Cyber insurance is commercial insurance designed to address specified financial losses associated with cyber incidents and privacy or network-security events. The Federal Trade Commission describes cyber insurance as one option businesses can use to protect against losses resulting from cyberattacks.

Potential incidents can include network breaches, theft or exposure of personal information, ransomware, attacks involving information held by vendors, and other events covered by the policy. Cyber coverage may also provide access to services that help a company investigate and respond quickly after an incident.

Cyber insurance should not be treated as one standardized policy. NAIC describes commercial cyber policies as highly customized. Two policies carrying the same general label may therefore cover different incidents, expenses, technologies, vendors, geographic areas, and liability exposures.

A useful way to understand cyber insurance is to separate first-party coverage from third-party coverage. Many businesses may need elements of both.

The FTC advises businesses considering cyber insurance to discuss whether they need first-party coverage, third-party coverage, or both. A company that stores sensitive customer information, depends heavily on computer systems, or provides digital services may have several exposures at the same time.

A data breach can create costs long before a liability lawsuit reaches court. A business may need to identify how attackers gained access, determine which systems and records were affected, obtain legal advice, communicate with affected people, restore systems, and manage business disruption.

The FTC identifies several expenses that first-party cyber insurance may cover, subject to the contract:

• Legal counsel related to notification and regulatory obligations.
• Forensic investigation of the breach.
• Recovery or replacement of lost or stolen data.
• Notification and call-center services for affected individuals.
• Crisis-management and public-relations expenses.
• Covered lost income from business interruption.
• Certain cyber extortion or fraud-related expenses when included by the policy.

The FTC’s breach-response guidance also emphasizes that businesses should quickly secure operations, mobilize appropriate experts, investigate the incident, consult legal counsel where appropriate, and determine which people or organizations may need notification.

A cyberattack can prevent a business from accessing software, customer records, websites, payment systems, production technology, or other digital resources needed for operations. Cyber business-interruption coverage may respond to specified income losses and expenses when an eligible cyber event causes a covered interruption.

This is different from assuming an ordinary commercial property policy’s business-income coverage applies. Traditional business-interruption coverage is commonly connected to covered physical property damage, while cyber interruption can involve network or system events without traditional physical damage.

Businesses comparing cyber interruption coverage should examine:

• Which cyber events trigger coverage.
• Whether a waiting period applies.
• How covered income loss is calculated.
• The maximum period or amount covered.
• Whether extra expenses incurred to continue operations can qualify.
• Whether outages involving outside technology or service providers are included.

Cyber insurance may cover certain ransomware-related losses, but coverage cannot be assumed. NAIC guidance notes that many cyber policies cover ransom payments, extortion-related expenses, and repair costs, while also emphasizing that coverage may require prior notification and security controls.

A ransomware incident can create several separate insurance issues, including:

• Forensic investigation.
• System restoration.
• Data restoration.
• Business interruption.
• Cyber extortion response.
• Legal, notification, or liability expenses if sensitive information was also accessed or exposed.

A cyber event may harm people or organizations outside the insured company. Customers can allege that personal information was inadequately protected, clients can claim a security failure caused financial harm, or regulators may investigate whether applicable obligations were satisfied.

According to FTC guidance, third-party cyber coverage can include, depending on the policy:

• Claims and settlement expenses related to disputes or lawsuits.
• Payments associated with affected consumers when covered.
• Litigation expenses.
• Costs of responding to regulatory inquiries.
• Covered settlements, damages, or judgments.
• Other specified liability costs included in the policy.

Businesses should also determine how defense costs affect the available liability limit and whether the insurer has a duty to defend eligible claims. The FTC specifically suggests looking for duty-to-defend wording when evaluating a cyber policy.

Modern businesses often rely on cloud providers, payment processors, software companies, payroll platforms, data-storage providers, and other outside vendors. A security event affecting one of those organizations can still disrupt your operations or expose information for which your business has responsibilities.

FTC cyber-insurance guidance recommends checking for protection involving cyberattacks on data held by vendors and other third parties. The exact scope can vary substantially, however.

When vendor dependence is significant, review whether the policy addresses:

• Data stored or processed by third parties.
• Business interruption caused by specified outside providers.
• Definitions of covered service providers or dependent businesses.
• Separate limits or sublimits applying to dependent-system losses.
• Contractual or notification requirements involving vendors.

Exclusions vary widely, so businesses should not rely on a generic list as a substitute for reading the policy. A loss can also fall outside coverage because it does not meet a definition, exceeds a sublimit, occurs outside the covered period, or involves a security representation or policy condition that becomes relevant to the claim.

Areas that deserve careful review can include:

• Events known before the policy began.
• Contractual liability beyond what the policy covers.
• Certain bodily injury or physical property damage claims.
• Losses falling under fraud, funds-transfer, or crime exclusions unless appropriately covered or endorsed.
• Cyber events involving vendors that do not meet the policy’s definition of a covered provider.
• Amounts exceeding cyber extortion, interruption, restoration, or other sublimits.
• Events outside the policy’s geographic or jurisdictional scope.
• Losses affected by exclusions or policy conditions relating to cybersecurity practices.

A Business Owners Policy and commercial general liability insurance can address important property and liability exposures, but they should not automatically be treated as substitutes for dedicated cyber coverage.

NAIC states that most commercial property and general liability policies do not cover cyber risks. A business relying heavily on digital systems or holding sensitive information should therefore identify exactly what its existing policies cover before assuming a separate cyber policy is unnecessary.

Some insurers offer cyber endorsements to package policies, while others offer stand-alone cyber insurance. A business should compare the scope and limits rather than assuming an endorsement provides the same breadth as a stand-alone product.

Cyber risk is not limited to technology companies. FTC and NAIC guidance emphasize that businesses of different sizes can be cyberattack targets. A company may have meaningful cyber exposure even if technology is not the product it sells.

Cyber insurance may deserve particular consideration if a business:

• Stores customer or employee personal information.
• Processes payments electronically.
• Depends on cloud platforms or outside technology vendors.
• Would lose substantial revenue if computer systems became unavailable.
• Maintains confidential business or client information.
• Provides online services or operates an e-commerce business.
• Faces contractual requirements for cyber or privacy coverage.
• Would need outside legal, forensic, notification, or public-relations assistance after a breach.

Cyber insurance works alongside cybersecurity rather than replacing it. The FTC recommends that businesses maintain basic security practices such as regular software updates, backups, employee training, access controls, multi-factor authentication where appropriate, vendor-security practices, and incident-response planning.

Cyber insurers may ask detailed questions about security controls during underwriting. Answers to those questions should be accurate. A company should not state that a control is implemented across its organization when the actual configuration or practice is different.

NAIC ransomware guidance also notes that coverage can require robust security controls and prior notification. Businesses should therefore treat cybersecurity practices as part of both loss prevention and insurance management.

1. Identify Your Most Important Cyber Risks

List the data, systems, vendors, applications, and revenue-producing operations the business depends on. Consider what would happen if each became unavailable, corrupted, stolen, or publicly exposed.

2. Compare First-Party and Third-Party Coverage

Make sure the quote addresses the company’s own recovery costs as well as liability to outside parties where those exposures matter. One side of the coverage should not be assumed to include the other.

3. Review Sublimits

A policy can have a large overall limit while applying smaller limits to particular losses such as cyber extortion, business interruption, restoration, or certain vendor-related events. Compare these sublimits with realistic exposure.

4. Check Incident-Response Resources

Review whether the insurer provides access to breach counsel, forensic specialists, notification vendors, crisis-management professionals, or other response resources and whether using approved vendors is required for coverage.

5. Review Vendor and Cloud Exposure

If a business depends on outside technology providers, determine how the policy treats outages and breaches involving them. Check the definition of covered vendors rather than assuming every provider qualifies.

6. Compare Defense Provisions and Other Insurance

FTC guidance suggests checking whether the insurer has a duty to defend eligible lawsuits or regulatory investigations and how cyber coverage interacts with other insurance. Overlapping policies can contain provisions determining which coverage responds first.

7. Read the Application as Carefully as the Policy

Cyber applications can ask detailed questions about backups, authentication, access controls, patching, employee training, vendors, data, and past incidents. Verify the answers with the people responsible for the company’s technology rather than guessing.

The worst time to learn how a cyber policy works is during an active attack. Incorporate insurance into the company’s incident-response planning before a loss.

• Save the policy and insurer’s emergency contact information somewhere accessible during a system outage.
• Identify who within the company has authority to notify the insurer.
• Understand when notice is required.
• Determine whether insurer consent is required before hiring forensic, legal, or restoration vendors.
• Maintain secure backups and periodically test restoration procedures.
• Train employees to recognize common attack methods.
• Review access controls and authentication practices.
• Maintain an incident-response, disaster-recovery, and business-continuity plan appropriate to the organization.
• Review important vendors and the cybersecurity risks they create.

• Assuming general liability covers cyber incidents. Traditional commercial policies can contain significant cyber gaps.
• Buying by total limit alone. Important coverage sections may have much smaller sublimits.
• Ignoring vendor risk. A business can be disrupted or exposed even when the attack occurs outside its own network.
• Assuming ransomware is automatically covered. Extortion coverage, consent requirements, exclusions, and security conditions vary.
• Providing inaccurate security information. Cyber underwriting questions should reflect actual company practices.
• Waiting until an attack to read the notification requirements. Late or improper notice can create avoidable coverage disputes.
• Treating insurance as a substitute for security controls. Prevention, detection, response, and recovery planning remain necessary.
• Failing to review the policy as technology changes. New software, vendors, locations, data, or services can change the company’s cyber exposure.

• Identify sensitive customer, employee, and business data.
• Estimate how a major system outage would affect revenue and operations.
• Review first-party breach-response and restoration coverage.
• Review third-party privacy and network-security liability coverage.
• Check ransomware and cyber-extortion terms.
• Review cyber business-interruption coverage and waiting periods.
• Check vendor and dependent-system coverage.
• Compare overall limits with applicable sublimits.
• Review defense arrangements and regulatory-response coverage.
• Confirm geographic and jurisdictional scope.
• Understand notice, consent, and approved-vendor procedures.
• Verify the cybersecurity information submitted to the insurer.
• Update coverage as technology, vendors, data, and operations change.

Cyber insurance can protect a business from several financial consequences of a covered cyber event. Depending on the policy, protection can include forensic investigation, data recovery, breach notification, business interruption, cyber extortion response, legal expenses, and liability claims brought by customers or other parties.

The biggest limitation is that cyber insurance is highly customized. A large policy limit does not guarantee that every cyber loss is covered, and important sections may have separate sublimits, waiting periods, exclusions, consent provisions, security requirements, or definitions affecting a claim.

Before buying or renewing coverage, map the policy to the company’s actual data, systems, vendors, revenue dependencies, and incident-response plan. Review cybersecurity controls at the same time because insurance works best as one part of a broader risk-management strategy.

• Federal Trade Commission, Cyber Insurance, accessed August 2026.
• Federal Trade Commission, Cybersecurity for Small Business, accessed August 2026.
• Federal Trade Commission, Data Breach Response: A Guide for Business, accessed August 2026.
• National Association of Insurance Commissioners, Cybersecurity, last updated May 9, 2024.
• National Association of Insurance Commissioners, Ransomware, accessed August 2026.