“Did Your Policy Actually Respond?” Post-Mortem Lab
Pick a breach scenario and walk it through a typical cyber policy, coverage part by coverage part — what likely pays, what pays only partially, what turns entirely on the wording, and what is simply excluded. It is the rehearsal most teams only do after a claim is denied. General and hedged — real policies vary and every claim turns on its facts and wording; not insurance advice.
The part everyone focuses on — the ransom — is the one most reduced by sublimits and coinsurance. Model the real recovery, not the headline limit.
What this lab does
- Pick a breach scenario — ransomware, business email compromise, a vendor breach, a state-attributed attack, a wrongful-collection class action, a lost-but-encrypted laptop — and walk it through a typical cyber policy coverage part by coverage part.
- Each part is marked likely pays / partial / depends on wording / likely excluded, with the reason, so you see where a real claim would actually land.
- Built to surface the surprises teams usually only discover after a denial: funds-transfer sublimits, war exclusions, wrongful-collection carve-outs, dependent-BI gaps.
- General and hedged — real policies vary and every claim turns on its facts and wording. Not insurance advice.
Why this matters
Most buyers understand a cyber policy as a single limit, when it is really a bundle of distinct coverage parts that each respond — or do not — depending on the scenario. The gap between "we have cyber insurance" and "this specific loss is covered" is where the painful surprises live: the BEC wire that hit a tiny sublimit, the state-attributed attack caught by a war exclusion, the privacy class action carved out by a wrongful-collection exclusion.
This lab runs that post-mortem before the incident, so you can find and close the gaps while you still can — buy the endorsement, negotiate the exclusion, raise the sublimit. It is a general, hedged model, not insurance advice; confirm everything against your own wording and your broker.
Frequently asked questions
Does cyber insurance cover business email compromise / wire fraud?
Often only partially, and only if you bought the right endorsement. A fraudulent wire triggered by a spoofed or compromised email is a funds-transfer / social-engineering-fraud loss, which most core cyber policies cover only under a specific endorsement that is usually sublimited well below the policy limit — sometimes to $100k–$250k on a multi-million policy. If no data was exposed, the privacy-liability and breach-response parts may not engage at all. Because BEC is one of the most common and costly cyber losses, checking for (and sizing) this endorsement is one of the highest-value things to confirm in your policy.
Will cyber insurance pay a ransomware claim in full?
Rarely the full headline limit. Incident-response costs usually respond well, but the ransom itself sits under a cyber-extortion sublimit and is commonly subject to coinsurance, so you recover a fraction of a large demand. Business interruption only pays beyond a waiting period and must be proven. Systems restoration is covered but "betterment" (upgrades made while rebuilding) is not. Add it up and a seven-figure limit can produce a recovery that covers well under half a serious ransomware loss — which is why modelling the real recovery matters more than the limit on the declarations page.
Can an insurer deny a claim using a war or "hostile cyber activity" exclusion?
Potentially, yes — this is the live frontier of cyber-claim disputes. After large systemic attacks, insurers and the Lloyd’s market rolled out war / hostile-cyber-activity exclusions (the LMA5564 family and similar) that can exclude losses attributed to a state or its proxies, sometimes with "widespread event" clauses that cap systemic losses. Whether a given attack is excluded turns entirely on the specific wording and its attribution standard. If your risk includes geopolitically-motivated attackers, read your war exclusion carefully and negotiate its attribution test before a claim, not during one.
Is this a substitute for reading my policy?
No. This lab is an educational model of how a typical cyber policy’s coverage parts tend to respond to common scenarios, deliberately hedged because real policies vary enormously in wording and every claim turns on its specific facts. Use it to learn which questions to ask and which gaps to look for, then read your actual policy and confirm with your broker or coverage counsel. It is not insurance advice and does not reflect any particular carrier’s form.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.