Understand the policy before an incident tests it
Your business uses email, takes payments, and stores employee or customer information. If something goes wrong, the cost may include much more than repairing a computer.
So, what does cyber insurance cover? Depending on the policy, it may help with incident investigation, data recovery, certain business interruption losses, and covered claims against your business. Fraudulent payments can require different protection.
For Central Illinois employers comparing coverage, the useful question is specific: “How would this policy respond to the way our business uses technology?”
What does cyber insurance cover for your business?
Cyber policies often distinguish between two categories:
- First-party coverage: Certain losses and expenses your own business experiences.
- Third-party coverage: Certain claims others bring against your business.
You may need both. A breach can create immediate response expenses and later claims involving exposed information. The FTC explains the distinction.
Here are common areas to review. None should be assumed included without checking your policy.
| Coverage area | What it may help with |
|---|
| Incident response | Approved legal advice, computer forensics, required notices, and related response services |
| Data restoration | Eligible costs to recover or restore damaged or compromised data and programs |
| Business interruption | Defined income loss and qualifying extra expenses following a covered system interruption |
| Privacy and network liability | Defense and covered damages from qualifying claims against the business |
| Cyber extortion | Certain response expenses and, where lawful and covered, extortion-related payments |
Availability, exclusions, limits, and approval requirements vary. Travelers describes examples of cyber coverage options.
Stolen money needs a separate conversation
Imagine an employee receives convincing instructions to change a vendor’s bank details. The employee sends the payment, then learns the request was fraudulent.
That loss is not automatically treated the same as exposed customer records. Social engineering fraud, computer fraud, and funds transfer fraud can have different definitions and coverage requirements.
Protection may appear in a cyber policy, a crime policy, or an endorsement. The applicable limit may be much lower than the policy’s headline limit. Some provisions require particular verification procedures.
Ask your advisor to walk through that exact scenario using your policies. “We have cyber insurance” does not answer whether an authorized employee’s payment to a scammer is insured. Travelers’ sample coverage details illustrate separate cyber-crime agreements.
What if your business cannot operate?
A cyber incident may interrupt scheduling, billing, sales, or production even when no building is damaged.
Cyber business interruption coverage can have a waiting period, a defined recovery period, and specific rules for calculating loss. A temporary inconvenience does not automatically qualify, and lost revenue is not necessarily the claim payment.
Ask whether the policy addresses a covered outage at a technology provider you rely on. Coverage for your own systems does not automatically establish coverage for every outside provider or every type of outage.
Do not assume the business income coverage in a property policy fills this gap. Its triggers may differ from cyber coverage. Travelers explains cyber interruption and restoration coverage.
What should you avoid assuming is covered?
Check the policy before counting on payment for:
- Every scam, transfer, or dishonest act.
- An incident or circumstance known before coverage began.
- All upgrades to older equipment or security systems.
- Every contractual penalty, regulatory fine, or legal expense.
- Expenses incurred without required insurer approval.
- Every vendor outage or loss of future customers.
Some policies offer limited protection for certain items on this list. Others exclude them. Ask what is included rather than relying on a product label.
Also review security-related application answers and policy conditions. If your business changes its authentication, backup, or access practices, discuss that change with your advisor. Do not assume every security mistake voids a policy, but do not overlook conditions you agreed to maintain.
Questions to bring to your coverage review
- Who do we call when we suspect an incident?
- Which response providers are approved?
- What limits apply to stolen funds and social engineering?
- What deductible or retention do we pay?
- Is there a waiting period for business interruption?
- What protection applies to outside technology providers?
- Do defense costs reduce the available limit?
- What reporting deadlines and security conditions apply?
Bring examples from your operations: payroll changes, vendor payments, online ordering, customer records, or scheduling software. They make the review more useful than discussing cyber risk in general terms.
Review your cyber coverage with TROXELL
TROXELL can help you compare your business’s exposures with its cyber and crime coverage, understand limitations, and prepare for reporting a claim. The goal is to know which protections you have before a suspicious email or system outage puts them to the test.