Key Exclusions

Why exclusions matter here

Exclusions are the events, circumstances or types of loss that a policy does not cover. They matter more than usual in cyber insurance because one incident often straddles the line between covered and excluded. A cyber policy carries the standard exclusions common to general insurance and also cyber-specific ones that arise from digital risk.

Social engineering and funds transfer fraud

In social engineering fraud nobody breaks into a system. An employee is tricked into voluntarily transferring funds, for example by an email that appears to come from a senior executive or by a manipulated vendor invoice. This loss is often excluded from the base cyber policy, or covered only up to a sub-limit, unless an endorsement is bought.

The Social Engineering Fraud and Funds Transfer Fraud covers are distinct covers that are often sold together. They respond to loss from business email compromise, impersonation of a senior executive and manipulated vendor invoices, exposures that matter most to businesses moving large sums by wire. They usually carry a sub-limit and conditions such as verifying payment instructions.

By contrast, forensics and legal defence are standard covers, and ransom payments are usually covered subject to the insurer's consent and the policy limits.

Minimum security standards

Cyber policies often require minimum security standards as a condition of cover: multi-factor authentication (MFA), firewalls and patching are the usual examples. Where the insured did not maintain them and that contributed to the loss, the insurer may decline the claim. A rejection because MFA was not enabled rests on this minimum security standards warranty.

The same thinking lies behind the treatment of known critical vulnerabilities left unpatched, which some policies exclude and others restrict through conditions or sub-limits.

Physical damage and prior known events

Bodily injury and physical property damage caused by a cyber attack are generally excluded from cyber policies. If a hacked industrial control system causes a factory explosion, the physical damage is outside the cyber policy. It may fall under property or liability insurance instead, but many of those policies now carry cyber exclusions of their own, so the wording of each needs checking.

The prior known events exclusion removes incidents or circumstances the insured knew of before the policy began. Insurance covers the unknown, not a loss already in progress. Failing to disclose such matters is a separate breach of the duty of good faith, so a known breach that was kept quiet creates two problems, not one.

Rules at a glance

Key points

• Social engineering fraud is often excluded from, or sub-limited in, the base policy unless added by endorsement.
• Social Engineering Fraud and Funds Transfer Fraud covers are distinct, often sold together, and usually carry a sub-limit and verification conditions.
• Ransom payments are usually covered subject to the insurer's consent and the policy limits.
• Failure to maintain required security standards, where it contributed to the loss, may lead the insurer to decline the claim.
• Bodily injury and physical property damage from a cyber attack are generally outside a cyber policy.
• Incidents or circumstances known before the policy began are excluded, and non-disclosure is a separate breach of good faith.

Common misunderstandings

• A cyber policy does not cover every loss that begins with an email: voluntary transfers induced by fraud are often excluded or sub-limited unless endorsed.
• Physical damage from a hack is not a cyber claim: it is generally excluded, and the property or liability policy may carry its own cyber exclusion.
• Security requirements are not a formality: they are often conditions of cover, so the wording has to be checked for how they apply.
• Buying a policy after discovering a breach does not bring that breach into cover: prior known events are excluded.

Questions people ask