What is excluded?

Despite competition amongst insurers, which has led to very broad products, certain types of cover often remain excluded:

• Fines and penalties – Most policies say they cover fines and penalties, but only “where insurable”. If local legislation states such fines are not insurable then the cyber insurance may assist with the legal representation related to the fine but will not cover the value of the fine itself.
• Cyber war – Many insurers will exclude claims related to attacks on governments or states, known as cyber warfare. Insurers should only rely on such as an exclusion if it is evident the cyber-attack affecting your business is an attack on the state more holistically and intended to bring down the entire UK infrastructure.
• Retro-date – Some insurers will apply a retro-active date, which means complaints or claims related to work prior to that date are excluded.
• Non-cyber event damage to system – Damage or business outages which are not related to a cyber event, for instance if a software update causes you to be unable to access your own system, resulting in business downtime.
• Time excess – Most policies will have a time excess, usually around eight to 12 hours. Whilst insurers will want to be immediately involved in incident response to mitigate losses, they usually exclude these first hours of lost trading.