The cyber insurance buyer's guide

How to read a cyber policy (in this order)

1. The schedule first. Limits, excess, retro date, and — critically — every sub-limit and co-insurance percentage. The schedule overrides your assumptions about the wording.
2. Exclusions second. Especially war/state-actor (which LMA variant?), infrastructure/utility failure, "failure to maintain" security, prior/known circumstances, and dishonesty. What the insuring clauses give, exclusions take away.
3. Conditions third. Anything called a "condition precedent", notification deadlines, consent requirements before incurring costs, and panel/vendor obligations.
4. Definitions fourth. "Computer system" (does it include cloud/SaaS you rely on?), "insured", "claim", "cyber event", "direct financial loss" — Inchcape turned on the word "direct".
5. Insuring clauses last. Map each of your top five realistic loss scenarios (ransomware, BEC, privacy breach, supplier outage, insider) to the exact clause you'd claim under, at what sub-limit, minus what excess and co-insurance.
6. Then the proposal form. Re-read every answer as if an insurer's lawyer will audit it post-breach — because after a large claim, one may. See Travelers v ICS.

Questions to ask your broker

Red flags

• A blanket state-sponsored-attack exclusion with no impact threshold or carve-back (LMA5564-style).
• "Failure to maintain" / minimum-required-practices exclusions with no causation link (Cottage Health).
• Security answers converted to warranties without severability or knowledge qualifiers.
• Social engineering/BEC sub-limited below your single largest routine payment run — or missing entirely.
• Co-insurance percentages buried in endorsements (e.g. 50% on catastrophic events).
• Fixed 48/72-hour notification deadlines triggered by "any employee's" awareness.
• Crime or management-liability policies being presented as "cyber cover" (Inchcape).
• A premium that's dramatically cheaper than competitors — the discount is usually hiding in the exclusions.

Negotiation checklist

1. War exclusion: LMA5567A/B-type threshold wording, collateral-victim carve-back, attribution mechanics agreed.
2. Warranties: knowledge-qualified, severable, scoped to named systems; application co-signed by the control owner.
3. Sub-limits: cybercrime/BEC raised to match real payment exposure; ransomware and BI at full limit.
4. Co-insurance: removed, or traded for a higher fixed excess.
5. Panels: your IR firm, forensics and legal counsel endorsed pre-bind; emergency-cost carve-out confirmed.
6. Notice: "as soon as practicable after senior officer awareness"; circumstance notification before each renewal.
7. Retro date: earliest available; continuity preserved on any insurer switch.
8. Betterment: carve-back for security upgrades required to restore safely.
9. Dishonesty: limited to senior management with final-adjudication trigger and innocent-insured protection.
10. Aggregation: run your worst-case scenario through the clause; consider limit reinstatement.

Glossary

Condition precedent

An obligation you must satisfy before the insurer's obligation to pay arises. Breach can defeat the claim regardless of merit (in Australia, s54 ICA may soften this where the breach didn't cause the loss).

Warranty

A promise that something is and will remain true (e.g. "MFA is enabled"). Breach can void cover; misstatement on the proposal can support rescission of the whole policy.

Sub-limit

A lower cap inside your headline limit for a particular loss type (e.g. $250k for social engineering inside a $5m policy).

Co-insurance

A percentage of each loss you must bear yourself on top of the excess.

Retroactive date

Events originating before this date aren't covered, however recently discovered.

Betterment

Improvement beyond pre-incident state during rebuild — typically excluded.

Aggregation

Rules deciding whether multiple events count as one claim (one limit/one excess) or several.

Condition subsequent / claims-made

Cyber policies generally respond to claims made and notified during the period — late notification of known circumstances is the classic trap at renewal.

PDS

Product Disclosure Statement — the Australian retail disclosure document. Read the full policy wording too; the PDS is a summary.

LMA clauses

Model wordings from the Lloyd's Market Association, e.g. the cyber war exclusion suite mandated across Lloyd's cyber since Bulletin Y5381.

Panel

The insurer's pre-approved incident response, legal and forensic vendors, often mandatory or consent-gated.

Rescission

Unwinding the policy as if it never existed, typically for misrepresentation — the outcome in Travelers v ICS.

The regulatory backdrop (Australia)

Cyber insurance sits inside a tightening regulatory frame: APRA now collects standalone cyber insurance claims data in the National Claims and Policies Database, APRA-regulated entities carry CPS 234 information-security obligations, and ASIC has signalled enforcement interest in cyber risk governance — boards increasingly need to show both real controls and coherent risk transfer. Insurance is the residual-risk layer, not a substitute for the controls your insurer will audit after a claim anyway.