellectual property
• Securities claims
• Uninsurable fines or penalties
• Prior claims or circumstances

Contact our team if you would like help reviewing the exclusions in your Cyber Insurance policy.