Cyber Insurance Glossary: Key Terms Explained
Whether you’re evaluating coverage for the first time or comparing policies as a renewal approaches, the terminology in a cyber insurance policy can be a barrier to making confident decisions. This glossary covers the terms you’re most likely to encounter when working with carriers, underwriters, and brokers.
A
Aggregate Limit The maximum total amount an insurer will pay across all covered claims during a policy period, regardless of how many incidents occur. Once the aggregate is exhausted, the policy provides no additional coverage until renewal.
Application Warranty A statement made by the insured during the underwriting process that attests to the accuracy of information provided on the application. Misrepresentations in the application — even unintentional ones — can void coverage at the time of a claim.
B
Business Email Compromise (BEC) A type of cyberattack in which criminals impersonate a trusted contact (often an executive or vendor) via email to trick employees into transferring funds or sharing sensitive data. BEC is one of the most common and costly cyber loss drivers for small and midsize businesses.
Business Interruption (BI) Coverage that compensates a business for lost income and operating expenses when a covered cyber event disrupts normal operations. Business interruption is now the single largest driver of cyber insurance claims and is typically measured against a waiting period before coverage activates.
C
Carrier The insurance company that underwrites and assumes the financial risk of a policy. Carriers set the terms, pricing, and appetite for coverage. Direct underwriters like SeedPod Cyber work with carriers to place coverage — meaning clients get direct access to the underwriting process without an intermediary broker.
CIS Controls The Center for Internet Security’s prioritized set of cybersecurity best practices. Carriers increasingly expect alignment with CIS Controls as a baseline condition for coverage. Documented compliance can accelerate underwriting, reduce sublimits, and lower premiums.
Claim A formal request submitted to the insurer seeking payment for a covered loss. In cyber insurance, claims typically involve notifying the carrier promptly after discovering an incident — policy language specifying notice requirements should be reviewed carefully.
Claims-Made Policy A policy structure in which coverage applies to claims reported during the active policy period, regardless of when the underlying incident occurred (subject to the retroactive date). Most cyber policies are written on a claims-made basis.
Coinsurance A provision in some policies requiring the insured to share a percentage of losses above the deductible. Less common in cyber, but worth checking for in policy wording.
Coverage Trigger The specific condition that must be met for a policy to respond. In cyber insurance, common triggers include unauthorized access, system failure, or a privacy breach event.
Cyber Extortion Coverage for losses related to ransomware or other extortion demands made by threat actors. This typically includes ransom payments, negotiation costs, and incident response expenses associated with the extortion event.
Cyber Express SeedPod Cyber’s fast-quote program for businesses with up to $50 million in annual revenue. Cyber Express delivers instant, bindable cyber insurance quotes without a lengthy application process.
D
Data Breach An incident in which unauthorized individuals access, steal, or expose sensitive or confidential data. A data breach can trigger multiple coverage components, including breach response, notification costs, credit monitoring, and third-party liability.
Data Breach Response / Breach Response Costs First-party coverage for the direct costs of responding to a data breach — including forensic investigation, legal counsel, notification to affected individuals, credit monitoring, and public relations expenses.
Deductible (Retention) The amount the insured is responsible for paying before the insurer’s coverage applies. In cyber insurance, this is often called a “retention” rather than a deductible. Higher retentions generally lower premiums.
Direct Underwriter An underwriter that works directly with carriers to place coverage, bypassing the traditional retail or wholesale broker layer. Direct underwriting gives insureds more direct access to the underwriting process, faster decisions, and often better pricing.
E
eCrime / Funds Transfer Fraud (FTF) Coverage for losses resulting from fraudulent wire transfers or payment misdirection caused by a social engineering attack or impersonation. Often a sublimited coverage within a cyber policy — check the limit carefully, as losses can be significant.
EDR (Endpoint Detection and Response) A security technology that monitors and responds to threats on individual devices (endpoints). Carriers widely consider EDR deployment a baseline underwriting requirement. Absence of EDR can result in higher premiums, sublimits, or declined applications.
Errors and Omissions (E&O) See: Tech E&O.
Exclusion A provision in the policy that explicitly removes certain events, losses, or circumstances from coverage. Common cyber exclusions include war and acts of terrorism, infrastructure failure by utilities, and losses arising from unpatched known vulnerabilities (varies by carrier).
F
First-Party Coverage Coverage for losses the insured directly experiences — such as business interruption income, ransomware response costs, data recovery, and breach notification expenses. Contrast with third-party coverage.
Forensic Investigation The process of analyzing systems and data to determine the cause, scope, and impact of a cyber incident. Forensic costs are typically covered as a first-party expense and are often required before a claim can be fully evaluated.
I
Incident Response (IR) The process of identifying, containing, and recovering from a cyber incident. Many cyber policies include access to a pre-approved IR panel — a vetted network of forensic, legal, and remediation firms that the carrier has already negotiated rates with.
Insured vs. Insured Exclusion A provision that excludes claims brought by one insured party against another. More common in D&O policies but can appear in cyber forms — worth reviewing if your organization has related entities on the policy.
L
Limit of Liability The maximum amount the insurer will pay for a single covered claim. Cyber policies typically offer per-occurrence limits alongside the aggregate. SeedPod Cyber offers primary limits up to $5 million.
M
MFA (Multi-Factor Authentication) An identity verification method requiring users to confirm their identity through two or more factors. MFA is one of the most scrutinized controls in cyber underwriting — carriers commonly require MFA for email, remote access, and privileged accounts as a condition of coverage.
MGA (Managing General Agent) An intermediary authorized by carriers to underwrite, bind, and manage insurance policies on their behalf. MGAs like SeedPod Cyber operate with direct carrier authority, allowing them to move faster and offer more tailored coverage than traditional retail channels.
MSP (Managed Service Provider) A company that provides outsourced IT management and support to businesses. MSPs play a critical role in cyber underwriting — businesses served by a qualified MSP with documented security controls often qualify for better pricing and terms.
N
Named Peril A policy structure that only covers losses from specifically listed events. Most cyber policies are “all-risk” (or “open peril”) rather than named peril, meaning they cover any covered event not explicitly excluded.
Network Security Liability Third-party coverage for claims arising from a failure of your network security — such as a breach that spreads to a client’s systems or results in a customer’s data being compromised.
Notice Requirement The policy provision specifying when and how the insured must notify the carrier of a potential or actual claim. Cyber policies typically require prompt notice — failing to notify the carrier in time can jeopardize coverage.
P
PCI DSS (Payment Card Industry Data Security Standard) A set of security standards required for businesses that process credit card transactions. PCI compliance status is a common underwriting question and can affect pricing and coverage terms.
Privacy Liability Third-party coverage for claims arising from the unauthorized disclosure of personally identifiable information (PII) or protected health information (PHI). This can include regulatory defense costs and civil penalties where insurable by law.
Professional Liability Liability arising from errors, omissions, or negligent acts in the performance of professional services. See: Tech E&O.
R
Ransomware A type of malware that encrypts a victim’s data and demands payment for the decryption key. Ransomware events typically trigger multiple coverage components — extortion, business interruption, forensics, and sometimes data recovery.
Rectification / System Restoration Coverage for the cost of restoring or recreating data and systems damaged or destroyed by a covered cyber event.
Retroactive Date In a claims-made policy, the retroactive date is the earliest point from which prior acts are covered. An incident that occurred before the retroactive date is not covered even if the claim is reported during the policy period. Maintaining a consistent retroactive date across renewals is important.
RDP (Remote Desktop Protocol) A Microsoft protocol that allows remote access to systems. Exposed RDP (publicly accessible without additional controls) is one of the most common attack vectors and is frequently cited as an underwriting exclusion trigger or declination reason.
S
Social Engineering Manipulation tactics used by attackers to deceive employees into taking actions that compromise security — such as transferring money, sharing credentials, or granting access. Social engineering coverage is often sublimited; verify the limit relative to your exposure.
Sublimit A coverage cap within a policy that applies to a specific type of loss, set below the overall policy limit. Common sublimits in cyber policies include funds transfer fraud, social engineering, and PCI fines. Sublimits are one of the most important line items to review when comparing policies.
System Failure Some policies extend coverage to losses caused by non-malicious system failures or outages — not just attacks. This distinction matters for businesses with high operational dependence on technology systems.
T
Tech E&O (Technology Errors and Omissions) A professional liability policy designed for technology companies, software developers, SaaS providers, and MSPs. Tech E&O covers claims arising from errors in your technology product or service that cause harm to a client — such as a buggy release, failed implementation, or missed SLA. Tech E&O and cyber insurance are complementary: cyber covers security incidents, Tech E&O covers professional mistakes.
Third-Party Coverage Coverage for claims made against the insured by outside parties — customers, vendors, regulators — arising from a covered cyber event. Common third-party coverages include network security liability, privacy liability, and regulatory defense.
U
Underwriting The process by which an insurer evaluates risk and determines whether and on what terms to offer coverage. In cyber insurance, underwriting typically involves reviewing an application, assessing security controls, and sometimes conducting a technical assessment of the insured’s environment.
W
Waiting Period The period of time that must pass after a covered event before business interruption coverage begins to pay. Common waiting periods range from 6 to 12 hours. A shorter waiting period provides broader coverage but may come at higher cost.
War Exclusion An exclusion that removes coverage for losses caused by acts of war or state-sponsored cyberattacks. The scope of war exclusions in cyber policies has been an active area of debate, particularly following nation-state attacks that affected commercial businesses.
Have questions about how any of these terms apply to your coverage? Contact SeedPod Cyber to speak directly with an underwriter.