Cyber insurance policies look similar on the cover page and very different in the fine print. The headline limit matters less than what is inside: which costs are covered, which have smaller sublimits, and what conditions you must meet. Always read your actual policy wording with your broker. What follows is a general overview, not advice on any specific policy.
What Are First-Party and Third-Party Coverages?
First-party coverage pays your own costs after an incident. Third-party coverage pays when others make claims against you.
| Coverage | Type | What it typically pays for |
|---|---|---|
| Incident response and forensics | First-party | Investigators to find out what happened and stop it |
| Legal and breach coaching | First-party | Privacy lawyers to guide notification decisions |
| Notification and credit monitoring | First-party | Letters, call centres, credit monitoring for affected people |
| Data restoration | First-party | Rebuilding systems and restoring data |
| Business interruption | First-party | Lost income during an outage, after a waiting period |
| Cyber extortion | First-party | Negotiation and, where lawful and approved, ransom payments |
| Social engineering or funds transfer fraud | First-party | Money lost to fake invoices or impersonation, often with a low sublimit |
| Privacy and network security liability | Third-party | Defence and settlements if clients or others sue |
| Regulatory defence | Third-party | Defence costs for privacy regulator investigations; fines only where insurable by law |
| Media liability | Third-party | Claims over content you publish |
What Is Usually Excluded or Limited?
Common exclusions and limits include:
- Prior known incidentsthat started before the policy.
- Failure to maintain stated controls, where policy language ties coverage to what you said in the application.
- War and state-sponsored attackexclusions, whose wording has been tightened in recent years.
- Infrastructure failuressuch as a widespread power or internet outage.
- Bettermentupgrading systems beyond what you had before the incident.
- Contractual liabilitybeyond what you would owe anyway.
- Bodily injury and property damage, usually covered elsewhere.
Social engineering fraud is a frequent surprise. A Brampton distributor loses money to a fake supplier invoice and discovers the policy covers it only up to a small sublimit, and only if a call-back verification procedure was followed.
Do You Have to Use the Insurer's Vendors?
Often, yes. Many policies require you to call the insurer's breach hotline first and use their panel of lawyers and incident responders, or get approval before using your own. If you already have an incident response provider you trust, ask your broker before you need it whether they can be approved in advance.
Does Cyber Insurance Pay Ransoms in Canada?
Some policies cover extortion payments, subject to insurer consent and legal checks such as sanctions screening. Paying is never automatic. See Should we pay the ransom? for the wider decision.
How Do You Make Sure the Policy Actually Responds?
- Read the application and policy together. Every "yes" you gave is a promise.
- Know the notice requirements and the breach hotline number.
- Keep the policy, broker and hotline details offline, since your email may be down.
- Build insurer notification into your incident response plan.
- Revisit limits annually as revenue and data volumes grow.
Our cyber insurance readiness page covers how we help businesses meet insurer expectations, and our incident response team works alongside insurer-appointed counsel during a claim. For whether a policy is worth buying at all, see Does a small business need cyber insurance?.