Cyber insurance pays for the financial damage of a cyberattack: the forensic investigation, the recovery, the lost income and the legal claims that follow. It has also become one of the most demanding documents a small business signs. The application asks detailed questions about your security, and the answers decide whether the policy pays. Here is what cyber insurance is, what it covers, what it leaves out, and what insurers check before they cover you.
What is cyber insurance?
Cyber insurance, also called cyber liability or cyber risk insurance, is a policy that covers losses from data breaches, ransomware, email fraud and other cyber incidents. It sits apart from general liability and property insurance, which usually exclude cyber losses or cover them only in narrow ways.
A cyber policy has two halves. First-party coverage pays your own costs. Third-party coverage pays claims that others bring against you. Most small-business policies include both, with a separate limit or sublimit for each type of loss.
What does cyber insurance cover?
Policies vary, so the wording of your own policy always decides. The common first-party coverages are:
- Incident response: breach counsel, forensic investigators and the firm that contains the attack.
- Data restoration: rebuilding systems and recovering data from backups.
- Business interruption: income lost while systems are down, and the extra expense of keeping the business running.
- Extortion: negotiation and, where the law allows, a ransom payment. The U.S. Treasury has warned that paying certain groups can violate sanctions.
- Notification: letters to affected people, call centers and credit monitoring.
The common third-party coverages are:
- Privacy and network security liability: claims from customers or partners whose data was exposed.
- Regulatory defense, and fines where the law allows them to be insured.
- PCI fines and assessments that card brands pass through your acquiring bank, on some policies.
- Media liability for content published on your website or social accounts.
Funds-transfer fraud and social engineering, where an employee is tricked into wiring money, are often a separate coverage with a lower sublimit. Ask your broker about this one directly, because it is the most common type of claim.
What does cyber insurance not cover?
Every policy has exclusions. Common ones include incidents that started before the policy began, war and state-backed attacks, the cost of upgrading your systems after an incident, bodily injury and property damage, and losses caused by a failure to maintain the security controls you described on the application. Many policies also require you to use the carrier’s panel of breach response firms, or to get the carrier’s consent before you hire your own.
What do insurers ask before they cover you?
The application is a signed statement about your security. Carrier forms differ, but they ask about the same controls: multi-factor authentication on remote access, administrator accounts, email and backups; endpoint detection and response on every workstation and server; firewalls, a patched VPN and no remote desktop open to the internet; offline or immutable backups that are restore-tested; email filtering with DMARC; patching and end-of-life software; logging that someone reviews; phishing training; a tested incident response plan; and a callback before any wire transfer or change to a vendor’s bank details.
Some carriers scan your internet-facing systems before they bind a policy and write critical findings onto the quote as conditions. Everything else is taken on your word and tested after a loss. Our cyber insurance readiness page walks through each control and includes a six-minute video on what carriers ask and how they check.
Why does one wrong answer matter?
An insurer prices and writes the policy on your answers. If an answer turns out to be wrong, the insurer can dispute the claim or ask a court to rescind the policy. In Travelers v. International Control Services (2022), the application said multi-factor authentication protected administrative access. Travelers alleged it protected only the firewall, and an agreed order rescinded the policy from the start. We covered the case in detail in Why Your Cyber Insurance Policy May Already Be Void.
What are cyber insurance claims made of?
Claims data shows where small businesses actually lose money. Coalition reported that in 2025, business email compromise and funds-transfer fraud made up 58 percent of its claims. At-Bay reported that in 2025, VPNs and remote desktop were the way in for 87 percent of its ransomware claims. Two controls follow directly from those numbers: a phone callback before any payment change, and a remote access setup that is patched, protected by multi-factor authentication and not exposed to the internet.
The market itself has eased. Marsh reported global cyber insurance rates down 4 percent in the second quarter of 2026. Lower prices do not mean shorter applications, and the questions about controls have not gone away.
How do you choose a cyber insurance policy?
- Work with a broker who places cyber regularly, and give them accurate answers early in the renewal.
- Compare limits and sublimits, especially for funds-transfer fraud and business interruption.
- Check the retention, the waiting period for business interruption, and the exclusions.
- Ask whether you must use the carrier’s breach response panel.
- Match every answer on the application to a system you can show working.
How does Triton help?
Triton Technologies works alongside your broker, never in place of your broker. Our vCISO team checks each application question against your real systems and writes the policy behind every yes. Our managed services team puts the controls in place: Sophos firewalls, Sophos XDR on every endpoint, multi-factor authentication on every login the application asks about, immutable AWS backups with documented restore tests, and patching and end-of-life replacement through vendor management. When your renewal arrives, or your broker sends a questionnaire you cannot answer with confidence, contact Triton or call (866) 304-4300.
Other providers will sell you tools to comply. Triton makes you compliant.
Sources
- Travelers v. International Control Services, C.D. Ill. No. 2:22-cv-02145
- Coalition 2026 Claims Report
- At-Bay 2026 InsurSec Report
- Marsh Global Insurance Market Index, Q2 2026
- U.S. Treasury OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 21 September 2021
- Cyber applications from Travelers, Beazley, Corvus, CFC, Axis, Tokio Marine HCC and Cowbell
This article is general information, not legal or insurance advice.
Let's Discuss Your IT Needs
Triton Technologies delivers managed IT services, cybersecurity, and IT support for businesses across New England. Contact our team today to start a conversation about your technology environment.
