FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Cyber exclusions
UK cyber insurance usually does not cover system upgrades, losses where agreed security conditions were not met, breaches you already knew about, war and many state-backed attacks, wider infrastructure failures, physical injury or damage, uninsurable fines, unlawful ransoms, card-scheme penalties, or invoice fraud without specific cover.
Part of: Cyber insurance guide
In short
Cyber insurance pays many of the costs of an attack or breach, including incident response, data restoration, business interruption and liability claims. It does not pay for everything. Most policies exclude betterment, known prior incidents, war, infrastructure outages and injury or damage, and many limit ransoms, fines, PCI assessments and funds transfer fraud. Security conditions such as MFA and encryption can matter as much as the exclusions themselves.
Wordings differ, but these gaps appear in many UK cyber policies.
| Not covered (usually) | Example | Where cover usually comes from |
|---|---|---|
| Betterment and upgrades | Replacing an old server with a better system after an attack | Your own budget; some policies allow limited betterment |
| Losses where security conditions were not met | Attackers use an admin account without MFA | Meeting the conditions you agreed to |
| Prior known incidents | Suspicious logins seen before cover started | The earlier policy, if one was in force |
| War and many state-backed attacks | Malware attributed to a foreign state | Depends on the exact clause; often no cover |
| Infrastructure and utility outages | A regional power or telecoms failure | Usually uninsured; dependent BI covers some supplier outages |
| Bodily injury and property damage | A hacked control system damages machinery | Property and liability policies, subject to their own cyber terms |
| Uninsurable fines | A regulatory fine the law will not let you insure | No cover; investigation costs often covered |
| Unlawful ransom payments | A demand from a sanctioned group | No cover; lawful payments only with insurer consent |
| Long-term lost profit and reputation | Customers drift away months later | Limited reputational harm extensions, if any |
| Social engineering and payment fraud | Staff pay a fake supplier invoice | Crime insurance or a social engineering extension |
| Contractual penalties and PCI assessments | Card-scheme assessments after a card breach | A specific PCI extension, often sublimited |
| Intellectual property | Stolen source code loses its value | Media liability for some infringement; IP insurance |
Policies usually pay to restore systems and data to where they were before the incident, not to improve them. Scenario: after a ransomware attack, an Essex accountancy practice decides to replace its ageing server with a new cloud set-up. The policy pays roughly what restoring the old environment would have cost; the upgrade is the firm's own spend. Some wordings allow limited betterment where like-for-like is no longer available. See what cyber insurance actually pays for.
Many policies depend on stated controls: multi-factor authentication on email and remote access, prompt patching of critical vulnerabilities, regular offline backups, and encryption of laptops and portable devices. Some exclude losses from unencrypted devices or unsupported software outright. Scenario: a recruitment firm said MFA covered all remote access, but one admin account was exempt and attackers used it. Under section 11 of the Insurance Act 2015 an insurer cannot rely on breach of a risk-reducing term if the breach could not have increased the risk of the loss that happened, but here it plainly did. Answer the proposal accurately too; see fair presentation.
Incidents that began, or that you knew about, before cover started are usually excluded. Scenario: a retailer's IT provider spots unusual logins in May, the business buys cyber cover in June, and in August finds the attacker has been inside since spring. Expect a dispute. Disclose anything unusual when you apply, and when a policy ends think about cyber run-off and extended reporting.
Most cyber policies exclude war, and many now also exclude cyber operations carried out by or for a state, particularly those that seriously damage another state's essential services or security, with rules on how attribution is decided. Scenario: a logistics firm is hit by malware later attributed to a foreign state; whether it is covered turns on the exact clause. See how war exclusions differ.
Failures of power, telecoms, internet infrastructure or satellite services outside your control are usually excluded. Scenario: a regional power cut takes an online shop offline for a day; that is not a cyber claim. Outages at IT or cloud suppliers you depend on may be covered by dependent business interruption or system failure extensions, often with lower limits. Compare with business interruption insurance.
Physical injury and damage to tangible property are usually excluded, although many policies pay to replace hardware made unusable by malware. Scenario: an attack on a factory's control system causes a machine to fail and damage stock. Property and liability policies may or may not respond, as many carry their own cyber exclusions; see ransomware: cyber v property v BI.
Cyber policies often cover fines and penalties only where insurable by law. Whether a UK GDPR fine can lawfully be insured has not been clearly settled, so cover may be offered without any promise it will pay. The costs of responding to an ICO investigation are more commonly covered. Scenario: a dental group's patient records are exposed; the policy funds lawyers and the ICO response, but any fine may sit with the business. See GDPR fines v civil claims.
Paying a ransom is not generally illegal in itself, but OFSI's ransomware guidance says making funds available to a sanctioned person is a criminal offence and licences for ransomware payments are unlikely to be granted. The NCSC and UK law enforcement do not encourage, endorse or condone paying. Policies with extortion cover usually need the insurer's prior consent, sanctions checks and a police report, and pay only where lawful. The government has also proposed a ban on payments by public sector bodies and critical national infrastructure. Scenario: a manufacturer receives a demand; checks link the group to a sanctioned entity, so no payment is made and recovery runs from backups.
Business interruption cover usually pays lost profit during a set indemnity period. Custom lost after that, and long-term damage to brand value, are usually excluded, though some policies include limited reputational harm cover and crisis PR costs. Scenario: a hotel group's breach makes headlines and bookings stay weak for a year. See reputational damage after a breach.
Being tricked into sending money, for example after a spoofed supplier email, is often excluded from core cyber cover or offered only as a small extension with conditions such as call-back checks. Scenario: a bookkeeper updates a supplier's bank details from an email and pays the next invoice to a fraudster. Crime insurance is the natural home; see social engineering and fund transfer fraud.
Penalties, service credits and liquidated damages you agreed to in a contract are usually excluded unless you would have been liable anyway. Card-scheme assessments after a card data breach are often excluded or covered only by a specific, sublimited PCI extension. Scenario: an online shop's checkout is skimmed and its payment provider passes on assessments. See cyber for retailers and PCI DSS.
Patent infringement and the lost value of your own trade secrets are usually excluded. Some policies cover copyright or trade mark infringement in online content under media liability. Scenario: attackers steal a software company's source code; restoring and investigating may be covered, but the drop in the code's commercial value is not. See media and IP liability.
Some policies cover lawful extortion payments, usually only with the insurer's prior consent and after sanctions checks. Paying a sanctioned person is a criminal offence, and the NCSC and UK law enforcement do not encourage, endorse or condone paying.
Only where insurable by law, and that is not clearly settled for UK GDPR fines. The costs of responding to an ICO investigation are more commonly covered.
Often not under core cover. Funds transfer fraud and social engineering usually need crime insurance or a specific extension with conditions such as call-back verification.
If the policy or proposal required MFA and the attack used an account without it, the insurer may decline or reduce the claim. If the gap could not have increased the risk of the loss that happened, the Insurance Act 2015 may stop it relying on the breach.
Often, under dependent business interruption or system failure extensions, usually with lower limits and waiting periods. Wider utility and internet infrastructure failures are usually excluded.
Many policies exclude war and certain state-backed cyber operations. Whether a particular attack is caught depends on the exact clause and how attribution is decided.
Send us your schedule and wording and a broker will tell you where the gaps are, with no obligation. Or call 0117 325 0027.
Ask a broker Start a commercial enquiryApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about common policy exclusions, not advice on your individual circumstances. Wordings differ, so always check your own policy. It does not guarantee that cover will be available or on what terms.
