What Does Cyber Liability Insurance Cover? (And What It Doesn't)

When our agency first reviewed cyber insurance policies, we were struck by how much jargon and ambiguity surrounded the actual coverage. Terms like "first-party," "third-party," "sublimits," and "retroactive dates" made it difficult to understand what we were actually buying — and more importantly, what we weren't.

After reading through multiple policy documents and consulting with brokers, we put together this plain-language breakdown of what cyber liability insurance actually covers, what it excludes, and how to avoid becoming part of the 40%+ of businesses whose claims get denied.

Disclosure: This article contains affiliate links. If you purchase a policy through our links, we may earn a commission at no extra cost to you. Our recommendations are based on independent research.

First-Party vs. Third-Party Coverage: The Core Framework

Every cyber insurance policy is built around two fundamental categories of coverage. Understanding this distinction is critical — it determines whether you're protected when something happens to your agency versus when something happens to someone else because of your agency.

Coverage Type	What It Protects	Who Benefits	Typical Scenarios
First-Party	Your agency's own losses and expenses	Your business directly	Ransomware hits your systems, your data is destroyed, your operations are interrupted
Third-Party	Claims and lawsuits from others	Clients, regulators, affected individuals	A client sues because their data was breached through your systems, a regulator investigates your data handling

Most comprehensive cyber policies include both, but the depth of coverage within each category varies dramatically between providers. Let's break down what falls under each.

First-Party Coverage: Protecting Your Agency

First-party coverage pays for your agency's direct costs when a cyber incident hits your own operations. These are the expenses you'll face in the hours, days, and weeks after discovering a breach or attack.

Incident Response and Forensics

When a breach occurs, the first thing you need is to understand what happened, how it happened, and what data was affected. Digital forensics investigations typically cost between $50,000 and $150,000 depending on the complexity of the incident and the size of your environment.

Your cyber policy covers the cost of hiring forensic investigators, which most policies require you to select from a pre-approved panel. This is actually a benefit — these panel firms have established relationships with the insurer, which streamlines the claims process and ensures the investigation meets the evidentiary standards needed if litigation follows.

Coalition includes proactive security monitoring with their policies, which can help detect incidents earlier and reduce forensic costs. Earlier detection generally means a smaller blast radius and lower overall claim.

Business Interruption

If a cyber incident takes your systems offline, business interruption coverage replaces your lost income and covers extra expenses incurred to maintain operations. For a digital agency that depends entirely on technology to deliver client work, this coverage is essential.

However, there's a critical detail most agencies miss: the waiting period. Business interruption coverage doesn't kick in immediately. Most policies impose a waiting period of 6 to 24 hours before coverage begins. That means if a ransomware attack takes your systems down for 8 hours and your policy has a 12-hour waiting period, you receive nothing for business interruption.

When we compared policies, we specifically looked for shorter waiting periods. Some providers offer 6-hour waiting periods as standard, while others default to 12 or even 24 hours. For an agency billing $200-$500 per hour across multiple team members, even a few hours of downtime represents significant lost revenue.

Data Recovery and Restoration

After an attack, you need to restore your systems and data. This coverage pays for the cost of recovering, restoring, or recreating data and software that was damaged, destroyed, or corrupted during a cyber incident.

This includes the cost of IT labor, replacement software licenses, and the painstaking process of rebuilding systems from backups (or from scratch if backups were also compromised). For agencies running complex tech stacks with multiple client environments, restoration costs can escalate quickly.

Ransomware and Cyber Extortion

Ransomware coverage pays for extortion demands — the ransom itself (if your insurer approves payment, which is increasingly rare) and the costs associated with responding to extortion threats. This includes hiring negotiators, which most insurers provide through their incident response panels.

A critical warning here: ransomware sublimits can dramatically reduce your effective coverage. Some policies cap ransomware payments at $100,000 even when your overall policy limit is $2 million. If you're hit with a $500,000 ransom demand and your sublimit is $100,000, you're covering the difference yourself. Always check the ransomware sublimit specifically — don't assume it matches your aggregate limit.

Crisis Management and Public Relations

A data breach doesn't just cost money in technical response — it can destroy your agency's reputation. Crisis management coverage pays for PR firms, communications consultants, and reputation management services to help you control the narrative and maintain client confidence.

Coverage for crisis management and PR services typically ranges from $10,000 to $250,000 depending on your policy limits and the severity of the incident. For a digital agency whose entire business depends on trust and reputation, this coverage can be the difference between surviving an incident and losing your client base.

Notification Costs

When personal data is breached, you're legally required to notify affected individuals in most jurisdictions. This sounds simple until you realize what it actually involves: identifying every affected person, drafting legally compliant notification letters, printing and mailing physical notices (still required in many states), setting up call centers to handle inquiries, and providing credit monitoring services.

For large breaches, notification costs alone can exceed $500,000. Even for a small agency breach affecting a few thousand individuals, costs of $50,000-$100,000 for notification and credit monitoring are common. Your cyber policy covers these mandatory expenses.

Credit Monitoring

Related to notification, most breach response plans include offering affected individuals 12-24 months of credit monitoring and identity theft protection services. At $10-$25 per person per year, this adds up quickly when thousands of individuals are affected. Your policy covers these costs as part of the breach response.

Third-Party Coverage: Protecting Against Claims from Others

Third-party coverage is where cyber insurance functions more like traditional liability insurance — it protects you when someone else suffers harm because of a cyber incident connected to your agency.

Client Lawsuits and Legal Defense

If a client's data is breached because of a vulnerability in your systems, or if malware spreads from your network to a client's environment, they may sue your agency for damages. Third-party coverage pays for your legal defense costs and any settlements or judgments.

For digital agencies, this is arguably the most important coverage category. You have privileged access to client systems — their CMS platforms, analytics accounts, ad accounts, social media profiles, and sometimes their customer databases. A breach originating from your access could expose you to significant liability.

Regulatory Defense and Fines

Data protection regulations carry serious financial penalties. Since GDPR took effect in 2018, total fines have exceeded €5.65 billion. In the US, state-level privacy laws (California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA, and others) create a patchwork of regulatory exposure.

Regulatory defense coverage pays for attorneys to represent you in regulatory investigations and proceedings. Some policies also cover the fines themselves, though this varies by jurisdiction — in some places, insuring against regulatory fines is prohibited by public policy.

An important distinction: most policies cover defense costs for regulatory proceedings even when they don't cover the fines themselves. The cost of defending a regulatory investigation can easily reach $100,000-$500,000 in legal fees alone, so this coverage has significant value regardless of fine coverage.

Media Liability

For digital agencies that create content, manage social media, or run advertising campaigns, media liability coverage protects against claims of defamation, copyright infringement, invasion of privacy, or other media-related torts committed through digital channels.

If your agency accidentally uses a copyrighted image in a client campaign, publishes content that's deemed defamatory, or creates an ad that infringes on someone's intellectual property, media liability coverage responds. This is particularly relevant for content marketing agencies, social media agencies, and PR firms.

PCI-DSS Fines and Assessments

If your agency handles payment card data — whether directly for e-commerce clients or through access to their payment systems — you may be subject to PCI-DSS (Payment Card Industry Data Security Standard) fines and assessments following a breach. These fines, imposed by card brands through acquiring banks, can range from $5,000 to $100,000 per month until compliance is achieved.

Third-party coverage typically includes PCI fines and assessments, but verify this explicitly if your agency touches payment data in any capacity.

Network Security Liability

If your agency's compromised systems are used to attack others — for example, if malware on your network spreads to clients, or if your compromised email server is used to send phishing emails — network security liability coverage protects you against claims from those affected third parties.

What Cyber Insurance Does NOT Cover

Understanding exclusions is just as important as understanding coverage. These are the scenarios where your claim will be denied, regardless of how much premium you've paid.

Intentional Acts

No cyber policy covers losses resulting from intentional, dishonest, or fraudulent acts committed by the insured or their executives. If a company officer deliberately causes a breach or knowingly violates data protection laws, the policy won't respond. This exclusion is standard across all insurance types.

Pre-Existing Vulnerabilities and Known Issues

If you knew about a security vulnerability before purchasing your policy and failed to address it, claims arising from that vulnerability may be denied. This is why the application process matters — insurers ask about your security posture, and material misrepresentations can void your coverage.

Coalition's pre-quote vulnerability scan actually works in your favor here. By identifying vulnerabilities during the quoting process, they establish a baseline. If you remediate the issues they flag, you've documented your good-faith security efforts.

Acts of War and Nation-State Attacks

This exclusion has become increasingly significant and controversial. Lloyd's of London issued updated guidance in 2024 requiring all cyber policies in their market to include explicit exclusions for state-backed cyber attacks and cyber operations occurring during armed conflicts.

The practical challenge: attribution is difficult. When a ransomware group with suspected ties to a nation-state attacks your agency, is that an "act of war"? The policy language matters enormously here, and it varies between carriers. Some policies use narrow war exclusions that only apply to declared conflicts, while others use broader language that could encompass state-sponsored criminal groups.

When reviewing policies, pay close attention to how the war exclusion is worded. Narrower is better for the policyholder.

Criminal Fines vs. Defense Costs

While most policies cover the cost of defending against regulatory proceedings, many exclude coverage for the actual criminal fines or penalties imposed. This distinction between defense costs (covered) and penalties (often excluded) catches many policyholders off guard.

Some jurisdictions prohibit insuring against criminal penalties on public policy grounds — the logic being that allowing insurance to cover fines would undermine their deterrent effect.

Poor Cybersecurity Practices

Increasingly, insurers are including conditions that require policyholders to maintain minimum security standards throughout the policy period. If you represented during the application that you use MFA on all systems, then disable it six months later, and a breach occurs exploiting that gap, your claim may be denied.

This is the cyber insurance equivalent of a homeowner's policy requiring working smoke detectors. The insurer is sharing risk with you, not absorbing all of it.

Insider Threats (Partial Exclusion)

Coverage for insider threats — employees or contractors who deliberately steal data or sabotage systems — varies significantly between policies. Some policies cover insider threats fully, others exclude them, and many cover them with reduced sublimits. If insider risk is a concern for your agency (and it should be — insider threats account for a significant percentage of breaches), verify how your policy handles this scenario.

Third-Party Vendor Breaches (Partial Exclusion)

If a breach occurs at one of your vendors — your cloud hosting provider, your project management platform, your email service — and your data is compromised as a result, coverage depends heavily on your specific policy language. Some policies cover vendor breaches as a standard inclusion, while others exclude or sublimit them.

For digital agencies that rely heavily on third-party SaaS tools, this is a critical coverage gap to evaluate.

The Sublimit Trap: Where Coverage Falls Short

Even when something is technically "covered," sublimits can dramatically reduce your effective protection. Two areas are particularly problematic for digital agencies:

Social Engineering Sublimits

Business email compromise (BEC) and social engineering attacks — where an attacker impersonates a trusted person to trick you into transferring funds or sharing credentials — are among the most common and costly attacks targeting agencies. The average BEC attack costs between $200,000 and $300,000.

However, many cyber policies cap social engineering coverage at just $100,000 to $250,000 through sublimits. If your policy has a $2 million aggregate limit but a $100,000 social engineering sublimit, you're severely underinsured for one of the most likely attack scenarios.

When shopping for coverage, specifically ask about social engineering sublimits and push for the highest available. Some providers, like Hiscox, offer straightforward policies where these sublimits are clearly stated upfront, making comparison easier.

Ransomware Sublimits

Similar to social engineering, some policies impose separate sublimits on ransomware-related costs. A policy with a $2 million overall limit might cap ransomware at $100,000 — covering the forensics and recovery but leaving you exposed on the extortion payment and extended business interruption.

Given that ransomware is the most feared cyber threat for most agencies, this sublimit deserves careful scrutiny during the purchasing process.

The 40%+ Claim Denial Rate: Why It Happens and How to Avoid It

Here's the statistic that should concern every cyber insurance buyer: over 40% of cyber insurance claims are denied or only partially paid. That's a staggering failure rate for a product designed to protect you in a crisis.

Understanding why claims get denied is the key to ensuring yours won't be:

Reason 1: Material Misrepresentation on the Application

The most common cause of claim denial is a discrepancy between what you stated on your application and your actual security posture at the time of the incident. If you checked "yes" for MFA on all systems but your VPN didn't have MFA enabled, and the breach came through the VPN, your claim is at risk.

How to avoid it: Answer every application question honestly and precisely. If you're unsure whether a control is fully implemented, say so. It's better to get a slightly higher premium based on accurate information than to have a claim denied based on inaccurate information.

Reason 2: Failure to Meet Policy Conditions

Many policies include ongoing conditions — requirements you must maintain throughout the policy period. Common conditions include maintaining MFA, keeping software patched within specified timeframes, and maintaining backup procedures. Failing to meet these conditions can void your coverage.

How to avoid it: Read your policy conditions carefully and document your compliance. Treat policy conditions like contractual obligations — because that's exactly what they are.

Reason 3: Late Notification

Cyber policies typically require you to notify your insurer within a specific timeframe after discovering an incident — often 48 to 72 hours. Late notification is a common basis for claim denial or reduction.

How to avoid it: Know your notification requirements before an incident occurs. Include your insurer's claims hotline number in your incident response plan. When in doubt, notify early — you can always provide additional details later.

Reason 4: Exclusion Applicability

Sometimes claims are denied because the incident falls within a policy exclusion that the policyholder didn't realize applied. War exclusions, prior-knowledge exclusions, and intentional-act exclusions are common culprits.

How to avoid it: Read your exclusions before you need to file a claim. If an exclusion concerns you, discuss it with your broker or insurer before binding the policy.

Reason 5: Sublimit Exhaustion

Technically not a denial, but functionally similar — when a sublimit is exhausted, the insurer stops paying even though your overall policy limit hasn't been reached. This is particularly common with social engineering and ransomware sublimits.

How to avoid it: Identify all sublimits in your policy and evaluate whether they're adequate for realistic loss scenarios.

How to Protect Yourself: A Pre-Purchase Checklist

Based on our research and experience, here's what we recommend every digital agency do before purchasing or renewing cyber insurance:

1. Read the Actual Policy Wording

Don't rely on marketing summaries or broker descriptions. Request the full policy form and read it — especially the exclusions, conditions, and definitions sections. If you don't understand something, ask your broker to explain it in plain language.

2. Verify Every Sublimit

Create a list of every sublimit in the policy and compare it against realistic loss scenarios for your agency. Pay special attention to social engineering ($100K-$250K caps vs. $200K-$300K average losses), ransomware, and business interruption sublimits.

3. Check the Retroactive Date

Your policy's retroactive date determines how far back coverage extends for incidents that are discovered during the policy period but actually occurred earlier. Ideally, your retroactive date should be "full prior acts" (no limitation) or at least match the date you first purchased cyber insurance.

4. Ensure Social Engineering Coverage Is Adequate

Given that BEC and social engineering are among the most common attacks targeting agencies, verify that your social engineering sublimit is at least $250,000. If the standard sublimit is lower, ask about endorsements or riders to increase it.

5. Understand the Claims Process

Before you need to file a claim, understand: Who do you call first? What's the notification deadline? Do you need pre-approval before hiring incident response vendors? Can you use your own forensics firm, or must you use the insurer's panel? Knowing these answers in advance saves critical time during an actual incident.

6. Document Your Security Posture

Maintain records of your security controls, training programs, and compliance efforts. If a claim is ever disputed, this documentation proves you met your policy conditions. Screenshots of MFA configurations, training completion records, and patch management logs are all valuable evidence.

Choosing the Right Coverage for Your Agency

For most digital agencies, we recommend a policy that includes both robust first-party and third-party coverage with specific attention to:

• Social engineering sublimits of at least $250,000
• Ransomware coverage without restrictive sublimits
• Business interruption with a waiting period of 8 hours or less
• Regulatory defense costs including GDPR, CCPA, and state privacy laws
• Media liability if your agency creates content or manages social media

Coalition offers some of the broadest coverage in the market, particularly for tech-savvy agencies that value their active monitoring and security tools. Their policies tend to have fewer restrictive sublimits and more inclusive coverage language. For agencies that want simpler, more affordable coverage without the extras, Hiscox provides clear, straightforward policies that are easy to understand and compare.

The most important thing is to actually read what you're buying. Cyber insurance is only valuable if it pays when you need it — and understanding your coverage, exclusions, and conditions before an incident is the best way to ensure it does.