BLOG

By David Chernitzky, Co-Founder and CEO, Armour Cybersecurity  |  Serving organizations across Canada, the US, and beyond  |  Last updated August 17, 2026

Quick answer: What does cyber insurance cover? At its core, cyber insurance covers the financial costs of a cyber incident, including ransomware payments, data breach notification, business interruption losses, regulatory defense and fines, crisis communications, and third-party liability claims from affected customers or partners. What it covers in practice depends heavily on the specific policy you buy, the coverage limits and sub-limits within each category, and the exclusions your carrier has written in. Most business owners discover the gaps only after a claim is denied. Understanding what you are actually buying before the policy is signed is the work that cyber insurance advisory exists to do.

Key Takeaways

• Cyber insurance has two broad coverage categories: first-party coverage, which pays for costs the organization incurs directly after an incident, and third-party coverage, which pays for liability claims brought by customers, partners, or regulators against the organization.
• Ransomware coverage is one of the most important and most variable elements of a cyber policy. Some policies cover the ransom payment, negotiation costs, decryption support, and data restoration. Others impose sub-limits well below actual ransom demands or exclude certain ransomware scenarios entirely.
• Business interruption coverage compensates for revenue lost while systems are down following a cyber incident. Waiting periods, sub-limits, and the definition of what constitutes a covered outage all vary significantly between carriers and must be reviewed carefully.
• Most cyber policies contain exclusions that reduce or eliminate coverage in specific scenarios. Common exclusions include acts of war or nation-state attacks, known unpatched vulnerabilities, failure to maintain required security controls, and incidents arising from prior known circumstances.
• Coverage limits that were adequate two years ago may be inadequate today. Ransomware demands, breach response costs, and regulatory fines have all increased significantly. Coverage adequacy should be reviewed at each renewal alongside the organization’s risk profile and any changes in the regulatory environment.

First-Party Coverage: What the Policy Pays for Your Own Costs

First-party cyber coverage pays for costs the organization incurs as a direct result of a cyber incident. These are the expenses that hit the organization’s own budget immediately after an attack, regardless of any liability to third parties. Understanding what first-party coverage includes and where sub-limits and exclusions apply is essential for evaluating whether a policy provides meaningful protection, and it is the heart of what cyber insurance coverage for business is meant to deliver.

Ransomware and extortion response

Ransomware coverage pays some combination of the ransom payment itself, the cost of engaging a specialist negotiator, the technical cost of decrypting systems, and the cost of restoring data from backups or rebuilding systems where backups are unavailable or have also been compromised. This is one of the most significant coverage categories for most mid-market organizations and one of the most variable between policies. Some policies cover the ransom payment without sub-limit; others cap ransomware payments at a fraction of the overall policy limit; others require prior carrier approval before any payment is made. Reviewing the ransomware provisions in detail, not just the headline coverage limit, is essential before binding coverage.

Business interruption

Business interruption coverage compensates the organization for revenue lost and ongoing expenses incurred while systems are unavailable following a covered cyber incident. If a ransomware attack takes down the organization’s order management system for five days and the organization loses revenue as a result, business interruption coverage is intended to replace that lost revenue up to the policy limit. The specifics matter: policies impose waiting periods before coverage activates (typically 8 to 24 hours after the outage begins), apply sub-limits to business interruption that may be well below the incident’s actual revenue impact, and define covered outages in ways that may exclude partial outages or outages caused by third-party system failures. Reducing the length of that outage is exactly what a managed SOC and a tested response plan are built to do.

Data breach response costs

When a breach exposes personal information, the costs of the legal, forensic, and notification response can be substantial. Cyber policies typically cover legal counsel to advise on notification obligations, forensic investigation to determine the scope of the breach, notification letters and credit monitoring services for affected individuals, and the operation of a breach hotline. These costs are often the first expenses that materialize after a breach is discovered and can run into tens or hundreds of thousands of dollars for a mid-market organization with a meaningful customer or employee data set. Coverage adequacy should be evaluated against the number of records the organization holds and the per-record cost benchmarks in current incident response data.

Crisis communications and public relations

A cyber incident, particularly one that results in a data breach or extended service outage, creates reputational risk that requires managed communication to customers, partners, media, and the public. Many cyber policies include coverage for crisis communications services, including public relations retainers, statement drafting, and media response. This coverage is often underappreciated at the time of purchase and highly valued when an incident creates reputational pressure that the organization is not equipped to handle internally.

Cyber forensics and incident investigation

Understanding what happened in a cyber incident, which systems were accessed, what data was exposed, how the attacker entered the environment, and whether the threat has been fully contained, requires forensic investigation by qualified digital forensics professionals. Cyber policies typically cover the cost of retaining a forensic firm, which is often a panel vendor approved by the carrier, and coordinating that work with your own breach response plan keeps the investigation moving while the claim is still being assessed. The coverage limit for forensic investigation should be evaluated against the complexity of the organization’s environment and the typical cost of a thorough forensic investigation.

Third-Party Coverage: What the Policy Pays for Claims Against You

Third-party coverage pays for liability claims brought by external parties who suffer harm as a result of a cyber incident at your organization. This coverage is most relevant when a breach exposes customer data, when a system compromise causes harm to a partner organization whose systems your network connects to, or when a regulator investigates and pursues enforcement action.

Privacy liability

Privacy liability coverage pays for claims by individuals whose personal information was exposed in a breach, including the legal costs of defending those claims and any settlement or judgment amounts. As class action litigation following data breaches has become more common, privacy liability coverage has become a more material component of the policy. Coverage limits and exclusions vary, and the policy should be reviewed for any exclusions that would limit coverage for claims related to specific types of personal information such as health data, financial data, or the personal information of minors.

Regulatory defense and fines

A data breach may trigger regulatory investigation and enforcement under PIPEDA, Quebec Law 25, HIPAA, GDPR, or PCI DSS, depending on the organization’s industry and the nature of the data involved. Regulatory defense coverage pays for legal counsel to represent the organization in the regulatory proceeding. Many policies also provide coverage for regulatory fines and penalties, though this coverage is subject to significant variation: some jurisdictions prohibit insurance coverage of regulatory fines entirely, and some policies exclude fines above a sub-limit or in specific regulatory contexts. Legal counsel should advise on the enforceability of fine coverage in the relevant jurisdiction, and reducing the underlying exposure is a job for the organization’s governance, risk and compliance function.

Network security liability

Network security liability coverage responds to claims by third parties who suffer harm because the organization’s systems were compromised and used to attack or infect them. If a ransomware infection spreads from the organization’s network to a partner’s connected systems, the partner’s resulting losses may give rise to a liability claim against the organization. This coverage is particularly relevant for organizations with significant partner or customer system connectivity, including managed service providers and organizations with deep supply chain integration.

Understanding Policy Exclusions

Exclusions are the provisions in a cyber policy that limit or eliminate coverage in specific scenarios. Understanding what is excluded is as important as understanding what is covered. Common cyber policy exclusions that frequently surprise policyholders at claim time include acts of war or terrorism by nation-state actors, incidents arising from a known vulnerability that the organization had been notified of but had not patched, incidents arising from prior known circumstances, failure to maintain specific security controls that were represented in the underwriting questionnaire, and losses arising from social engineering or fraudulent instruction schemes unless the policy specifically includes social engineering coverage. That last exclusion is one reason ongoing security awareness training matters as much to insurability as it does to prevention.

The war exclusion has become particularly contentious in cyber insurance following nation-state attribution in major ransomware campaigns. Some carriers have sought to deny ransomware claims on the basis that the attack was attributable to a nation-state actor, invoking the war exclusion. Review of the war exclusion language and any cyber-specific carve-outs in the policy is an important step in coverage evaluation.

Armour Cybersecurity’s Cyber Insurance Advisory engagement reviews the full policy language, identifies exclusions that present material risk given the organization’s environment, and advises on coverage that addresses those gaps.

Frequently Asked Questions

Does cyber insurance cover ransomware payments?

It depends on the policy. Most cyber policies include some ransomware coverage, but the specifics vary significantly. Some policies cover the ransom payment up to the full policy limit with carrier approval. Others impose sub-limits that may be well below a realistic ransom demand for an organization of your size and data profile. Some policies require that the carrier approve the ransom payment before it is made and may decline to approve payment in certain circumstances. Some policies include the cost of the negotiation specialist and decryption support within the ransomware sub-limit; others treat these as separate coverage categories. Reading the ransomware provisions in the policy document, not just the carrier summary sheet, is essential.

What is a cyber insurance sub-limit?

A sub-limit is a maximum coverage amount within a specific coverage category that is lower than the overall policy limit. For example, a policy with a one million dollar overall limit might have a two hundred fifty thousand dollar sub-limit for ransomware payments and a one hundred thousand dollar sub-limit for business interruption. Sub-limits are common in cyber insurance and significantly affect the practical value of coverage in a real incident. The sub-limits that matter most for most mid-market organizations are the ransomware sub-limit, the business interruption sub-limit, and any sub-limit on regulatory defense or fines.

Does cyber insurance cover employee mistakes?

Cyber insurance typically covers incidents caused by employee error, including accidental data disclosure and falling for phishing attacks that result in a breach, as long as the error was not intentional. Coverage for intentional acts by employees is typically excluded. Social engineering losses, where an employee is deceived into transferring funds or providing credentials to an attacker impersonating a trusted party, are covered under some policies but excluded under others. If social engineering is a material risk for your organization, which it is for most businesses that process wire transfers or hold valuable credentials, verify that the policy explicitly includes social engineering coverage rather than assuming it is included.

How much cyber insurance does a mid-market business need?

Coverage adequacy depends on the organization’s revenue, the sensitivity and volume of personal data it holds, the cost of its systems being unavailable for the typical duration of a ransomware incident, its regulatory exposure, and the value of potential third-party liability claims. A useful starting point is to model the financial impact of a realistic worst-case incident: the cost of a ransomware response including negotiation, decryption, and system restoration; the revenue lost during the outage; the cost of breach notification for the number of records the organization holds; and the potential regulatory fine under the most stringent applicable framework. The coverage limit should be sufficient to address that modeled loss. A cyber insurance advisory engagement develops this risk profile as a deliverable to inform both coverage scoping and the broker conversation.

Can cyber insurance be denied after a claim is filed?

Yes. Claim denials in cyber insurance occur most commonly when the policyholder made a misrepresentation in the underwriting questionnaire, when the claim falls within an exclusion, when the organization failed to maintain security controls that were represented as being in place during underwriting, or when the claim involves a circumstance that was known to the organization before the policy was bound. The risk of claim denial is reduced substantially by ensuring that underwriting questionnaire responses are accurate and supported by evidence, that the policy exclusions are understood before binding, and that any changes in the security environment after binding are reported to the carrier as required by the policy terms.

The Bottom Line

What does cyber insurance cover? On paper, the financial fallout of an incident: ransomware, business interruption, breach response, crisis communications, regulatory defense, and third-party liability. In practice, what you actually collect at claim time is decided by the sub-limits and the exclusions, the ransomware cap, the business interruption waiting period, the war exclusion, the social engineering carve-out, and the security controls you attested to at underwriting. The gap between the headline limit and the real recovery is where most businesses get caught. A cyber insurance advisory engagement reads the full policy, maps the exclusions to your environment, and tells you where you are exposed before you sign, not after a claim is denied.