Cyber Insurance Glossary: 40 Terms Every Business Owner Should Know

Cyber insurance policies are full of specialized language. Terms like “retention,” “retroactive date” and “dependent business interruption” can make a quote feel like a legal contract, and in a way it is. Misunderstanding one of these terms can mean the difference between a paid claim and an unpleasant surprise.

This glossary explains 40 of the most common cyber insurance terms in plain English, in alphabetical order. Bookmark it and use it while you compare quotes. If you’re new to the topic, start with what cyber insurance is and what it covers.

Cyber Insurance Terms, A to Z

• Aggregate limit: the maximum amount the insurer will pay for all claims during the policy period, no matter how many incidents occur. Once it’s used up, coverage ends until renewal.
• Application: the form (often a security questionnaire) you complete to get a quote. Your answers about security controls become the basis of the policy, and inaccurate answers can lead to denied claims. See How to Pass a Cyber Insurance Security Questionnaire.
• Backups: copies of your data stored separately so you can restore systems after an attack. Insurers often ask whether backups are tested, offline or “immutable” (can’t be altered or deleted). See Backup Requirements for Cyber Insurance: The Complete Checklist.
• Betterment: upgrades beyond what you had before an incident. Policies usually pay to restore your systems, not to improve them, unless a specific extension applies.
• Breach coach: typically an attorney assigned through your insurer who leads your response after an incident, coordinating forensics, legal advice and notification.
• Business email compromise (BEC): a scam in which attackers use email, often from a hijacked or spoofed account, to trick someone into sending money or sensitive data. See Business Email Compromise Coverage: What to Look for in a Policy.
• Business interruption: coverage for lost net income and certain continuing expenses when a cyber event stops your operations. See Business Interruption Coverage After a Cyber Attack: How It Works.
• Claims-made policy: a policy that covers claims made against you while the policy is active, not just incidents that happened during that time. If it lapses, you may lose protection for past events unless you buy extended reporting.
• Co-insurance: a clause that makes you pay a percentage of a covered loss. For example, 20% co-insurance means you pay one-fifth and the insurer pays the rest, after the retention.
• Cyber extortion: a threat to damage systems, leak data or keep systems locked unless a payment is made. Ransomware is the best-known example.
• Data breach: an incident in which personal, confidential or protected information is accessed, stolen or disclosed without authorization. Many laws require notification when a breach occurs.
• Declarations page: the summary page of your policy that lists your limits, sublimits, retention, policy period and endorsements. Read it first.
• Dependent business interruption: lost income when a vendor, cloud provider or supplier you rely on suffers a cyber event and stops working, even though your own systems weren’t hit.
• Endpoint detection and response (EDR): security software that monitors laptops and servers for suspicious behavior and can stop attacks. Many insurers require it. See EDR vs. Antivirus: What Cyber Insurers Actually Require.
• Endorsement: an amendment that adds, removes or changes coverage in the policy. Endorsements can expand protection or narrow it, so read them carefully.
• Exclusion: something the policy specifically doesn’t cover, such as war, prior known incidents or failure to maintain security. See What Does Cyber Insurance Not Cover? 12 Common Exclusions.
• Extended reporting period (ERP): extra time after a claims-made policy ends during which you can still report claims for past events. Often called “tail coverage.”
• First-party coverage: coverage for your own direct losses after an incident, such as forensics, data restoration, business interruption and notification costs. See First-Party vs. Third-Party Cyber Coverage: What’s the Difference?
• Forensic investigation: a technical examination to determine how attackers got in, what they accessed and how to remove them. It’s usually one of the first and largest costs after an incident.
• Funds transfer fraud: loss of money due to fraudulent instructions given to your bank or payment provider, usually without your knowledge. It’s often confused with social engineering, but the two are different coverages.
• Incident response plan: a written plan that explains who does what when an attack occurs. Insurers may ask whether you have one. See Incident Response Plan Template for Small Businesses.
• Limit of liability: the maximum the insurer will pay under the policy or for a particular coverage. It may apply per claim, in aggregate or both.
• Multi-factor authentication (MFA): a login method that requires something more than a password, such as a code from an app or a security key. It’s one of the most common insurer requirements. See Cyber Insurance MFA Requirements: What Insurers Expect in 2026.
• Notification costs: the expenses of informing affected people and regulators after a breach, including mailing, call centers and credit monitoring.
• Panel vendors: forensic firms, law firms and other providers pre-approved by your insurer. Many policies require you to use them. See Cyber Insurance Panel Vendors: What They Are and Why They Matter.
• Payment Card Industry Data Security Standard (PCI DSS): security rules for businesses that handle credit card data. Some policies cover fines or assessments if a card breach occurs, though terms vary. See PCI DSS Compliance for Small Businesses: A Plain-English Guide.
• Protected health information (PHI): health-related information that identifies a person and is protected under laws such as HIPAA in the United States. Handling PHI raises both risk and compliance duties.
• Personally identifiable information (PII): data that can identify an individual, such as names combined with Social Security numbers, driver’s license numbers, financial account details or email addresses. Breaches of PII commonly trigger notification laws.
• Phishing: fraudulent messages, usually emails or texts, designed to trick people into clicking links, giving up passwords or opening malicious files. It’s a leading cause of cyber incidents.
• Ransomware: malicious software that encrypts your files or systems and demands payment to restore access, often combined with a threat to leak stolen data. See Ransomware Coverage Explained: How Claims Actually Work.
• Regulatory fines and penalties: amounts imposed by government agencies after a data incident. Policies often cover them only “where insurable by law,” and may cap them with a sublimit.
• Retention (deductible): the amount you pay out of pocket before the insurer begins paying. Higher retentions usually mean lower premiums.
• Retroactive date: the date before which incidents or wrongful acts are not covered. If an attack began before this date, the claim may be denied even if you discover it after the policy starts.
• Social engineering: manipulating people into taking actions such as sending money or revealing information. Policies often cover it under a separate and relatively low sublimit.
• Sublimit: a smaller cap on a specific coverage within the policy. For example, a $1 million policy may have a $100,000 sublimit for social engineering fraud.
• Tech E&O (technology errors and omissions): professional liability insurance for companies that provide technology products or services, covering claims that your work failed or caused a client’s loss. See Cyber Liability Insurance vs. Tech E&O: Which One Do You Need?
• Third-party coverage: coverage for claims made against you by others, such as lawsuits from customers or investigations by regulators, including legal defense and settlements.
• Underwriting: the insurer’s process of evaluating your risk to decide whether to offer coverage and at what price. It looks at your industry, revenue, data and security controls.
• Waiting period: the time, usually measured in hours, that must pass after an outage begins before business interruption coverage starts.
• War exclusion: a clause that excludes losses caused by war, hostile acts or, in many policies, attacks attributed to nation-states. The wording varies widely and can be hard to apply.

How to Use This Glossary When Shopping for Coverage

Understanding the terms is the first step. The next is applying them to your quotes.

1. Start with the declarations page. Compare limits, sublimits, retention, waiting period and retroactive date side by side.
2. Check definitions in the policy. Terms like “security failure,” “insured” and “war” can change how coverage works.
3. Ask about sublimits for ransomware, social engineering and regulatory fines.
4. Confirm vendor rules. Find out whether you must use the insurer’s panel vendors.
5. Match the application to reality. Make sure the controls you claim are really in place.

For a fuller comparison process, see Best Cyber Insurance for Small Business: 10 Providers Compared and How Much Cyber Insurance Coverage Do You Need?

Frequently Asked Questions

What is the difference between a limit and a sublimit?

A limit is the maximum the policy will pay overall or for a coverage. A sublimit is a smaller cap inside the policy for a specific type of loss, such as ransomware or social engineering.

What is the difference between a retention and a deductible?

In cyber insurance, they mean essentially the same thing: the amount you pay before the insurer starts paying. “Retention” is the term more commonly used in business policies.

Why does the retroactive date matter?

It decides whether an older incident can be covered. If a breach began before your retroactive date, the insurer can deny the claim even if you only discover it after the policy starts.

Is a claims-made policy different from an occurrence policy?

Yes. A claims-made policy covers claims reported while the policy is active. An occurrence policy covers events that happen during the policy period, regardless of when the claim is made. Many cyber and E&O policies are claims-made.

Where can I find these terms in my own policy?

Start with the declarations page and the definitions section. Ask your broker to walk you through each one in writing.

The Bottom Line

The language of cyber insurance is dense, but you don’t need to memorize it. Learn the terms that affect your payout the most: limits, sublimits, retention, retroactive date, exclusions and conditions tied to your security controls. Then use them to compare quotes line by line.

When you’re ready to see what coverage costs, read How Much Does Cyber Insurance Cost for Small Businesses in 2026?

Disclaimer: This article is for general information only and is not insurance, legal or financial advice. Policy terms vary by insurer and state. Review the actual policy wording and consult a licensed insurance professional before making a decision.