Cyber liability FAQ
General answers about cyber insurance, claims, vendors, evidence, business interruption and the limits of this site.
What is cyber liability insurance?
It is business insurance designed to address specified first-party cyber costs, third-party claims, or both. The policy label alone does not establish what is covered.
Is cyber insurance the same as cybersecurity?
No. Cybersecurity concerns protection and operation. Insurance is a financial response mechanism that may apply after defined events and subject to conditions.
What is the difference between first-party and third-party coverage?
First-party coverage addresses certain losses of the insured organization. Third-party coverage addresses certain claims made against the organization by others.
Should an organization notify the insurer immediately?
Policies often contain notice requirements, and early contact may help confirm panel vendors and consent. The required timing and method depend on the actual policy and facts.
Can a business use any forensic or legal vendor?
Not always. Some policies require panel vendors or prior consent. Emergency and legal duties also matter, so qualified advisers should review the real situation.
Why are cyber claims denied or narrowed?
Common issues include late notice, unapproved costs, exclusions, sublimits, underwriting disputes, prior knowledge, weak financial support and a mismatch between the loss and covered-event wording.
Are ransomware payments always covered?
No. Coverage, insurer consent, legality, sanctions, exclusions and process can all affect the result. Payment also does not guarantee restoration or remove liability.
Does a cyber policy cover vendor outages?
Some policies include dependent business interruption or vendor-related coverage, but definitions, named dependencies, waiting periods and exclusions vary.
Are regulatory fines insurable?
Insurability can depend on jurisdiction, policy wording, the nature of the penalty and public policy. Defense or response costs may be treated differently from fines.
How are business interruption losses supported?
Claims may require revenue and expense records, operational evidence, a defensible counterfactual, saved-expense adjustments, waiting-period treatment and clear assumptions.
What evidence should be kept?
A useful claim file may include chronology, policy and notice records, technical findings, approvals, invoices, contracts, interruption support, communications and underwriting records.
Do the calculators on this site determine coverage?
No. They perform simplified arithmetic using user-entered assumptions. They do not interpret a policy or estimate what an insurer will pay.
Does this site store information entered into the tools?
The interactive tools run in the browser and do not submit entries to this site. The evidence organizer creates a local text file only when the user selects download.
Is the site legal or insurance advice?
No. It provides general educational information. Real decisions require review of the policy, facts, contracts, jurisdiction and qualified professional advice.