KNOWLEDGE
Cyber insurance knowledge base
Short, citable definitions of the concepts that shape cyber underwriting, claims and regulation.
Betterment
An upgrade of systems obtained while restoring them after a loss. Many policies pay to restore the prior state and not the cost of improvements.
Business Interruption (Cyber)
Cover that indemnifies the loss of operating profit caused by an interruption of IT systems following a cyber event.
Claims-made
A trigger under which the policy responds to claims first made during the policy period, provided the event is not earlier than the retroactive date. It is the most common basis for cyber liability cover.
Cyber Aggregation
The risk that a single event, such as a cloud provider outage or a widespread software vulnerability, causes simultaneous losses across many insureds in the same portfolio.
Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847 setting cybersecurity requirements for products with digital elements. Reporting duties for exploited vulnerabilities and incidents apply from 11 September 2026, the main obligations from 11 December 2027.
Cyber War Exclusion
A clause that excludes losses arising from war or from cyber operations attributable to states. The Lloyd's market has required clauses of this kind in stand-alone cyber policies since 31 March 2023.
Cyber extortion
Cover for the costs of a threat to damage systems or disclose data unless money is paid, including, where law and the policy allow it, negotiation consultants and payment of the ransom.
Cyber insurance
A policy that transfers to the insurer, within contractual limits and conditions, part of the financial losses caused by cyber incidents: incident response costs, business interruption, third-party claims and insurable penalties.
DORA
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable since 17 January 2025: it requires ICT risk management, incident reporting and oversight of critical providers.
Dependent business interruption
Loss of profit caused by an outage at a third-party provider, for example a cloud provider, on which the policyholder depends. It may be covered only for listed providers or with a sub-limit.
EDR (Endpoint Detection and Response)
A tool that monitors devices, detects anomalous behaviour and allows them to be isolated and analysed. Its presence is often assessed at underwriting.
Extended reporting period (ERP)
A period after a claims-made policy ends during which the policyholder may still report claims arising from events that occurred while covered. It often requires an additional premium.
First-party coverage
Cover for losses suffered directly by the policyholder, such as system restoration costs, forensic investigation, extortion, loss of profit and notification of affected individuals.
Incident response costs
Expenses incurred to respond to a cyber event: forensic investigation, legal advice, containment and recovery, communications and notification to individuals and authorities.
Insurability of fines
Whether regulatory fines, for example under data-protection law, can be covered by insurance. It depends on the applicable law and the policy wording, and in some jurisdictions it is not allowed.
Multi-factor authentication (MFA)
Access that requires at least two different kinds of proof of identity, such as a password and an app-generated code. It is one of the minimum controls most cyber insurers require.
NIS2
Directive (EU) 2022/2555, which strengthens cybersecurity risk-management and incident-reporting obligations for essential and important entities in the European Union.
Panel vendors
Law firms, forensic firms and other professionals pre-approved by the insurer. Many policies cover response costs only if these vendors are used or the insurer approves others.
Policy limit
The maximum amount the insurer will pay per claim or per policy period. It may be a single aggregate for the whole policy or reduced by sub-limits on individual coverages.
Product Liability Directive
Directive (EU) 2024/2853, which treats software as a product and applies to products placed on the market after 9 December 2026. Compensable damage excludes, among other things, property used exclusively for professional purposes and pure economic loss.
Ransomware
Malicious software that encrypts or locks data and systems and demands a ransom to restore them. It is often combined with data theft used as an additional threat (double extortion).
Retention (SIR)
The amount of each loss the policyholder bears before the policy responds. In cyber policies it is often expressed as a self-insured retention and may differ by coverage section.
Retroactive date
The date before which wrongful acts are not covered under a claims-made policy, even if the claim is made during the policy period. An intrusion that began before that date may therefore be excluded.
Silent Cyber
Cyber risk that is neither explicitly included nor explicitly excluded in traditional (non-cyber) insurance policies, which can create exposures the insurer has not quantified or priced.
Social engineering fraud
A scam that tricks a person into making a payment or revealing credentials, for example a fake email from a supplier or senior executive. It is often covered only with sub-limits and verification conditions.
Sub-limit
A limit lower than the overall policy limit, applied to a specific coverage, for example ransomware or business interruption.
Subrogation
The right of an insurer that has paid a claim to pursue the party responsible for the loss, for example a supplier, to recover what it paid.
System failure
An outage not caused by an attack, such as a misconfiguration or a faulty update. Some policies include it in business interruption cover, others exclude it.
Systemic risk
The risk that one event affects many parties at once, for example through a common provider or a widespread vulnerability. It is the main constraint on insurers' capacity to offer cyber cover.
Third-party liability
Cover for claims by customers, partners or other parties harmed by the policyholder's cyber incident, including legal defence costs.
Underwriting questionnaire
The form in which the applicant describes its security controls (MFA, backups, patching, EDR). The answers drive pricing and terms, and inaccurate statements can jeopardise cover.
Waiting period
The number of hours that must pass from the start of a systems outage before business interruption cover begins to indemnify the loss of profit.