What Doesn’t Cyber Insurance Cover?
Cyber policies commonly exclude losses such as known incidents, certain prior events, and some contractual or intentional conduct; the exact exclusions vary by form.
The exclusions matter most where your business relies on vendor systems, stores sensitive data, or transfers funds. Review the actual wording for exceptions and endorsements before treating a listed coverage as protection.
Review exclusions and carve-backs alongside the definitions of security event, privacy event, system failure, dependent system, and covered data. Then check sublimits, retentions, waiting periods, prior-knowledge provisions, retroactive dates, consent rules, and any required security controls. Ask the broker or insurer to point to the exact quoted wording for the loss you are concerned about.
