Does Cyber Insurance Cover Software Vulnerabilities?
Sometimes—cyber insurance may cover losses after an attacker exploits a vulnerability, but known flaws and failure-to-patch conditions can restrict coverage.
Some products set specific grace periods. If exploitation causes a covered security incident, cyber coverage may apply to some resulting response or liability costs. The policy can treat the flaw’s age and the company’s response as relevant: Chubb describes an endorsement for certain neglected software exploits with a defined patching grace period and later risk-sharing terms. That is a specific product feature, not a universal rule.
Check exclusions for known vulnerabilities, failure to maintain security, unsupported software, and prior events. Review any patching warranty or endorsement for which systems and vulnerabilities it covers, when the clock starts, and how delay affects the insurer’s share. Confirm the policy separately covers restoration, interruption, and third-party claims. Preserve patch-management records and accurately disclose known issues in the application.
