Cyber-attacks on private, public and government information systems continue to rise in both frequency and complexity. These attacks range from cybercriminals to nation-states and today’s attackers are more disciplined, sophisticated and aggressive than ever before.
Today’s attackers are well-organized, often blending criminal operations with nation-state tactics. As these risks grow, organizations are increasingly turning to cyber insurance as part of their overall risk management strategy. But understanding how coverage works and where it may fall short is more important than ever.
Cyber Insurance Basics
Cyber insurance, also called cyber liability insurance or cyber risk insurance, is designed to help organizations recover from a range of cyber incidents, such as ransomware attacks, data breaches and business interruption by covering some of the associated financial, legal and operational costs. Cyber insurance coverage terms vary widely, and many policies contain exclusions that can leave businesses vulnerable – often at the worst time.
If you have cyber insurance or are considering it, it’s important to evaluate whether your policy and response plan truly support your business in a high-impact situation. Below are key areas to review:
Common Policy Questions to Ask
- What does the policy cover and what’s excluded?
- Are there carve-outs for “acts of war” or state-sponsored attacks?
- Are you required to use insurer-approved vendors for incident response?
- Will the insurer scan your systems for vulnerabilities?
- What documentation is needed during claims or renewals?
Request a Confidential Report
Withum’s Cyber Team provides confidential open port scanning of your business and dark web scans to see if your business is being targeted by the dark web. This insight supports a better understanding of your cyber risk posture and may aid in both securing and maintaining coverage.
Approved Vendors
Many policies require that you choose incident response and legal support teams from an approved list. While these teams may offer valid findings, their primary obligation may be to the insurer, not your business. That could limit your ability to recover damages that reflect your true financial and reputational loss.
Automated Risk Scans
Some carriers may also conduct automated scans of your environment (such as open port scans) to assess risk. Think of an open port like an open physical backdoor for your business. These open ports are used by cybercriminals to install ransomware and extort your business. The insurers are using these open ports as a way not only to determine coverage, but their level of risk in underwriting policies and potentially to deny coverage post-incident.
Risk Posture Visibility
If an insurer cannot determine your cyber risk, due to lack of documentation or missing controls, they may deny coverage or decline to renew. It’s not uncommon for businesses to be caught off guard by these requirements during renewal time, which can delay or disrupt coverage.
Don’t wait until an incident occurs. For additional information about Withum’s Cybersecurity Services, contact our experts now.
Cyber Insurance Coverage and “Acts of War” Exclusions
Cybercriminals are not the only threat post-impact. One major area of concern is how insurers treat attacks linked to nation-state actors or advanced persistent threats (APTs). These may be classified as “acts of war” or “terrorism,” which are often excluded from coverage, even if the organization itself is not government-affiliated.
Cyberwarfare is orchestrated across all levels, with hostile governments not only attacking our government, but a government’s lifeline, i.e., disrupting businesses and government revenue streams that collect from those businesses. If your business generates revenue and relies on technology, it could be seen as a strategic target, regardless of industry or size.
Insurers and counsel make excellent arguments to deny coverage and this could put you out of business. If you haven’t reviewed your policy’s exclusion clauses, this is a critical step in understanding your true exposure.
Cyber Insurance Requirements: Controls to Have in Place
Many insurers are tightening their requirements and conducting more detailed risk assessments during underwriting and renewal. Your ability to qualify for coverage or avoid policy denial often depends on your cybersecurity maturity. Insurers expect certain technical and operational controls to be in place.
Below are some of the most common controls cyber insurers expect businesses to have in place:
- Cyber risk assessment
- Multi-factor authentication (MFA)
- Anti-virus, anti-malware and endpoint protection software
- Regular backups of critical data, stored separately from network-connected systems
- Routine testing of backup restoration
- Patch management (typically within 30–60 days)
- Email filtering for malicious attachments and links
- A formal incident response plan
- Encryption of data at rest (servers, workstations)
- Encryption of data in transit (network communications)
It’s important not to wait until renewal to learn what your insurer requires. A proactive review of these controls helps reduce risk and supports smoother renewal or claims processes. Withum can assist in assessing readiness and identifying control gaps.
Cyber Insurance Best Practices
To reduce the chance of claim denial or renewal issues, organizations should:
- Conduct a pre-renewal risk assessment to identify gaps
- Review policy language with legal counsel or risk advisors
- Clarify what constitutes an “act of war” or exclusion criteria
- Understand who incident response providers ultimately represent
- Document all preventative and detective controls
- Keep detailed incident logs and forensic reports in the event of a breach
Cyber insurance can play a critical role in managing risk, but only if it’s part of a broader cybersecurity strategy. The value of your policy depends not only on what’s written in it, but on your organization’s ability to meet evolving requirements and respond to threats effectively.
Contact Us
If you’re unsure whether your current coverage aligns with your risk profile or you need help preparing for renewal, Withum’s Cybersecurity Consulting Services Team can guide you through the process.
