Cyber insurance
Can help your business respond to data breaches, cyber attacks and covered claims involving customer information.
How the coverage can help
One breach. Costs on both sides.
The incident
A stolen login
An attacker uses an admin account to access customer records.
Potential policy response
Incident response
The cost of investigating a breach and notifying affected people.
Claims from others
The cost of responding to covered claims about exposed data.
Response costs and liability coverage vary. Check the covered events, limits and required response procedures.
The fit
Who it’s for
Businesses that store customer information, accept electronic payments or depend on connected systems should consider their cyber exposure. Review the cost of responding to an incident as well as claims from others. Outsourcing hosting does not remove every response cost or responsibility.
The protection
What it can cover
- Responding to a breach.
- Incident-response coverage pays specified costs of investigating a breach and handling legal advice, notifications and support for affected people. For a startup without an in-house response team, the available specialists and reporting process are practical parts of the purchase.
- Getting operations running again.
- Data restoration and business-interruption coverage address specified recovery costs and income lost during a qualifying outage. Compare the outage causes included, the waiting period and whether an interruption at your cloud provider is covered.
- Claims from other people.
- Cyber liability addresses covered allegations that your company failed to protect data or network security. That is separate from paying your own incident-response costs, even when both arise from the same breach.
Follow a claim
From the incident to the insurance.
Scenario 01
A compromised account exposes customer data.
What happened
An attacker steals an admin login and accesses customer records. Your team discovers the unauthorized access.
What the business faces
Your team must contain the breach, investigate the access and work out which customers need notification.
Where this policy may help
Cyber may pay for a covered breach investigation and notices. Follow the policy’s reporting procedures.
Scenario 02
An attack interrupts your work.
What happened
An attacker takes an essential system offline. Your team cannot use the tools it needs to serve customers.
What the business faces
Work stops while your team restores service. Your business loses income and faces extra recovery costs.
Where this policy may help
Cyber may pay recovery costs and replace lost income. The policy must cover the event that caused the outage.
Illustrative scenarios. Whether a policy responds depends on the claim, policy terms, limits and exclusions.
Know the difference
Different policies. Different jobs.
Different policies address different losses. These comparisons explain where to look; they do not mean every coverage mentioned is available through Komodo.
Cyber insurance
Addresses data and security incidents, including specified costs to your own business.
Technology E&O
Addresses claims that your technology product or service caused a customer financial loss.
What to check Evaluate both if customers rely on your software. Tech E&O addresses a service failure without a breach; cyber adds the data and security incident coverage. Combined policies may share limits.
Cyber insurance
Addresses covered data and security incidents and related expenses.
Commercial crime
Addresses specified theft and fraud losses.
What to check For a fake vendor-bank-details request, look specifically for social engineering coverage. The words “cyber” or “crime” on a quote do not establish that this type of payment is covered.
Cyber insurance
May cover specified losses from a cyber incident.
Property insurance
Generally addresses physical loss or damage and related interruption.
What to check For lost income, identify the cause of the shutdown. Physical damage, a security attack and a cloud-provider failure are different coverage questions.
Good questions
Before you decide
Do I need cyber insurance?
Consider the data your business holds, the systems it relies on and any contractual insurance requirements. Cyber insurance may help with specified incident costs and liability claims; the right coverage depends on those exposures.
Which businesses need it?
Businesses handling customer data, electronic payments or connected operations may have cyber exposures. Review the activities and information involved rather than assuming that business size determines the need.
What does it cover?
A policy may include breach response, extortion, data recovery, business interruption and privacy liability coverage. Covered events, waiting periods, sublimits and exclusions vary.
What add-ons are available?
Some policies offer funds-transfer fraud, social engineering or media liability coverage. Ask which sections are included, which are optional and what conditions apply.
What isn’t covered?
Coverage is not automatic for every outage, payment scam or security incident. Review exclusions, prior-incident provisions and any separate terms for service providers, system failures and extortion.
What should I compare between cyber policies?
Compare covered events, response services, waiting periods, deductibles and limits. Check whether cloud-provider interruptions and payment fraud are included, and how incidents must be reported.
What does a claim look like?
Illustrative example: ransomware interrupts a shop’s checkout system. A policy may help with covered restoration costs or lost income, subject to the outage provisions, waiting period and limits.
Is cyber insurance enough on its own?
Cyber addresses a particular set of exposures. Your business may also need other coverage, such as general liability or professional liability; no single policy covers every risk.