What does cyber insurance cover—and how does it differ from crime insurance?

By Mark Melliand, owner, Melliand Insurance Agency · 13 years as an independent agent · Published October 27, 2026

Short answer: Cyber insurance is a group of coverages for costs, losses and claims arising from specified data and computer-system incidents. Depending on the policy, that can include breach response, liability claims, regulatory proceedings, data restoration, business interruption, cyber extortion and certain fraud losses. It isn’t one uniform product. What applies depends on the insuring agreements purchased, definitions, triggers, exclusions, endorsements, limits, retentions and reporting requirements. Crime insurance is a separate product, focused on your business’s own loss from specified crimes. The two can overlap or leave gaps.

Three kinds of cyber protection

  • First-party coverage pays the insured business’s own covered costs or losses, such as breach response, data restoration or business interruption.
  • Third-party liability coverage responds to covered claims by others, such as allegations arising from a privacy or network-security failure.
  • Services may come with a policy. Travelers describes threat monitoring and other services available to CyberRisk policyholders (Travelers), and Chubb describes an incident-response panel and preparation services (Chubb). Access to a service isn’t the same as coverage: whether a related expense is insured still depends on the policy.

Some insurers offer cyber as an endorsement to a BOP or package policy, and others as a standalone policy. The Hartford, for example, describes adding data breach and similar coverages to a BOP for less complex risks, and a standalone cyber policy for more complex ones (The Hartford). See our BOP coverage guide.

Coverages to look for

The illustrative policy form reviewed (Travelers CyberRisk Coverage, CYB-16001 Rev. 06-20, the non-California form listed on Travelers’ CyberRisk forms page) states that only the insuring agreements with limits shown in the declarations apply. Its insuring agreements illustrate the range of coverage a cyber policy may offer:

  • Incident response: legal and forensic help. Coverage for computer and legal expert costs after an actual or suspected privacy breach, security breach or extortion threat. That form also includes public relations costs and, with the insurer’s written consent, certain “betterment” costs to improve systems after a breach.
  • Notification and related response costs. Privacy breach notification costs, which can include notifying affected people and related services such as credit monitoring, as the form defines them.
  • Privacy and network-security liability. Coverage for claims alleging a privacy or security failure. Some policies also include media liability.
  • Regulatory proceedings. Defense and certain regulatory costs. In the illustrative form, covered regulatory costs can include civil fines, penalties and consumer redress amounts “to the extent insurable under the most favorable applicable law.” Whether a fine is insurable is a legal question.
  • Data restoration. Costs to restore or recover data or systems after a covered security breach.
  • Business interruption and extra expense. In the illustrative form, business interruption can be triggered by a security breach that interrupts a computer system, a system failure “if applicable,” or a reasonable voluntary shutdown to limit a breach in progress. A security breach and a non-malicious system failure are different triggers; check whether system failure is included.
  • Dependent business interruption. In the illustrative form, this applies to interruption caused by a breach of an IT provider’s computer system, such as unauthorized access, a denial-of-service attack or a virus. That isn’t the same as an ordinary outage at a provider.
  • Cyber extortion. Coverage for response to an extortion threat. In the illustrative form, covered extortion costs, including any ransom, require the insurer’s prior written consent. Don’t make any payment without involving your insurer and qualified professionals, and confirm what your policy and applicable law allow.
  • Funds transfer fraud and social engineering, where specifically included. The illustrative form has separate cyber crime insuring agreements for computer fraud, funds transfer fraud, social engineering fraud and telecom fraud. Social engineering coverage may carry a lower limit; The Hartford notes a social engineering sublimit may be lower than the overall cyber limit (The Hartford).

Not every policy includes every item. Check the declarations and endorsements to see which coverages you actually have.

Cyber vs. crime insurance

Using email or a computer doesn’t, by itself, establish cyber coverage. Crime and cyber policies may overlap or leave gaps. Review each policy’s definitions, voluntary-transfer provisions, verification requirements, sublimits and other-insurance conditions. Our commercial crime guide explains the crime-side fraud distinctions in detail.

ScenarioCoverage to reviewQuestions to ask
Ransomware disrupts operationsCyber extortion, incident response, data restoration, cyber business interruptionIs consent required before any response or payment? What wait period and period of restoration apply? Are approved providers required?
Customer or employee information is exposedBreach response (legal, forensic, notification), privacy liability, regulatory coverageWhich response costs are covered? Must you use the insurer’s providers? How does the policy treat regulatory proceedings?
A business is accused of harming another organization through its networkNetwork-security liability; technology E&O if you provide technology servicesIs the claim within the liability insuring agreement? Is technology E&O included or separate?
An employee pays a fake vendor instructionSocial engineering coverage in a cyber or crime policy, if purchasedWhich policy includes it, and at what limit? Are there verification requirements? How do other-insurance provisions apply?
A criminal makes an unauthorized transferFunds transfer fraud or computer fraud in a cyber or crime policyWas the transfer made without your knowledge or consent? Which policy’s definitions fit the facts?
A cloud provider outage interrupts businessDependent business interruption, if includedDoes the policy require a security breach at the provider, or does it also cover non-malicious outages? Does an infrastructure exclusion apply?

Important limitations

  • Different triggers in one policy. Liability parts are often claims-made. In the illustrative form, the liability agreements cover claims first made during the policy period or an applicable extended reporting period, while breach response, crime and business loss parts are tied to events discovered during the policy period. Applicable extended reporting or discovery provisions may affect certain coverage parts, so don’t assume every first-party coverage ends exactly at the policy-period boundary, or that every part uses the same trigger. Our claims-made guide explains claims-made terms.
  • Prior acts, prior knowledge and reporting. Ask about any retroactive or prior-acts dates, prior-knowledge provisions and notice requirements, and when each period starts.
  • Wait periods and restoration periods. In the illustrative form, business interruption is measured during a period of restoration that begins after a wait period shown in the declarations and ends at the earlier of a stated maximum or the restoration of operations, as the form describes. These are set by your policy; check your declarations.
  • Limits, sublimits, retentions and loss-sharing. Coverage parts may share one aggregate limit or have their own sublimits and retentions. Review the limits, sublimits, retentions, waiting periods and any applicable loss-sharing provisions for each part.
  • Approved providers and consent. Some policies require using approved providers, or getting the insurer’s consent before incurring certain costs. In the illustrative form, extortion costs require the insurer’s prior written consent, and betterment costs require the insurer’s written consent.
  • Application answers and security controls. Insurers ask about security controls when you apply. Travelers, for example, publishes a multi-factor authentication supplement on its CyberRisk forms page. Answer accurately and review any continuing conditions. How a missing control affects a claim depends on the actual application and policy wording.
  • Exclusions. The illustrative form includes exclusions for bodily injury (with exceptions for emotional distress and similar harms); interruption or failure of infrastructure such as utilities, internet service providers and satellites, except infrastructure under the insured’s control; war and warlike action; and certain contract-related losses. Policies differ; read yours.
  • Technology E&O. If you provide technology services or products, ask whether technology E&O is included or separate. See our professional liability coverage guide.
  • Property-based business income. Cyber interruption is different from property-based business income coverage. See our business income guide.

Breach notification in Texas: three different things

Texas law may require notice to affected individuals and, when applicable, reporting to the Texas Attorney General. The obligations depend on the statutory definitions, circumstances and applicable provisions. These duties are separate from notice required by an insurance policy. Seek prompt advice from qualified breach counsel.

  • Notifying affected individuals. See Texas Business and Commerce Code Chapter 521, including Section 521.053.
  • Reporting to a regulator. The Texas Attorney General accepts breach reports electronically; see its Data Breach Reporting page.
  • Notice to your insurer. This is a policy requirement, separate from any legal notification duty. Your policy sets how and when you must report an incident or claim.

Hypothetical examples: coverage-review questions

These are illustrations, not real customers or predictions of outcomes.

Ransomware locks a small office’s systems

Assume an office can’t access its files or scheduling system after a ransomware attack, and a ransom demand arrives. Questions to review:

  • Does the policy include cyber extortion, incident response, data restoration and business interruption?
  • What must you do before engaging vendors or responding to the demand, including insurer consent?
  • What wait period and period of restoration apply to the interruption?
  • What limits, sublimits and retentions apply to each part?

Customer information may have been exposed

Assume a business finds that an unauthorized person accessed a database containing customer information. Questions to review:

  • What breach response costs are covered, and must approved providers be used?
  • What notification duties apply? Ask breach counsel.
  • When and how must the insurer be notified?
  • If customers or regulators pursue the business, which liability or regulatory coverages apply?

An outage at a software provider stops orders

Assume the business’s cloud-based ordering system goes down because of a problem at the provider. Questions to review:

  • Does the policy include dependent business interruption?
  • Does that coverage require a security breach at the provider, or does it also cover non-malicious outages?
  • Could an infrastructure or similar exclusion apply?
  • What does the provider’s contract say about outages?

Checklist: what to review

  • The systems, information and service providers your business depends on
  • Your current cyber, crime and any relevant professional liability policies
  • Which cyber coverage parts you purchased, and their limits, sublimits and retentions
  • Who to contact, and how, if an incident occurs, including insurer notice requirements
  • Your security controls, and whether your application answers are accurate and current. See our guide to what information you need for a cyber insurance quote.
  • Any vendor, approved-provider and consent requirements in your policy

Never send passwords, authentication codes, security configurations, customer databases or incident evidence through an ordinary website form or email. Ask what’s needed and arrange an appropriate secure method.

Sources

Insurer pages describe their own products and services; they don’t describe every policy and aren’t sources of Texas law. The policy form is the non-California sample Travelers lists on its forms page, cited for illustration only. It isn’t confirmed as the form, edition or endorsements in any current Texas policy. Your policy’s wording controls.

About Melliand Insurance Agency

Melliand Insurance Agency is an independently operated insurance agency affiliated with Premier Group Insurance (PGI), a nationwide agency network.

Questions about cyber coverage for your business? Call (972) 346-4666 or email melliandinsurance@gmail.com. Hours are Monday–Friday, 8 AM–5 PM Central. We don’t have a walk-in office. In-person visits are by appointment at your home or business throughout DFW.

This guide is general information, not legal advice or a statement of coverage. Coverage depends on the actual policy, and only the policy terms control.