Does Cyber Insurance Cover Zero-Day Attacks?
A zero-day attack may be covered if it causes a loss that fits the policy’s cyber event definitions; the fact that no patch existed does not decide coverage.
The key question is whether the incident meets the covered-event trigger, not whether a vendor had already issued a fix.
Read the policy’s cyberattack and vulnerability definitions, any known-circumstance exclusion, and terms addressing failure to maintain security. Check whether patch timing is measured from public disclosure or notification by the insurer. Review the applicable limits, waiting periods, and incident-response requirements. Ask the carrier to explain the quoted wording for an unknown vulnerability and preserve evidence of when the flaw became known and what steps were taken.
