Cyber Liability Insurance
Cyber liability insurance is coverage for a company's losses and legal liability after a cyber incident such as a data breach, ransomware or system outage, typically including first-party response costs and third-party claims, subject to the policy's terms and exclusions.
Last updated October 13, 2026
How cyber liability insurance works
Cyber policies usually combine two kinds of protection. First-party coverage responds to the company's own costs, which may include forensic investigation, breach notification, data restoration, business interruption and extortion payments. Third-party coverage responds to claims from others, such as customer lawsuits, regulatory investigations and related defense costs and settlements.
Exactly what is included varies by insurer and form. Many policies are written on a claims-made basis and use limits, retentions and sublimits that differ between coverage parts. Insurers typically assess security controls such as multi-factor authentication and backups during underwriting.
Typical coverage components
- Breach response: forensic investigation, legal counsel, notification and credit monitoring.
- Business interruption: lost income and extra expense after a covered network outage or attack.
- Extortion: response to ransomware demands, where the policy allows.
- Recovery support: some policies also fund data restoration or public relations help after an incident.
- Liability: defense and damages for privacy and security claims and regulatory proceedings.
Example
A hypothetical payments start-up discovers that an attacker accessed customer records. The policy may help pay for a forensic firm, legally required notices, credit monitoring and legal counsel, and may respond if customers or regulators later bring claims, subject to the retention, limits and any exclusions.
What to watch for
- Common gaps: many policies do not respond to lost revenue from stolen intellectual property, harm to reputation, or falling stock prices after a breach, and some do not pay to replace damaged hardware.
- Sublimits: ransomware, social engineering and regulatory fines are sometimes capped well below the main limit.
- Application accuracy: statements about security controls are relied on by the insurer, so answers should be verified with IT.
- Cyber versus tech E&O: cyber addresses security and privacy events, while technology errors and omissions addresses failure of your product or services for customers. Many tech companies need both.
Cyber liability vs. related terms
- Cyber vs. technology E&O. Cyber responds to security and privacy events, while tech E&O responds to claims that your product or service failed a customer. A bug that causes a customer financial loss is typically a tech E&O question. A breach of customer data is typically cyber.
- Cyber vs. crime. Crime covers theft of money and securities, including some funds transfer fraud. Cyber covers response costs, extortion, restoration and liability. Payment-redirection fraud may sit in either.
- Cyber vs. general liability. General liability is built around bodily injury and property damage, and many forms exclude or limit data-related claims. See commercial general liability.
- Cyber vs. D&O. After a major incident, shareholders or regulators may allege management failures. Those claims against directors and officers are typically a D&O question, not cyber.
- First-party vs. third-party cyber coverage. First-party coverage pays your own response and loss costs. Third-party coverage pays defense and damages when others sue or investigate you.
Second example: a ransomware event
A hypothetical AI software start-up finds that its production systems have been encrypted after an attacker used stolen credentials. The company calls the incident number in its policy. Depending on the wording, the insurer may connect it with approved forensic and legal providers, and the policy may respond to investigation costs, restoration of systems and data, lost income after any waiting period, and negotiation and payment of an extortion demand where the law and the policy allow. Insurers typically require consent before any payment, and legal restrictions on paying certain parties can apply. If customers later sue over the outage, the third-party liability section may respond. Each part is subject to its own retention, sublimit and exclusions.
Questions to ask your broker or underwriter
- What are the retention and the waiting period for each coverage part?
- Which sublimits apply to ransomware, social engineering, regulatory proceedings and PCI-related costs?
- Does the policy cover dependent business interruption when a cloud or software vendor goes down, and for what vendors?
- Are we required to use the insurer's panel of forensic and legal providers?
- What exclusions could apply, such as war, infrastructure failure or unencrypted devices?
- What are the retroactive date and any claims-made reporting requirements?
- Which statements about security controls in the application is the insurer relying on, and have we verified them?
Why it matters for technology, AI, fintech and digital-asset companies
These companies hold sensitive data, run critical software and often depend on cloud providers, so a single incident can trigger both breach response costs and customer claims. See our ransomware coverage, social engineering fraud and business email compromise entries, and our Cyber / Technology E&O page.
AI companies also hold training data, model weights and customer prompts that attackers target. Whether the loss of value of stolen intellectual property or model weights is covered is policy specific, and many policies exclude it, so ask directly. Crypto and fintech companies should be aware that theft of tokens from a hot wallet often falls outside a cyber policy and is typically addressed under digital asset or crime coverage. See AI and emerging tech, digital assets and crypto and fintech for how programs are typically combined.
See how this applies in practice: tech E&O and cyber insurance and AI liability insurance.
Related terms
Related coverage
Frequently asked questions
What is cyber liability insurance?
Cyber liability insurance is coverage for a company's losses and legal liability after a cyber incident such as a data breach, ransomware or system outage, typically including first-party response costs and third-party claims, subject to the policy's terms and exclusions.
What does cyber liability insurance typically cover?
Typically first-party costs such as forensics, notification, data restoration, business interruption and cyber extortion, plus third-party liability such as customer suits, regulatory inquiries and settlements. The specific coverage, limits and sublimits vary by policy and insurer, so the wording should be reviewed.
What is not usually covered by cyber insurance?
Many policies exclude or limit losses like lost revenue from stolen intellectual property, reputation damage, stock price declines and hardware replacement. Insurers have also tightened terms in recent years, so exclusions and limits vary widely.
Is cyber liability insurance the same as tech E&O?
No. Cyber liability focuses on data breaches, ransomware and network incidents. Tech E&O focuses on claims that a company's technology product or service failed customers. They overlap in places, and some insurers combine them in one policy.
Does cyber insurance cover ransomware payments?
Many policies include cyber extortion coverage that can pay negotiation costs and, in some cases, the ransom itself, subject to the policy's conditions, sublimits and applicable law. Insurers typically require notice and consent before any payment. Coverage differs by policy, so confirm the extortion terms.
Does cyber insurance cover a breach at my cloud provider or vendor?
It may, depending on the policy. Some cyber policies include dependent business interruption for outages at technology vendors, and liability coverage can respond when a vendor's breach exposes your customers' data. Coverage often depends on which vendors qualify and on any sublimit. Ask for the specific wording.
What do insurers ask about in a cyber application?
Applications commonly ask about security controls such as multi-factor authentication, backups, endpoint detection, patching, employee training, and how sensitive data is handled. Answers are relied on by the insurer, so they should be reviewed with IT before submission.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays your own costs after an incident, such as forensics, notification, restoration and lost income. Third-party coverage pays defense and damages when customers, regulators or others bring claims against you. Most cyber policies include both, with separate limits or sublimits.
Need this coverage, or just a clear answer?
Our brokers translate terms like Cyber Liability Insurance into a program built for how your company actually operates, and read every policy for the exclusions that matter.
Book a consultation → (opens in a new tab)