What it is
Cyber liability pays for breach response (forensics, legal, notification, call centre), ransomware and funds transfer fraud losses, regulatory defence, and third party claims after a security failure. For AI companies it is also where attack vector AI wording, like deepfake enabled fraud, is developing fastest.
What it covers
- Incident response: forensics, breach counsel, notification, credit monitoring
- Ransomware and business interruption from a security failure
- Funds transfer fraud and social engineering, subject to form terms
- Regulatory defence and insurable penalties
- Deepfake response help under newer endorsements (forensics, takedown, crisis PR)
What it does not cover
- Liability for your own AI product's wrong outputs (that is Tech E&O or a standalone AI policy)
- Long term reputational loss beyond the form's crisis cover
- War and infrastructure exclusions that vary by carrier
- Losses from controls you attested to but did not have, such as MFA
What triggers buying it
- Holding customer data, health data, or payment data
- A customer security review or SOC 2 process
- Deploying AI agents that can take actions or move money
- Your first ransomware or phishing incident, ideally before it happens
Who requires it
Enterprise customers, regulated industries, and cyber insurers themselves: underwriting now requires MFA, EDR, backups, and an incident plan before binding.
Typical limits
Seed companies commonly carry $1M to $3M. Companies with regulated data or enterprise contracts commonly carry $5M or more, sometimes in towers.
Frequently asked questions
Does cyber insurance cover our AI being used to attack us?
Leading cyber MGAs now affirm AI as an attack vector, for example AI caused security failures and deepfake enabled funds transfer fraud. That is different from covering your AI's outputs, which sits in Tech E&O or a standalone AI policy.
What controls do we need before we can buy cyber?
MFA everywhere, endpoint detection, tested backups, and basic access controls are the usual minimum. We run a pre submission check so an application is not declined on a fixable gap.
Is ransomware still covered?
Yes, at most markets, but with conditions, sublimits at some carriers, and much harder questions about backups and segmentation than two years ago.
Talk through your stack before you sign the next contract
Send us the term sheet, the customer MSA, or the renewal you are worried about. We will tell you plainly what it requires, what your current programme does about it, and what we would place differently.