Cyber Insurance Case Studies

How to read these scenarios

The scenarios in this lesson are examples for learning, not accounts of particular companies. Each one is used to ask the same three questions: what triggers the cover, where an exclusion or a limit bites, and who ends up bearing which part of the loss.

The insider who takes data

Suppose an employee of an edtech company copies its user database and takes it to a competitor. The company faces several kinds of loss at once. It must investigate what was taken, notify the users, defend claims from them and answer any regulatory proceedings.

Cyber policies respond to these direct costs of a breach: forensics, notification, legal defence and regulatory proceedings, subject to the policy terms and exclusions, including any on dishonest acts by employees. The loss a cyber policy is least likely to cover is the revenue lost as students move to the competitor. That is a commercial loss, not a standard cyber cover. The company may suffer it because of the breach, but the policy is not built to make good a loss of market share.

The attack that arrives through a vendor

A supply chain attack exploits a trusted relationship. Malware delivered through a legitimate vendor update or data link bypasses normal security, because the victim has authorised the vendor's access. The danger lies in that trust: the malware spreads through legitimate channels and is not treated as a threat.

For insurance purposes the victim's own costs and liabilities are looked at under its own cyber policy. If the vendor's negligence caused the breach, the insurer, after paying the claim, may pursue recovery from the vendor by subrogation, and the insured must cooperate.

When the claim is larger than the limit

A policy limit is the most the insurer will pay. If a company with a ₹5 crore cyber policy faces ₹10 crore in third-party claims, the insurer pays up to ₹5 crore and the company bears the remaining ₹5 crore. The insurer's liability is capped at the limit, whatever the size of the loss.

This is why the adequacy of the limit matters, and why excess or umbrella cyber liability cover exists as a further layer above the primary policy.

A breach also has a public side. PR crisis management is a first-party cover under cyber insurance: the insurer provides access to professional crisis communication firms to manage media, customer communication and public statements after a breach.

Rules at a glance

Key points

• Cyber policies respond to the direct costs of a breach: forensics, notification, legal defence and regulatory proceedings.
• Revenue lost because customers move to a competitor is a commercial loss and not a standard cyber cover.
• Supply chain attacks are dangerous because malware arrives through a trusted vendor's authorised access.
• The insurer's liability is capped at the policy limit; the insured bears any amount above it.
• PR crisis management after a breach is a first-party cover.

Common misunderstandings

• A cyber policy does not make good every consequence of a breach: lost customers and market share are commercial losses outside standard cover.
• The policy limit is not a guide to the likely loss: it is a cap, and anything above it stays with the insured.
• A trusted vendor is not a safe channel by definition: supply chain attacks work because the vendor's access is authorised.
• Crisis communication is not a liability cover: it is a first-party cover for the insured's own response.

Questions people ask