Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Cyber Insurance?

Definition

Cyber insurance is coverage that pays some of the costs of a cyberattack or data breach, such as incident response, data restoration, lost income, legal advice, notification, and claims brought by others. What it actually pays depends on the policy wording: its limits, its exclusions, and the security promises you made on the application.

How It Works

Coverage usually falls into two groups, which the National Association of Insurance Commissioners (NAIC) tracks as first-party and third-party claims:

  • First-party: your own costs, such as forensic investigation, restoring systems and data, business interruption, and extortion response.
  • Third-party: claims against you, such as customers or partners suing over exposed data, and regulatory defense.

Cyber cover is sold in different forms. The NAIC's 2025 market report separates primary policies, excess policies that sit above another policy, and endorsements, which add cyber coverage to another policy such as a business owner's package. Endorsements made up 55.1% of policies in force in 2024 but only 4% of premium, which the NAIC describes as "high-volume but low-premium products."

Three things decide whether a claim pays:

  • The application. Your answers about security controls become part of the deal, so they must be accurate and stay accurate.
  • Exclusions. Carve-outs vary by policy; the case below turned on a war exclusion.
  • Conditions. Check notice deadlines and whether the policy names vendors or counsel you must use.

Real-World Example

In May 2023, a New Jersey appeals court ruled in Merck & Co. v. ACE American Insurance Co. that insurers could not use a "hostile/warlike action" exclusion in Merck's "all risks" property policies to deny its claim for the June 2017 NotPetya attack. These were property policies, not cyber policies, but the lesson carries over. The court described malware delivered through backdoored updates to M.E. Doc, a Ukrainian accounting program, that infected over 40,000 machines in Merck's network. The insurers argued the attack was the work of the Russian state. The court held the exclusion required a connection to military action, and $699,475,000 in disputed coverage turned on that wording.

Why It Matters for a Small Business

The market is large and changing. The NAIC reported about $9.14 billion in U.S. cyber premiums written in 2024, the first annual decline on record, while the number of claims rose almost 40% to nearly 50,000. The U.S. Government Accountability Office found in 2021 that differing definitions of policy terms such as "cyberterrorism" can make it unclear what is covered. For a small business, the Merck case is the lesson in miniature: the wording decides the outcome. If your cyber coverage is an endorsement on another policy, check its limit now, not at claim time.

How to Spot It / How DTS Handles It

Questions to ask now: Is your cyber coverage a standalone policy or an endorsement? What are the limits and sublimits? Which vendors must you use? Are your application answers about MFA and backups still true?

DTS helps you answer insurer security questionnaires accurately and close gaps before renewal. Talk to our vCISO team; if an incident is underway, see our incident response service.

Related Terms

  • Cyber insurance application questionnaire: the security answers your coverage rests on.
  • Incident response retainer: check how it fits your insurer's vendor rules.
  • Ransomware: one of the most common reasons small businesses file claims.
  • Chain of custody: evidence records insurers and lawyers ask for.
  • Multi-factor authentication (MFA): a control insurers commonly ask about.
  • Supply chain attack: NotPetya spread through a software supplier's updates.

Sources

  • National Association of Insurance Commissioners, Report on the Cybersecurity Insurance Market (2025, covering 2024 data): https://content.naic.org/sites/default/files/inline-files/2025%5FCybersecurity%5FInsurance%20Report.pdf
  • Merck & Co. v. ACE American Insurance Co., N.J. Super. Ct. App. Div., Nos. A-1879-21, A-1882-21 (May 1, 2023), via Justia: https://law.justia.com/cases/new-jersey/appellate-division-published/2023/a-1879-21.html
  • U.S. Government Accountability Office, Cyber Insurance: Insurers and Policyholders Face Challenges in an Evolving Market (GAO-21-477, May 2021): https://www.gao.gov/products/gao-21-477

Last updated October 14, 2026.