Cyber Insurance: First-Party and Third-Party Coverage, Exclusions and Cost Factors

Treat the lists below as categories to ask about. A specific policy may include all of them, some of them or versions with their own limits and conditions.

First-party coverage: your own costs

The FTC says first-party coverage typically includes your business's costs related to:

• Legal counsel to determine your notification and regulatory obligations
• Recovery and replacement of lost or stolen data
• Customer notification and call center services
• Lost income due to business interruption
• Crisis management and public relations
• Cyber extortion and fraud
• Forensic services to investigate the breach
• Fees, fines and penalties related to the cyber incident

Business interruption deserves its own questions. Ask how lost income is measured, whether a waiting period passes before coverage starts and whether an outage at a cloud host, payment processor or other vendor counts. The FTC suggests making sure a policy covers cyberattacks on your data held by vendors and other third parties. FTC list of what a policy should cover.

Funds-transfer fraud and business email compromise

"Fraud" on that list can mean several different losses. Business email compromise (BEC) is a scam in which criminals compromise email or other communication accounts, or use social engineering, to get a business to make an unauthorized transfer of funds. The FBI's Internet Crime Complaint Center received 24,768 BEC complaints in 2025, with reported losses of about $3.05 billion. FBI IC3 2025 annual report.

Ask whether a proposal covers a payment that an employee sends after being deceived, as well as a hack of your own systems. Then ask which insuring agreement applies, what limit applies to that loss and whether any verification step is a condition of coverage.

Ransomware and extortion

Cyber extortion is on the FTC's first-party list, but a ransom payment raises legal questions as well as insurance ones. The U.S. Treasury's Office of Foreign Assets Control (OFAC) says the U.S. government strongly discourages paying ransom or extortion demands. Its 2021 advisory warns that companies facilitating ransomware payments, including cyber insurance firms, may risk violating OFAC regulations when a payment involves a sanctioned person or jurisdiction. In an enforcement decision, OFAC treats a prompt, complete report of the attack to law enforcement or CISA as a significant mitigating factor. OFAC ransomware advisory.

Before relying on extortion coverage, ask how its limit compares with the overall policy limit, whose consent is needed before any payment and which response firms you must use.

Third-party coverage: claims against you

The FTC says third-party coverage typically includes:

• Payments to consumers affected by the breach
• Claims and settlement expenses relating to disputes or lawsuits
• Losses related to defamation and copyright or trademark infringement
• Costs for litigation and responding to regulatory inquiries
• Other settlements, damages and judgments
• Accounting costs

The same FTC page suggests checking whether the insurer will defend you in a lawsuit or regulatory investigation (look for "duty to defend" wording), whether coverage applies in excess of other insurance you have, and whether it offers a breach hotline that is available at all times. FTC third-party coverage guidance.

Notification laws and regulatory penalties

A breach can create legal duties even before anyone sues. According to the FTC, all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information, and other laws may apply depending on the type of information involved. FTC data breach response guide.

If your business is subject to the HIPAA privacy and security rules, HHS assesses civil money penalties for each violation, not for each record. The penalty tiers rise with culpability, from violations the business did not know about to willful neglect that is not corrected in time. Each tier has a calendar-year limit for all violations of an identical requirement. HHS notice on HIPAA penalty tiers. HHS adjusts the amounts for inflation every year and lists the current minimum, maximum and calendar-year cap for each tier in its penalty table. 45 CFR 102.3, HHS civil monetary penalty table.

The FTC lists fees, fines and penalties among the costs first-party coverage typically includes. Ask the provider to show the wording that would apply to a regulatory fine and any condition or exclusion that limits it.

Expect the application to ask about your security controls. In a 2021 circular letter, New York's Department of Financial Services told the property and casualty insurers it authorizes that assessing an insured's cyber risk "commonly starts with gathering information regarding the institution's cybersecurity program through surveys and interviews." Its listed topics include access controls, encryption, endpoint monitoring, vulnerability management, incident response planning and third-party security policies. NYDFS cyber insurance risk framework. If an outside firm runs your IT, our guide to what a cyber insurer still asks when you outsource IT lists the access, backup and incident-response details to gather before you apply.

That letter is New York guidance to insurers. It shows the kinds of topics underwriters examine, not the exact questions on any one application. As one insurer's explanation, The Hartford says insurers often look for multifactor authentication, regular backups, endpoint detection and response (EDR) technology, consistent patching and employee training. The Hartford's cyber pricing explanation.

Multifactor authentication (MFA) requires a combination of two or more authenticators, such as a password and a code, before a service grants access. CISA MFA guidance. CISA's guidance for small businesses describes MFA and the other common controls in practical terms. Use it to check what you can actually confirm before you answer. CISA cyber guidance for small businesses.

Answer each question from current records. If a control covers only some accounts or devices, say so instead of choosing the nearest "yes." Ask the provider how your application answers relate to the policy's conditions, and keep a copy of what you submitted.

Our cyber insurance preparation checklist turns the data you handle and the controls you can confirm into a list of items to verify before that conversation.

A cyber policy's title does not settle what it pays. Exclusions remove events or costs from coverage. A sublimit caps one type of loss below the overall limit. A retention, similar to a deductible, is the amount your business pays before the insurer does.

Sublimits are a real feature of these products. The Hartford's cost page, for example, lists an extortion sublimit as a separate item in its own cyber coverage. The Hartford's cyber coverage components.

The FTC suggests making sure a policy covers data breaches, network breaches, attacks on your data held by vendors, attacks that occur anywhere in the world and terrorist acts. Turn those points, and the other common gaps, into written questions:

Our professional liability guide explains retroactive dates and extended reporting periods; ask how a cyber proposal defines both. The policy-reading guide shows how declarations, forms and endorsements fit together.

Your premium comes from an insurer's underwriting of your business, so the useful question is which of your facts move the price. A published average cannot see your data, controls or claims history.

Security controls matter to the price as well as to eligibility. New York's 2021 circular letter told insurers they "should also incentivize the adoption of better cybersecurity measures by pricing policies based on the effectiveness of each insured's cybersecurity program." NYDFS guidance on pricing and controls.

The Hartford's explanation of its own cyber pricing lists these factors. Treat them as one insurer's description, not a market rule. The Hartford's cost factors.

• Company size: more revenue, endpoints or vendor connections can mean broader exposure.
• Type and amount of data: more sensitive data, such as personal, health or payment information, and more records can raise costs.
• Security measures: MFA, backups, EDR, patching and training "may help improve your pricing."
• Claims history: past incidents can lead to higher pricing, stricter exclusions or higher retentions.
• Limits and deductible: higher limits typically raise the premium; a higher deductible can lower it.
• Technology and data access: remote logins, administrator permissions, vendor connections and cloud systems add access points.
• Number of employees: more people can mean more chances of phishing attempts and internal access risks.

Market conditions sit in the background. The National Association of Insurance Commissioners (NAIC) reported the U.S. market's first-ever reduction in cyber direct written premium in 2024: about $9.14 billion, 7% below 2023. That is a market total, not a guide to any one renewal. NAIC 2025 cybersecurity insurance market report.

To compare offers fairly, give every provider the same description of your business, data and controls. The quote-comparison worksheet keeps limits, sublimits, retentions and open questions side by side. Request coverage help if you would like PolicyBenchmark to follow up about your questions.

Cyber coverage is sold both as its own policy and as an endorsement added to another policy. NAIC data show that in 2024 endorsements made up 55.1% of cyber policies in force but only 4% of cyber direct written premium. The NAIC describes endorsements as "high-volume but low-premium products." NAIC cyber market data.

If your business owners policy offers a cyber or data breach endorsement, compare its covered events, limits and sublimits with a stand-alone proposal before treating the two as substitutes.

Other policies may be silent on cyber. New York regulators describe "silent" cyber risk as the risk that an insurer must cover a cyber loss under a policy that does not explicitly mention cyber. They named general liability, errors and omissions, burglary and theft, and product liability among the policies where it can be found, and told insurers to make clear in any policy that could face a cyber claim whether it provides or excludes coverage for cyber-related losses. Ask your general liability provider to point to the wording that applies. NYDFS on silent cyber risk.

If you sell technology services, ask each provider how it would handle a client's claim that your service failed: under the cyber policy, under professional liability (also called errors and omissions), or under a proposal that combines the two, and whether any part of that claim would fall outside both.

Speed matters, and so does the order of steps. The FTC's breach guide advises mobilizing a breach response team, considering independent forensic investigators and consulting legal counsel. It also says to take affected equipment offline immediately but not to turn machines off until forensic experts arrive. FTC steps after a breach.

On the insurance side, follow the policy's notice instructions and use the claim contact or hotline it names. Before hiring outside firms, ask whether the policy requires the insurer's own panel. For ransomware, OFAC encourages victims to report to CISA, a local FBI field office, the FBI's Internet Crime Complaint Center or the U.S. Secret Service as soon as possible. OFAC reporting guidance.

Keep the policy number and claim contact somewhere you can reach if your own systems are down. The claim-filing guide covers documentation and follow-up.