What Cyber Insurance Covers (and What It Does Not)

If you are shopping for a policy, or trying to understand the one you already hold, the fine print can be hard to read. This article breaks down what cyber insurance actually pays for, in plain language, so you can match a policy to the risks your business really carries. For the bigger picture of whether you need coverage at all, start with our pillar guide on business cyber insurance in Canada.

One caveat up front: insurance terms vary by policy and insurer. The categories below are how coverage is usually structured, not a guarantee of what any single policy includes. Always read your own wording, and confirm details with your broker.

First-Party vs Third-Party

Almost every cyber policy is built from two kinds of coverage, and understanding the split is the key to reading any quote.

First-party coverage pays for your own losses when an incident hits your business. That includes breach response costs (forensics, legal, notification), restoring or recreating lost data, income lost while systems are down, and cyber extortion costs when an attacker holds your data or systems to ransom. In short, first-party coverage is about getting your business back on its feet.

Third-party coverage pays for your liability to other people when an incident affects them. That includes claims from customers or partners whose data was exposed, the cost of defending privacy lawsuits, and the legal expense of responding to a regulator. Third-party coverage is about the claims that land on you after the fact.

Most Canadian SMB policies bundle both, but the limits and sub-limits differ by category. It is worth confirming that the parts you are most exposed to, often business interruption and breach response, carry limits that would actually cover a real incident.

Cyber Liability Coverage

Cyber liability is the third-party core of a policy: the coverage for claims that others bring against you after a breach or attack. It typically responds to a few distinct exposures.

• Privacy liability: claims from individuals or organizations whose personal or confidential information was exposed while in your care.
• Regulatory defence and penalties: the cost of responding to a privacy regulator, and, where a policy allows and the law permits, certain fines or penalties.
• Network security liability: claims arising when a failure in your systems harms someone else, for example by passing on malware or enabling an attack downstream.
• Media liability: claims tied to your digital content, such as defamation or intellectual property issues in what you publish online.

Coverage for regulatory fines in particular depends on the policy and on whether the penalty is insurable under the applicable law, so treat it as policy-specific rather than assumed.

Data Breach Response

Data breach response is usually the first-party coverage you lean on soonest, because the clock starts the moment you discover an incident. It funds the specialists and steps needed to contain the breach and meet your obligations.

• Forensic investigation: establishing what happened, what data was affected, and how the attacker got in.
• Legal counsel: breach coaches who guide the response and help determine your notification duties.
• Notification: the cost of telling affected individuals and, where required, regulators.
• Credit monitoring: services offered to affected individuals when appropriate.
• Public relations: managing communications to protect your reputation.

Notification is not just a nice-to-have. Under Canada's federal private-sector privacy law, PIPEDA, organizations must report breaches of security safeguards to the Office of the Privacy Commissioner, and notify affected individuals, when the breach creates a real risk of significant harm. The exact triggers and timelines are set out in the law, and some provinces and sectors have their own rules, so a breach coach earns their keep here. Good breach response coverage helps you meet those duties without absorbing the full cost yourself. Our guide to cyber insurance requirements in Canada covers the controls that keep this coverage intact.

Business Interruption and Ransomware

When an attack takes your systems offline, the biggest cost is often not the cleanup, it is the revenue you lose while you cannot operate. This is where two of the most valuable first-party coverages come in.

• Business interruption: income lost during the downtime an incident causes, and the extra expense of getting back online. Some policies also include dependent or contingent business interruption, which responds when an outage at a provider you rely on, such as a cloud vendor, stops your operations.
• Cyber extortion: the costs of responding to ransomware, including negotiation and specialist support.
• Data restoration: the cost of restoring or recreating data and systems after an attack.

Be realistic about ransom payments specifically. Coverage for the ransom itself has tightened significantly. Many insurers now sub-limit it, require prior approval before any payment, or exclude payments that would breach sanctions rules. The safer assumption is that a policy will help you respond to extortion and recover, but that it may not simply reimburse a ransom on demand. Tested, offline backups remain your best defence, because they let you restore without negotiating at all.

Common Exclusions

The coverage above only matters if a claim gets paid. This is the honest part that policy marketing tends to skip: cyber claims are denied, and policies are voided, more often than people expect. The usual reasons come down to controls you did not have, or answers you got wrong on the application.

• Missing controls you attested to: if you said you had MFA everywhere and you did not, an insurer can dispute a claim tied to an account that lacked it. The same applies to EDR, backups, and other controls you confirmed on the application.
• Unpatched or known-vulnerable systems: failing to address a known, patchable vulnerability can be treated as a failure to maintain reasonable security, which some policies exclude.
• Prior known incidents: a breach you were already aware of before the policy started is generally not covered. Coverage is for new, unexpected events.
• Misrepresentation on the application: inaccurate answers on the questionnaire can void coverage entirely, not just for one claim. Underwriting relies on those answers, so accuracy protects you.
• War and nation-state clauses: many policies exclude or limit losses attributed to war or state-backed cyber operations. The scope of these clauses is evolving, so the wording matters.

The pattern is clear: the controls insurers ask about are the same controls that keep a claim payable. Getting them in place, and answering the application honestly, is what turns a policy on paper into coverage you can rely on.

Get Help

At ClayGen, we help Ontario businesses put the controls insurers expect in place, and keep the evidence that supports both your application and any future claim, as part of our managed IT services. MFA, endpoint detection and response, tested backups, patching, and security training are the difference between a policy that pays and one that does not.

We are not insurance brokers, and this article is not insurance advice, since terms vary by policy. What we can do is make sure your security posture matches what you told your insurer, so coverage holds when it counts. If you are not sure where you stand, get in touch and we will walk through it with you.

Last updated September 2026. New article.