What Exclusions Should Tech Companies Watch Out for in Standard Cyber Risk Insurance Policies?

Table of Contents

1. The Erosion of Coverage in a Hardening Market

2. The "Act of War" & State-Backed Cyberattack Exclusion

3. The Application Trap: Prior Knowledge & Continuous Controls

4. The AI Exclusion & The Uncharted Frontier

5. The Sublimits Deception: Social Engineering, BEC & Funds Transfer

6. The Physical Gap: Bodily Injury & Property Damage (BI/PD)

7. Systemic Risk, Supply Chain, & Third-Party Exclusions

8. The Unpatched Vulnerability & Security Controls Requirement

9. The Professional Liability Crossover: Tech E&O Gaps

10. Comparative Matrix: Standard Cyber vs. Actual Exposure

11. Frequently Asked Questions (FAQ)

---

1. The Erosion of Coverage in a Hardening Market {#section1}

For technology companies, the standard cyber risk insurance policy is no longer the comprehensive safety net it once was. Recent market dynamics have seen premiums stabilize or even decrease in some sectors, but this affordability comes with a significant trade-off: coverage is narrowing. Carriers are introducing new exclusions and coverage limitations at a rapid pace, making policies less comprehensive and exposing businesses to severe gaps in protection .

This shift is driven by a recognition that the cyber threat landscape is fundamentally different from other commercial lines of insurance. Attackers constantly find new vectors, and courts are still settling what legacy policy language means in modern contexts . A policy issued even two years ago may read drastically differently than one available today. For executives and business owners, the figure on the declarations page is not the figure on the balance sheet if it is heavily discounted by exclusions .

To avoid a catastrophic denial, tech companies must move beyond checking the limit box and scrutinize the specific clauses that define—and often restrict—coverage. Here are the critical exclusions and limitations that demand your attention.

2. The "Act of War" & State-Backed Cyberattack Exclusion {#section2}

One of the most significant shifts in cyber insurance is the explicit exclusion of losses arising from state-backed cyberattacks. This is largely a response to massive losses like the NotPetya attack, which swept up global companies and led to disputes about whether such an event constituted an "act of war" .

The market has responded decisively. Following a landmark case involving Merck, where the court ruled that an exclusion for "hostile or warlike action" required actual military action (not a Russian intelligence operation spilling onto civilian networks), insurers rewrote the language . Lloyd's of London, for example, mandated through Market Bulletin Y5381 that standalone cyber policies must exclude losses from state-backed attacks, including those that significantly impair a state's ability to function .

The Trap: The new wording often allows the insurer to rely on government or third-party attribution to place an incident inside the exclusion. This means that if a breach is later attributed to a nation-state actor by a government body, the claim can be denied, regardless of the nature of the damage to your business . Attributing an attack is complex and often takes years, but the policy language gives insurers the power to deny coverage based on this determination long before a final verdict is reached.

3. The Application Trap: Prior Knowledge & Continuous Controls {#section3}

The second major family of exclusions revolves around what you represent on your application. Insurers underwrite your policy based on the security posture you attest to. If that representation is inaccurate, even inadvertently, you risk having your policy voided from inception.

• Material Misrepresentation: A single inaccurate answer on an application can be fatal. In a notable case, a one-million-dollar policy was rescinded after a ransomware attack because the manufacturer had attested to using multi-factor authentication (MFA) on privileged accounts when they were not fully compliant . The court voided the policy, stating that a material misrepresentation applies regardless of intent to deceive .

• Continuous Controls Warranty: The trap is sharper than a single form. Many policies now carry a "continuous-controls condition." This means you are warranting that you will continuously implement the procedures and risk controls identified in your application . A control that lapses mid-term—an expired endpoint license, a new server stood up without MFA, or a patch cycle that slips—can become the carrier's stated reason to deny a claim . They can deny even if the lapse is only arguable as a link to the breach.

4. The AI Exclusion & The Uncharted Frontier {#section4}

Artificial Intelligence represents a new category of systemic risk for insurers, and the coverage gap is immense. Standard cyber policies were built around data breaches and network intrusion, not around a model that hallucinates or a deepfake that authorizes a payment .

• The ISO's Move: In a significant development, the Insurance Services Office (ISO), which writes standard policy forms for the US market, introduced generative-AI exclusions for commercial general liability in January 2026 . The definition of AI is broad enough to capture almost any system that produces text, images, audio, video, or code .

• The Practical Gap: When a policy says nothing about AI, it has not quietly granted cover. It has deferred the question to a future dispute . For tech companies, this is a massive blind spot.

  • Data Leakage: Assume policies will not cover data leakage through prompting of external AI tools or the leakage of training data from internal AI .

  • Prompt Injection & Subversion: Breaches via prompt injection or AI subversion are generally unaddressed .

  • Damages due to AI-Driven Automation: A failed automation script generated by an AI could cause a network outage that your cyber policy might not cover .

5. The Sublimits Deception: Social Engineering, BEC & Funds Transfer {#section5}

Social engineering and business email compromise (BEC) are among the most common claim types for tech companies, yet they are frequently covered under a sublimit rather than the full policy limit . This is often more dangerous than a complete exclusion because it provides a false sense of security.

A policy with a $2 million limit may only provide $250,000 for a fraudulent wire transfer initiated by a BEC attack. For a mid-market tech company, BEC losses can easily exceed seven figures . Since these incidents are difficult to verify and prevent, insurers are capping limits or narrowing terms for these types of claims .

Actionable Step: Do not assume your policy includes full coverage for funds transfer fraud. Ask your broker specifically what sublimit applies to social engineering and invoice manipulation. Negotiate this sublimit upward if your business regularly processes large wire transfers .

6. The Physical Gap: Bodily Injury & Property Damage (BI/PD) {#section6}

A fundamental limitation of cyber insurance is that it typically covers intangible losses—data breaches, business interruption, and reputational harm—but does not extend to physical property damage or bodily injury . These are covered under other lines of insurance like General Liability or Property insurance.

For tech companies developing physical products (IoT devices, autonomous tech, medical software), this is a critical gap. If your software failure causes a physical asset to malfunction and injure someone or damage property, the cyber policy will not respond. Underwriters are increasingly scrutinizing this crossover, especially for manufacturers with operational technology (OT) environments .

7. Systemic Risk, Supply Chain, & Third-Party Exclusions {#section7}

Insurers are increasingly concerned about systemic events—attacks or outages that affect a large segment of the economy or a specific industry . A widespread cloud outage, a major supply-chain compromise, or a coordinated ransomware wave could trigger a sharp market correction and lead to correlated losses .

• Systemic Event Sublimits: Some policies reduce the potential payouts for such events by imposing a sublimit or excluding them entirely .

• Third-Party Risk: Insurers often restrict coverage to service providers and suppliers that are explicitly named in the policy . If you use a SaaS platform that relies on a cloud infrastructure provider (e.g., AWS or Azure), and the root cause of a problem was an outage at that IaaS provider, your policy likely must name that third party to get coverage . Vendors and supply chain partners now receive the same level of scrutiny as internal controls .

8. The Unpatched Vulnerability & Security Controls Requirement {#section8}

Insurers now require documented evidence of specific security controls and may explicitly exclude claims resulting from their absence . The baseline controls are stringent:

• MFA Everywhere: Multi-factor authentication on all remote access and admin accounts is non-negotiable .

• EDR on all Endpoints: Endpoint Detection and Response is required .

• Patching Latency: Some policies require IT staff to install patches for known vulnerabilities within a specified window of their release. Failing to patch in a timely way can lead to rejected claims .

• Immutable Backups: Documented and tested backups are a must .

If forensics finds a gap between what you represented and the reality of your security posture during an incident, the exclusion applies .

9. The Professional Liability Crossover: Tech E&O Gaps {#section9}

Tech companies often assume their cyber policy covers everything, but a significant exposure lies in technology errors and omissions (Tech E&O). Cyber insurance covers attack-driven incidents, but Tech E&O covers professional mistakes—software that fails to perform as promised, flawed implementation, or negligent delivery of services .

• The Overlap: A single incident can trigger both. A Business Email Compromise can evolve within weeks into allegations of professional negligence, contractual breach, and failures in technology governance . While a cyber policy may respond to the security incident, allegations concerning the negligent delivery of professional services may require a different liability analysis .

• The Trap for AI Companies: This is the fastest-growing exposure category. When an AI system misfires, biased outputs occur, or flawed recommendations surface, clients look to the developer for accountability. Regulatory frameworks around AI liability are tightening globally .

10. Comparative Matrix: Standard Cyber Policy vs. Actual Tech Exposure {#matrix}

Risk Exposure	Standard Cyber Policy Response	Common Exclusion/Limitation	The Gap for Tech Companies
State-Sponsored Attack	Often Excluded	"War" or "Act of State" clauses; Attribution clauses	High: Any breach later attributed to a state actor could face total denial of claim, even if the attack vector was common .
Social Engineering/BEC	Coverage typically provided under a sublimit, not the full limit.	Sublimit of $100k - $500k (e.g., 10-25% of the full policy limit)	Extreme: BEC losses often exceed sublimits. Companies processing high-value wires or invoicing are vulnerable to massive uninsured losses .
AI Failure/Algorithmic Bias	Generally Silent or Excluded	Absence of coverage grants or new ISO exclusions for AI	Extreme: Claims from model drift, biased outputs, or data leakage through prompting are unlikely to be covered .
Professional Mistakes (Tech E&O)	Not Covered	Cyber policies cover security breaches, not errors in product performance	High: A major financial loss due to a coding defect that causes a credit system error is a Tech E&O issue, not a cyber one .
Failure to Implement Controls	Coverage Denied	"Continuous Controls" warranties; Material misrepresentation	High: If you attest to using MFA but a privileged account lacks it, even temporarily, coverage for the ensuing breach can be denied .
Third-Party/Supply Chain Failure	Coverage constrained to named providers	Need to explicitly list vendors in the policy for outages to be covered	Significant: If a critical unnamed SaaS/Cloud provider fails, causing business interruption, you may be left with no recourse .

---

11. Frequently Asked Questions (FAQ) {#faq}

Q1: Does cyber insurance cover employee mistakes or negligence?

This is a complex area. Generally, a cyber policy is designed to cover the consequences of a security incident caused by a mistake (like an employee falling for a phishing email). However, if the mistake rises to the level of professional negligence in delivering a professional service (e.g., a managed service provider failing to implement basic security for a client), it may fall under Tech E&O, not cyber .

Furthermore, claims for employee dishonesty are sometimes excluded . The bigger issue is the "continuous controls" requirement—if the mistake was a failure to follow an internal security policy (like not disabling a terminated employee's account), the insurer may dispute the claim .

Q2: What is the difference between a claim denial and a sublimit denial?

A complete denial means the insurer pays nothing for that category of loss. This often applies to "Act of War" or bodily injury claims .

A sublimit denial is a payment limitation. The policy covers the loss, but only up to a specific, lower amount. This is common for social engineering and funds transfer fraud. The claim is not "denied," but the payout is capped at a figure much lower than the main policy limit, leaving the business to absorb the excess .

Q3: How can we negotiate better cyber insurance terms despite these exclusions?

Negotiation is possible, especially if you have a strong security posture and a clean loss history. Some strategies include:

1. Engage a Broker: Use a specialist broker who understands tech company risks.

2. Document Controls: Provide granular evidence of security controls (MFA, EDR, patch management) and AI Governance (model testing, bias audits) to demonstrate you are a low-risk client .

3. Endorse for Gaps: Specifically request endorsements to buy back coverage for social engineering (increase the sublimit), AI-specific incidents, and Tech E&O crossovers .

4. Review Client Contracts: Do not accept broad contractual liability that shifts more risk onto you than your insurance can handle .