![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.
What Legal Language Should I Look Out for When Selecting Cyber Insurance?
At times, vague coverage can actually work for you.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb95506dbb3618867/64f0d07668861bf21ac5de85/602x250_shield_insurance_protection.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Question: What legal language should I look out for when selecting cyber insurance?
Andrea Luoni, CEO and founder of RateCraft: This is a great question because a higher premium does not always equal better protection when it comes to cybersecurity insurance. That's because money does not guarantee protection – language does. Many coverages can actually be added or increased by adapting the language with little to no change in premium.
Although it may not seem like it in the moment, vague coverage surrounding cybersecurity can be better in some cases, as it can give business insurance attorneys more room to find an opening for coverage in the case of a legal conflict with the carrier.
Conversely, if the language is very specific, be cautious of what it is or is not saying. For example, if the policy lists coverage for being hacked or a ransomware attack, these are good things to be included that could be of great concern to a business. However, that may mean other cybersecurity issues, such as social engineering, are not covered. The business may not even know to look for social engineering coverage or whether the carrier offers the coverage but under a different name.
Read the fine print, or exclusions, too. It could have a clause that voids coverage for "insider compromise" or that unknowingly requires social engineering coverage to have dual authentication implemented. A cyber policy should also have universal triggering definitions between first- and third-party coverages. Many policies can lack this, which can cause problems if claims are covered on one side of a policy and not the other.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024