Why continuous cyber coverage and the right limits matter
A cyberattack does not always begin and end within a single policy period. Cyber insurance coverage can become complicated when an incident starts today, remains hidden for years, and only comes to light after a business has renewed its policy, increased its limits, or changed carriers.
That creates an important question: Which cyber policy will respond when the breach is finally discovered?
Many business owners assume that a cyber incident discovered in 2029 would fall under their 2029 policy and its current limits. Unfortunately, cyber insurance is not always that simple. Buying more coverage later may help protect against future events, but it may not fully address an exposure that already exists.
Cyber incidents can operate on two different clocks
Cyber policies often involve two important timelines.
First-party coverage may help with expenses such as forensic investigations, customer notifications, data recovery, and business interruption. These costs are often triggered when an incident is discovered.
Third-party coverage may apply to lawsuits, privacy liability, and regulatory proceedings. This coverage is commonly written on a claims-made-and-reported basis, meaning the timing of both the claim and the notice provided to the insurer can affect coverage.
Because the coverage triggers can be different, identifying when an attack began is only part of the picture. Businesses also need to understand when the incident was discovered, when a claim was made, and when it was reported.
A cyber coverage scenario
Consider this example:
A hacker quietly accesses a company’s systems and copies encrypted customer information. The business does not know the incident occurred.
Over the next several years, the company renews its cyber insurance and increases its limit from $1 million to $5 million. Later, new technology or a stolen encryption key makes the information readable. The breach is finally discovered, leading to investigation costs, notification expenses, and potential claims.
The business now has a $5 million cyber policy, but that does not necessarily mean the full $5 million will apply to the incident.
The later policy may respond if coverage remained continuous and its retroactive protection reaches back far enough. However, an increased limit may apply only to events occurring after the increase. A newly added excess layer may also have a different retroactive date. Prior-knowledge exclusions and the information provided when applying for the higher limit can affect the outcome as well.
The cyber insurance coverage time trap
Before increasing limits, renewing a cyber policy, or moving coverage to a different carrier, businesses should review five areas.
1. Understand both coverage clocks
Determine how the policy treats the date an incident is discovered and the date a related claim is made and reported. These dates may trigger different parts of the policy.
2. Review retroactive protection
Confirm whether the policy’s retroactive protection reaches back far enough to address earlier events. If the program includes an excess layer, review whether that layer follows the same retroactive date as the underlying coverage.
3. Protect continuity when changing carriers
A new carrier may not automatically preserve the retroactive date provided by the previous policy. Reviewing continuity before making a change can help identify potential gaps.
4. Pay attention to notice requirements
An expired policy generally will not respond unless the incident or claim was properly reported, or an extended reporting period preserves the ability to provide notice. Understanding these requirements before a policy expires is essential.
5. Look beyond the total limit
The number shown on the policy’s declarations page may not represent the full amount available for every type of loss. Defense costs can reduce the policy’s aggregate limit, while regulatory matters, payment-card claims, and social engineering losses may be subject to lower sublimits.
Why this exposure matters now
Modern encryption has not been broken by artificial intelligence, but AI may accelerate the discovery of weaknesses. Future quantum computers could also threaten important forms of public-key cryptography.
Meanwhile, cybercriminals are already stealing encrypted information and holding it with the expectation that they may eventually be able to access it. This approach is sometimes described as “harvest now, decrypt later.”
For businesses, that means the cyber incident that creates a serious loss years from now may have already begun. Increasing limits in the future may provide valuable protection for future events, but it may not repair an existing gap involving previously compromised data.
Put the right protection in place before you know you need it
Cyber insurance should not be evaluated only by looking at the current premium and total limit. Businesses also need to understand how present and historical coverage works together.
Deland, Gibson’s Cryptographic & Latent Cyber Risk Review considers:
- Current and historical cyber limits
- Current and previous insurance carriers
- Retroactive dates
- Notice provisions
- Policy sublimits
- Whether the total limit fits the organization’s exposure
Ask your Risk Advisor to walk through your cyber insurance program and identify potential gaps before an incident brings them to light.