What Doesn’t Cyber Insurance Cover?

A cyber policy responds only when the facts fit its covered event and the relevant insuring agreement. A specimen AIG form, for example, contains specific exclusions and conditions; Chubb separately describes some crime protections as endorsements. Those examples show why a broad label such as “cyber” cannot establish whether a particular ransom, stolen-funds, outage, lawsuit, fine, or intellectual-property loss is insured.

Review exclusions and carve-backs alongside the definitions of security event, privacy event, system failure, dependent system, and covered data. Then check sublimits, retentions, waiting periods, prior-knowledge provisions, retroactive dates, consent rules, and any required security controls. Ask the broker or insurer to point to the exact quoted wording for the loss you are concerned about.