What does cyber insurance cover? Cover, exclusions and the fine print

By Kike Gandia · Co-Founder & CEO, OSCP

A cyber insurance policy covers two things: what a cyberattack costs you (incident response, system recovery, business interruption, extortion, fraud) and what others can claim from you because of it (exposed client data, malware spreading to others, legal defence). But the name of each cover says little: what decides whether a policy pays are its sublimits, deductibles, waiting periods, exclusions and the time limits on claims. This guide goes through each cover, what usually falls outside it and how to check what yours really covers.

What cyber insurance covers at a glance

Cyber policies group their covers in blocks that look fairly similar across insurers. What changes, a lot, is the fine print of each one:

Cover	What it includes	What to watch
Incident response	Forensics, containment, legal advice, crisis management and notifying affected people	Whether you must use the insurer's provider panel
Data and system recovery	Restoring data, reinstalling and reconfiguring systems	It does not pay to improve systems, only to return them to their previous state
Business interruption	Revenue lost while operations are down	The waiting period before it pays and the maximum indemnity period
Cyber extortion	Negotiation and, where the law allows, paying the ransom	Its own sublimit and the insurer's prior approval
Social engineering fraud	CEO fraud and supplier impersonation	Often not in the base package or with a low sublimit
Third-party liability	Claims over exposed data or malware spreading to others, and legal defence	Time limits on claims
Regulatory proceedings	Defence before the data protection authority	The fine itself only where insurable, which is debated in Spain

First-party losses: what the attack costs you

This is the block an SMB claim uses most, because it covers the costs of the first hours and days:

Incident response: the forensic team that works out how the attacker got in and what they took, containment, the lawyers assessing notification duties and, for incidents with public impact, communications and reputation management.
Notifying affected people: the cost of informing clients or employees whose data was compromised and, in some policies, identity monitoring services for them.
Data and system recovery: restoring from backups, reinstalling and reconfiguring machines and applications. The general rule is returning systems to their pre-incident state, not paying for an upgraded version.
Business interruption: revenue lost while the website, the ERP or production is down, usually after a waiting period of several hours set in the policy.

Business interruption caused by an outage at one of your technology providers —your cloud, your management software or your payment provider— is a separate cover, sometimes called contingent or dependent business interruption, and many policies exclude or limit it unless it is bought expressly.

Third-party liability: what others can claim from you

The second block responds when the incident harms others and they claim against you:

Exposed personal data: Article 82 of the GDPR gives anyone harmed by an infringement the right to claim compensation from the controller. If the breach was caused by one of your suppliers, you answer first and can then recover from them.
Spreading to third parties: if malware spreads from your systems to a client or supplier, they can claim damages from you.
Legal defence: lawyers' fees and procedural costs, which are often the largest item in the claim.

Some policies add liability for digital content, such as intellectual property or image right infringements on the company's website or social media. It is worth checking whether it is included or must be bought separately.

Ransomware: what the insurance pays and what it does not

Ransomware touches almost every cover at once: incident response, system recovery, business interruption and, if data was stolen, third-party liability. The specific cyber extortion cover is the one with the most conditions:

It usually has its own sublimit, lower than the policy's overall limit.
It requires the insurer's prior approval before anything is paid and the involvement of its negotiators.
It cannot be paid to people or groups on EU sanctions lists, whatever the policy says.

In practice, paying the ransom is the last resort. The preferred route is recovering from clean, isolated backups, which is exactly why underwriting questionnaires ask so much about backups and whether restores have been tested.

CEO fraud and fraudulent transfers

Social engineering fraud —an employee who transfers money believing they are following instructions from an executive or a real supplier— is one of the most frequent incidents in SMBs and, at the same time, one of the covers that causes the most surprises:

In many policies it is not part of the base package and has to be bought as an extension.
When included, it usually has a sublimit well below the overall limit.
Some make cover conditional on a verification procedure for bank account changes, such as a confirmation call to an already known phone number.

Because CEO fraud does not require compromising any system —a convincing email is enough— it easily falls outside a policy that only covers technical incidents. It is the first question to ask if your company makes frequent transfers to suppliers.

Does it cover data protection fines?

This is the question with the least clear answer. What policies usually do cover is defence in the penalty proceedings before the Spanish Data Protection Agency (AEPD) and the costs of notifying the breach. The fine itself is another matter: in Spain it is debated whether a punitive administrative penalty is insurable, since insuring it would empty it of its deterrent effect, and there is no settled doctrine on it.

That is why many policies say they cover penalties "where insurable" or "where permitted by law", often with a modest sublimit. If this cover matters to your decision, the prudent thing is to ask the insurer for its position in writing before buying and not to assume the fine will be covered.

What it does not cover: the most common exclusions

Every wording has its own, but these appear in most policies on the market:

Prior or known events: incidents that happened before the retroactive date or that the company knew about when buying.
Deliberate acts by the insured.
War and state-attributed attacks: in the Lloyd's market, for example, standalone cyber policies must include a state-backed attack exclusion since March 2023. The wording varies and is worth reading.
Infrastructure failures: power, telecoms or Internet outages that are not due to an attack on your company.
System upgrades: whatever it costs to leave security better than it was before the incident.
Intellectual property and trade secrets: the loss of value of stolen information, unless specifically covered.
Property damage and bodily injury resulting from the incident, which usually belong to other policies.
Declared controls that were not in place: not strictly an exclusion, but under Article 10 of the Spanish Insurance Contract Act it reduces the payout proportionally, or cancels it in case of fraud or gross negligence.

The fine print: limits, sublimits, deductibles and waiting period

Two policies with the same limit can pay very different amounts for the same claim. These are the concepts that explain why:

Concept	What it is	Illustrative example
Limit of indemnity	The most the policy pays in total, per claim or per year	€500,000
Sublimit	A specific cap on one cover within the overall limit	Cyber extortion capped at €100,000
Deductible	The part of each claim the company always pays	The first €3,000 of each claim
Waiting period	Hours of downtime not indemnified under business interruption	The first 12 hours of outage
Indemnity period	Maximum time business interruption is covered for	Up to 90 days

The figures in the table are an example to show how the pieces fit, not market values: each policy sets its own. What matters is that the sublimit, not the overall limit, decides how much you receive for a ransomware attack or a CEO fraud.

When it covers: time limits on claims

Third-party liability covers usually work on a claims-made basis: they cover claims made while the policy is in force, even if the incident behind them happened earlier. Article 73 of the Spanish Insurance Contract Act allows these clauses in two forms: either claims made up to at least one year after the contract ends are covered, or claims made during the policy term are covered for events going back at least one year before it started.

They are limiting clauses, so they must be highlighted in the policy and specifically accepted in writing. When switching insurer, check the new policy's retroactive date: if it is the date you bought it, an incident brewing before the switch can end up covered by neither.

How to check what your policy covers

Before signing or at your next renewal, these are the questions worth having answered in writing:

What sublimits apply to cyber extortion, social engineering fraud and business interruption?
What is the business interruption waiting period and how long is the indemnity period?
Is an outage at a technology provider I depend on covered?
Do I have to use the insurer's provider panel, or can I call my usual security team?
What is the retroactive date and how are claims limited in time?
What is the insurer's position on data protection penalties?
Which controls did I declare in the questionnaire, and can I prove today that they are still active?

The last question is the one that decides the most claims and the only one that depends entirely on you. The broker or insurer answers the rest.

FAQ

Does cyber insurance cover ransomware?

Usually yes, through several covers at once: incident response, system recovery, business interruption and, if data was stolen, third-party liability. Paying the ransom, when included, has its own sublimit, requires the insurer's prior approval and cannot be made to people or groups sanctioned by the EU.

Does it cover CEO fraud?

It depends on the policy. In many it is not part of the base package and must be bought as an extension, and when included it usually has a low sublimit. Some insurers also require a verification procedure for bank account changes to have been in place.

Does it cover GDPR fines?

Defence in the penalty proceedings and notification costs, usually yes. The fine itself is debatable: in Spain it is argued whether a punitive administrative penalty is insurable, and many policies only cover it "where insurable". Ask the insurer for its position in writing before buying.

What if the attack comes through a supplier?

The losses the incident causes you are usually covered even if a supplier was the origin. What changes is business interruption caused by the supplier's own outage —your cloud, your management software—, which many policies exclude or limit unless you expressly buy contingent business interruption cover.

Does it cover employee mistakes?

Generally yes when the mistake triggers a covered security incident, such as opening a malicious attachment or falling for phishing. Human errors that are not a security incident, such as accidentally deleting data, are only covered by policies that expressly include them.

How is it different from general liability insurance?

General liability insurance covers damage you cause to others in your business, but more and more of these policies expressly exclude cyber risks and data. It also does not cover your own losses: neither system recovery, business interruption nor extortion. That is why cyber insurance exists as a separate product.

What happens if I declared a control I did not have?

Under Article 10 of the Spanish Insurance Contract Act, if the declaration was inaccurate and a claim arrives before it is corrected, the payout is reduced in proportion to the premium that would have been charged knowing the real risk, and in case of fraud or gross negligence the insurer is released from paying. That is why controls should be verified before declaring them.

Sources

Get my company ready for cyber insurance