Problems & fixes · Cyber insurance
Cyber insurance exclusions and common coverage gaps
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Cyber policies commonly restrict cover for war and state-backed attacks, prior known incidents, failures to maintain stated security controls, infrastructure outages, betterment and some forms of fraud. Reading the exclusions and definitions matters more than the marketing summary. Ask how each exclusion works in practice and whether endorsements can narrow it.
Who this is for: A business owner reviewing a cyber policy wording to understand where claims may be denied or limited.
What to evaluate
War and state-backed attack wording
Broad exclusions can remove cover for large-scale incidents.
How to check: Read how the policy defines attribution and the scope of the exclusion.
Prior knowledge
Incidents or circumstances known before inception are excluded.
How to check: Understand the application's disclosure duties.
Failure to maintain security
Some wordings allow denial if controls lapse.
How to check: Ask whether this is a warranty, a condition or just a premium factor.
Infrastructure and provider outages
Power, telecoms and some cloud failures may be excluded or sub-limited.
How to check: Check which providers and event types are included.
Betterment
Policies often restore to the previous state, not an improved one.
How to check: Ask whether upgrades required after an incident are covered.
Fraud and social engineering
Payment diversion may be a separate, lower-limit extension.
How to check: Find the sub-limit and verification conditions.
Comparison
| Exclusion | Why it exists | Question to ask |
|---|---|---|
| War or state action | Insurers avoid catastrophic accumulated losses | How is a state-backed attack determined? |
| Prior known circumstances | The policy is for future events | What must be disclosed at application? |
| Unmaintained security | Controls influence the risk | Is cover lost or reduced if a control lapses? |
| Infrastructure failure | Large systemic outages are hard to insure | Which provider outages are included? |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| War and state-backed attack wording | |||
| Prior knowledge | |||
| Failure to maintain security | |||
| Infrastructure and provider outages | |||
| Betterment | |||
| Fraud and social engineering | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Which exclusions apply to ransomware and extortion events?
- How does the policy deal with an attack attributed to a state?
- Is cover reduced if a security control stops operating?
- Are outages at my cloud provider covered and with what waiting period?
- Are upgrades required by regulators or the insurer covered?
- Does the policy cover invoice fraud and funds-transfer fraud?
- How are definitions such as security failure and data breach worded?
Typical trade-offs
Accept broad exclusions for a lower premium
- Upside
- Lower cost of cover
- Downside
- Greater chance a loss falls outside the policy
Negotiate endorsements
- Upside
- Tailors the policy to your risks
- Downside
- Extra premium and time with a broker
Self-insure part of the risk
- Upside
- Avoids paying for cover you may not use
- Downside
- Large uninsured losses are possible
Common mistakes
- Assuming marketing summaries match the wording. Compare against the policy document and schedule.
- Ignoring definitions. A small change in a term can change whether an event is covered.
- Skipping renewal review. Wordings and exclusions can change between periods.
- Failing to record security measures. Evidence supports a claim if a control is questioned.
Related questions
What does the war exclusion mean for ransomware?
Many insurers add wording to exclude losses linked to war or state-backed operations. Disputes arise when an attack is attributed to a government, because proof can be difficult and the exclusion may be broadly drafted. Different wordings vary in how they address attribution, scale and impact. Ask the broker how the clause would apply to a typical ransomware event and whether any endorsement narrows it. This is a wording-specific question and a regulator or lawyer can help interpret it.
Can a claim be refused for a missing security control?
It can be, depending on the wording and the law. Some policies treat controls as conditions, others as application statements that affect the outcome if they were inaccurate. The result may be full denial, a reduced payout or no effect, and local insurance law shapes this. Ask whether stated controls are warranties, and keep records showing they were operating. If a claim is refused, ask for the reasons in writing and use the insurer's complaints process.
Why are cloud provider outages sometimes excluded?
Large provider failures can affect many policyholders at once, which insurers find hard to price, so wordings may exclude certain providers, require a longer waiting period or apply a lower sub-limit. Some policies cover only outages of systems you operate. If your business depends heavily on a few providers, ask exactly which are included and how business interruption is calculated for dependent-service events.
Does cyber cover include money lost to payment fraud?
Not always. Social engineering or funds-transfer fraud is often a separate extension with a low sub-limit and conditions, such as call-back verification of payment changes. Some businesses find it within a crime policy instead. Check which policy responds and whether the conditions are realistic for your processes. Ask the insurer how it treats losses where staff were deceived but followed the rules.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Information for small and medium sized organisations — National Cyber Security Centre, retrieved 27 October 2026
- Cybersecurity and Infrastructure Security Agency — CISA, retrieved 27 October 2026
- Insurance Information Institute — Insurance Information Institute, retrieved 27 October 2026
Related guides
How to choose · Cyber insurance
How to choose cyber insurance for a small business
Cyber policies typically combine first-party cover for your own losses, such as incident response, data restoration and business interruption, with third-party cover for claims from customers or regulators. Compare what triggers each section, the sub-limits and waiting periods, and what security controls the insurer expects. This is general information, not advice on what any business should buy.
Comparison · Cyber insurance
Cyber insurance versus investing in security controls
Insurance transfers some financial loss after an incident, while security controls lower the likelihood and impact. The two are complementary, and insurers often require certain controls as a condition of cover. A sensible comparison looks at which losses you could absorb, which you could not, and which controls reduce both risk and insurance friction. This is general information, not a recommendation.
Requirements · Cyber insurance
What happens when you make a cyber insurance claim
Claims depend on prompt notification, cooperation with the insurer and its appointed specialists, and keeping evidence. Policies are usually written on a claims-made basis with strict notice conditions. The insurer typically coordinates investigation, legal advice and recovery, then assesses what falls within cover. Read the claims conditions before an incident so you know whom to call and what not to do.
Problems & fixes · Health insurance
Why health insurance claims are declined and how to respond
Health claims are declined for reasons such as pre-existing condition exclusions, lack of prior authorisation, treatment outside the network, waiting periods, benefit limits reached, or the insurer judging a treatment not medically necessary or experimental. The decision letter should cite the reason. You can request clinical review, supply supporting letters from your doctor, and use internal appeals and then an external reviewer or ombudsman.
How to choose · Claims and brokers
How to choose an insurance broker
A broker arranges cover on your behalf, while an agent may represent one insurer. Judge a broker on regulatory status, the range of insurers it can access, how it is paid, how it handles claims and whether it explains policy wording clearly. Ask whether it acts for you or for insurers. This is general information and not advice on any specific purchase.
Problems & fixes · Claims and brokers
What to do when an insurance claim is denied or delayed
Start by getting the decision in writing with the policy clauses relied on. Compare it with your policy wording and evidence, then use the insurer's internal complaints process. If unresolved, many jurisdictions provide an independent ombudsman or regulator route, with deadlines. Keep records of every call and document. This is general information, not legal advice about your claim.
Problems & fixes · Life insurance
Why life insurance claims are denied and how beneficiaries can respond
Life claims are usually declined or delayed because of misstatements on the application, death inside an exclusion period, lapse for unpaid charges, cause of death falling under an exclusion, or disputes about the beneficiary. Insurers investigate more closely if death occurs soon after the policy starts. Beneficiaries can request the file reasons in writing, supply evidence and use the insurer's complaints process and the relevant ombudsman or regulator.