Most organizations understand how a data breach, phishing scam or ransomware attack affects the bottom line. The 2023 Allianz Risk Barometer report – a survey of risk management experts that identifies the most pressing corporate risks – finds 34 percent of responses rank cybersecurity as the number one risk.

Cyber threats have prompted companies to invest in cyber insurance to mitigate risk and protect themselves in case of a security incident. In reviewing these policies, in-house counsel will be surprised to learn that cyber insurance may not cover all aspects of cyber threats – potentially leaving the organization vulnerable following an incident.

Scott N. Godes, partner and co-chair of the Insurance Recovery and Counseling Practice with Barnes & Thornburg

"Based on how they're marketed, buyers think policies are designed for anything related to cyber," says Scott N. Godes, partner and co-chair of the Insurance Recovery and Counseling Practice with Barnes & Thornburg. "But the claims department is quick to say that these policies aren't a panacea for everything."

When in-house and corporate counsel consider cyber insurance, they should consider several factors, including what specific cyber incidents the policy covers. Legal leaders must also realize that language is crucial – and how the policy is written makes a significant difference.

What Do These Policies Cover, Anyway?

Cyber insurance is a burgeoning and growing market, with some predictions estimating its value at about $20 billion worldwide by 2025. In general, cyber insurance can cover a range of cyber threats, from data breaches to email compromise scams to ransomware attacks. Policies should help victimized organizations recoup the cost to restore data lost in a breach, loss of income due to business interruptions, and even certain legal expenses.

A typical policy, however, might not always cover intentional acts, or provide full coverage for social engineering attacks.

"A good standalone cyber policy should cover the costs to resolve a ransom demand, for example," says Godes. "That said, there's no standardization in cyber policies."

The list of places where carriers push back is "endless," says Godes, adding that over the last year: "Carriers are taking an astonishingly aggressive approach on how they interpret statements policyholders make in their applications."

Policy Language Matters 

What companies understand the least about cyber insurance, says Godes, is pretty much everything about cyber insurance. That's because cyber, compared to any other insurance policy, is still new.

Since most companies still haven't experienced a significant attack, what's covered in the policies can be fuzzy – and that is why the policy language matters.

"Start by working with a sophisticated broker," explains Godes. "In-house counsel and others involved in decision-making should ask about the policy language."

That seems simple enough, but it's a must-have conversation because carriers don't provide the full set of policy language at the time of purchase.

In-house counsel should also ensure that carriers fully understand their firms' lines of business to offer the right policies. Indeed, communication is key.

"Sitting down and having a detailed conversation with the broker in advance of the date that the policy needs to be bound is helpful," says Godes. "A best practice for in-house counsel who know data privacy and cyber risk would be to have a tabletop exercise to discuss how policies would apply in certain situations. How would we want to proceed? What losses would the company incur? If I had a ransomware attack, where is the coverage?"

And if a claim is denied? Try to understand the rationale behind the denial – as well as that carriers rarely favor broad interpretations of coverage – and go from there. This is why in-house counsel must understand what the policy covers and how language changes affect the outcome.

"The insurance industry has made this a very difficult market in the last couple of years," says Godes. "In-house counsel need to do their homework."

Barnes & Thornburg's Insurance Recovery and Counseling practice has additional information for in-house counsel about insurance and risk.

Johanna Marmon is a writer in upstate New York who has been reporting on trends impacting the legal industry for more than 15 years.