Does Cyber Insurance Cover Supply-Chain Attacks?

A supply-chain attack can use a software provider, service vendor, or trusted connection as the path into a company’s systems. The intrusion may then produce a security breach, interruption, or loss affecting multiple organizations. FTC guidance recommends assessing cybersecurity risks from suppliers and checking vendor-held data coverage. Chubb separately describes specific terms for widespread cyber events, illustrating that aggregated events can have special limits or conditions in some products.

Check whether the form requires a direct attack on your network or also covers a provider’s compromised software or connection. Review dependent-system definitions, systemic-event endorsements, aggregation language, and any sublimit or coinsurance. Identify whether response expenses, your interruption, and claims by others each have a coverage grant. Keep an inventory of software and providers that can access business systems, then ask the insurer about named critical dependencies.