Practical guide
Common cyber insurance exclusions and how to avoid a denied claim
Review cyber exclusions, security conditions and reporting requirements before an incident. A practical guide without promising that every claim can be covered.
Updated October 2026. About a 8 minute read.
Key point
You cannot guarantee that a claim will be paid. You can reduce avoidable problems by giving accurate application answers, reading exclusions and endorsements, reporting promptly and obtaining required consent for response expenses.
Covered trigger
Does the event fit an insuring agreement?
Restrictions
Do exclusions or conditions change the answer?
Required process
Were notice and consent duties followed?
| Provision | Potential effect | Practical review action |
|---|---|---|
| Known circumstances | Earlier known problems may fall outside cover | Disclose relevant facts and keep records |
| Contractual liability | Extra promises may exceed insured liability | Review indemnities and liability caps |
| Security conditions | Specific required controls may affect cover | Confirm actual scope and exceptions |
| War or state backed attack | Defined events may be excluded | Read definitions and attribution process |
| Notice and consent | Late reporting or unapproved costs can cause disputes | Keep contacts and follow policy procedures |
Exclusions are only one part of the review
A claim can fail because the event never meets the coverage trigger, a limit is exhausted or a condition is not satisfied. Those are not all exclusions, even though the result may feel the same to the owner. Separate the insuring agreements, definitions, exclusions and conditions when reading a policy. A broad marketing description is not enough to establish that the business has cover for a particular loss.
The New York DFS Cyber Insurance Risk Framework emphasizes careful underwriting and clarity about cyber exposures. Use that same discipline when comparing offers. Ask which section would address a plausible incident and then read the restrictions affecting it. This guide cannot guarantee payment or determine coverage for an actual dispute. It offers a practical way to identify questions before purchasing and to avoid administrative mistakes during a stressful response.
Known events and prior work need accurate disclosure
Policies can restrict cover for incidents, claims or circumstances already known before coverage begins. The wording and application questions determine what must be disclosed. A business that noticed suspicious activity before buying insurance should not assume later discovery of the full damage makes everything new. Keep a factual record and obtain advice on the disclosure and reporting duties that apply.
Claims made terms, prior acts provisions and retroactive dates can affect whether earlier activity falls within cover. They are not identical across every cyber product. At renewal or when switching insurers, compare these provisions explicitly. Do not reset a date or allow a reporting gap merely to obtain a lower price without understanding the consequence. If a question is unclear, request written clarification instead of choosing the answer you think an underwriter wants.
Contract promises can exceed insured liability
A customer contract may require you to reimburse any loss, waive defenses or accept responsibility beyond what the law would otherwise impose. A contractual liability exclusion can restrict some of that exposure. Other wording may preserve coverage for liability the business would have without the contract. The exact distinction matters. Do not assume signing an indemnity causes an insurer to insure everything it promises.
Review the largest or most demanding contracts alongside the policy. Ask about service credits, penalties, guaranteed performance and uncapped breach obligations. An insurer may distinguish legal liability from voluntary payments or business goodwill. Obtain consent before offering reimbursement after an incident where the policy requires it. Commercially sensible promises still need to fit your financial capacity, even when insurance does not cover them.
Security conditions are not a universal exclusion
An application answer, a warranty and an ongoing security condition can have different legal effects. Some policies specify controls that must be maintained. Others assess the accuracy of answers through applicable insurance law. It is misleading to say every missing patch automatically voids cyber coverage. It is equally unsafe to assume inaccurate statements about MFA or backups cannot affect a claim.
Describe control scope carefully, including exceptions and planned improvements. Keep the evidence supporting the application and notify the insurer of material changes as required. If a provider manages IT, confirm what it actually delivers rather than relying on a sales description. Ask how an isolated failure or unsupported device interacts with the wording. A qualified adviser can help interpret the condition before the business accepts it.
War, systemic events and other specific restrictions
Some cyber contracts contain war or state backed attack exclusions, and certain markets have introduced requirements concerning those provisions. Lloyd's bulletin Y5381 is a primary example of market requirements, not wording that automatically applies to every US small business policy. Ask how the proposed contract defines an excluded event and deals with attribution, location and related damage. Avoid assuming that any government linked attacker means every claim is excluded.
Other restrictions can involve infrastructure outages, payment transfers, property damage or particular kinds of liability. An exclusion may have an exception or a buyback endorsement, so read the complete contract. Ask about the vendor dependencies and realistic losses most relevant to your company. A small company should not pay for broader wording it does not need, but it should recognize when a lower quote leaves an important exposure uninsured.
Hypothetical worked example: an agency response
This invented illustration assumes an agency incurs $24,000 of eligible response expenses, plus $6,000 for a provider hired without the prior consent required by its assumed contract. Suppose the insurer accepts only the $24,000 and applies an assumed $5,000 retention. Its assumed payment is $19,000. The agency pays $11,000 in total, including the unaccepted $6,000 expense. These figures are not reported costs or an actual coverage decision.
The insurer might reach a different result under a real contract, applicable law or emergency circumstances. The example shows why consent and vendor arrangements should be understood before an incident. It does not advise delaying necessary containment. Call the response hotline promptly, explain urgent needs and record instructions. Where authorization is unclear, obtain qualified help rather than treating every emergency invoice as automatically reimbursable.
What drives the cost up or down
Broader triggers, fewer restrictions and stronger limits can affect pricing, but their value depends on what the business needs. A narrow policy may cost less without being equivalent. Past incidents, sensitive information, vendor dependence and the quality of security evidence can also change the offer. Higher retentions can shift more loss to the insured. None of these establishes a fixed market percentage change.
This guide does not give a premium range because a verified comparable public range for the specific exclusion choices is not established. Compare actual quotations on the same assumptions and request the endorsements before making a decision. Keep a final copy of the application and issued wording. During an incident, report promptly, preserve evidence and follow reasonable response instructions. If a claim is disputed, seek qualified advice and ask the insurer to explain its position with references to the contract.
Plan your insurance budget
Use the cyber liability cost calculator for a planning range with visible assumptions. It is a model, not an insurer quotation or a guarantee of coverage.
Frequently asked questions
Can I eliminate every risk of a denied claim?
No. Coverage depends on the contract, facts and applicable law. Accurate disclosure, a clear understanding of terms and compliance with reporting and consent duties reduce avoidable problems, but they cannot guarantee that every loss is eligible.
Does one failed security control void the whole policy?
Not automatically. Its effect depends on application statements, conditions, policy wording and applicable law. Do not assume either complete loss of cover or no consequence. Disclose scope accurately and obtain advice on the particular provision.
Are all state backed attacks excluded?
No universal answer applies to every policy. Definitions and market requirements vary. Read the actual exclusion, its exceptions and attribution process. The Lloyd’s bulletin cited here concerns its market requirements and is not a substitute for your issued contract.
Can I choose any response provider?
Check the policy first. Approved panels and consent conditions can affect expense eligibility. Keep the incident hotline available and discuss urgent requirements promptly. Necessary containment matters, but an unapproved invoice is not automatically reimbursable.
What should I do if the insurer denies a claim?
Request a written explanation identifying the relevant wording and facts. Preserve communications and seek qualified coverage advice. Follow applicable dispute and complaint processes. This guide is general education and cannot determine the merits of an individual claim.
Related reading
Sources
These primary sources support the coverage distinctions and operating guidance discussed above. Security guidance is not an insurance contract. Published product descriptions illustrate possible cover, while your issued wording and applicable law control a claim.
- New York DFS: Cyber Insurance Risk Framework. Primary regulator guidance on underwriting cyber risk and clarity about cyber exposure in insurance products.
- Lloyd’s: Market bulletin Y5381. Primary market requirements concerning state backed cyber attack exclusions. Application depends on the policy and market involved.
- CISA and FBI: StopRansomware Guide. Security controls, incident response and recovery guidance. This is security guidance, not insurance wording.
- NAIC: Cybersecurity insurance. Consumer and regulatory context for cyber insurance and the distinction between business losses and liability.
- Travelers: How does cyber insurance work?. Published insurer explanation of cyber coverage. Your issued policy and endorsements control any claim.
All worked examples are clearly hypothetical. Their dollar amounts and percentages are assumed calculation inputs, not premium benchmarks, reported claims or statistics. No unverified market premium or control discount is presented.