Most business owners buy cyber insurance expecting it to cover “anything that goes wrong online.” Then a claim arrives, and they discover the policy has exclusions: situations the insurer won’t pay for, no matter how serious the loss.
Knowing the exclusions before you buy is one of the smartest things you can do. It helps you compare policies, fix security gaps that could void a claim and avoid unpleasant surprises when you need the coverage most.
Below are 12 of the most common cyber insurance exclusions, what they mean in plain English and what you can do about each one. If you’re still learning the basics, start with what cyber insurance is and what it covers.
Why Exclusions Matter
Every insurance policy has two sides: what it promises to cover and what it carves out. Exclusions are listed in the policy wording, and they override the coverage grants. Wording varies by insurer, so treat this list as a guide to what to look for, not a guarantee of how your policy reads.
1. Failure to Maintain Security Standards
This is the exclusion that catches small businesses most often. When you apply, you answer questions about your security, such as whether you use multi-factor authentication (MFA), keep backups and install updates. If an incident occurs and it turns out you didn’t actually do what you said, the insurer may reduce or deny your claim.
What to do: Answer applications honestly, and put the controls in place before you sign. Read Cyber Insurance MFA Requirements: What Insurers Expect in 2026 and How to Pass a Cyber Insurance Security Questionnaire.
2. Prior Incidents and Known Circumstances
Cyber insurance covers future events. If you were already breached, or you knew about a vulnerability or an incident before the policy started, the insurer will typically exclude it. Many policies also use a retroactive date, which means attacks that began before that date aren’t covered even if you discover them later.
What to do: Run a security check before you apply, and disclose known issues. Check the retroactive date on your declarations page.
3. War and State-Sponsored Attacks
Many policies exclude losses caused by war, hostile acts and, increasingly, cyber attacks attributed to nation-states. The wording varies widely. Some exclusions are narrow, while others are broad enough to create real uncertainty about whether a large attack would be covered. Lloyd’s of London syndicates have required state-backed attack exclusions in standalone cyber policies since 2023, and other insurers have followed with their own versions.
What to do: Ask exactly how the policy defines war and state-backed attacks, and who has to prove attribution. Compare wording across insurers.
4. Infrastructure Outages
Failures of the power grid, telecommunications network, internet backbone or other utilities are generally excluded, even if they interrupt your business. These are widespread events beyond your control that insurers don’t want to cover under a cyber policy.
What to do: Look at other protection such as backup power or business interruption coverage in your property policy.
5. Upgrades and Improvements (Betterment)
Cyber insurance helps you get back to where you were, not to improve your systems. If you’re hit by ransomware and decide to replace your whole network with newer equipment, the insurer will usually pay only to restore what you had.
What to do: Budget separately for security upgrades. Some policies offer limited “betterment” coverage that pays for part of the improvement after a claim, so ask about it.
6. Bodily Injury and Property Damage
If a cyber event causes physical harm, such as a hacked system that damages equipment or injures someone, many cyber policies exclude the physical side of the loss. Those risks traditionally sit with general liability or property insurance, and cyber exclusions can leave gaps between policies. See Does General Liability Insurance Cover Cyber Attacks?
What to do: Review all your policies together with your broker, especially if you operate machinery, medical devices or connected equipment.
7. Contractual Liability
If you promised a client something in a contract, such as a guaranteed uptime, specific indemnities or penalty clauses, the policy may not cover the liability you took on beyond what the law would require.
What to do: Have your contracts reviewed before you sign, and compare them with your policy wording. If you provide technology services, see Cyber Liability Insurance vs. Tech E&O: Which One Do You Need?
8. Fines and Penalties That Can’t Legally Be Insured
Insurers can often cover the cost of defending a regulatory investigation. Whether they can pay the fine itself depends on the type of penalty and the state or country. Some penalties are considered uninsurable by law, and some policies exclude them regardless.
What to do: Ask whether regulatory fines are covered “where insurable by law,” and check the sublimit. Compliance, such as HIPAA and PCI, helps you avoid the fines in the first place.
9. Intentional or Fraudulent Acts by Company Leadership
Policies typically exclude losses caused by deliberate, dishonest or criminal acts of the business owner or senior management. A rogue employee is often treated differently, and many policies cover theft by employees, but the definition of who counts as “the insured” matters.
What to do: Check how the policy defines insiders and whether the exclusion applies only after a final court ruling.
10. Loss of Intellectual Property and Future Revenue
Trade secrets, patents and the market value of your intellectual property usually aren’t covered if they’re stolen or exposed. Likewise, lost future business and long-term reputational harm are hard to prove and are frequently excluded or tightly limited. Cyber policies are built to cover documented, direct costs.
What to do: Protect trade secrets with strong access controls, and ask about reputational harm coverage if it’s important to you. Understand that it often has strict limits and waiting periods.
11. Outages at Vendors and Cloud Providers
If a software vendor or cloud host you depend on goes down because of its own cyber incident, you may lose income without any failure in your own systems. Many policies cover this only through an add-on called dependent business interruption, and some exclude it entirely.
What to do: List the vendors your business can’t operate without, and ask whether the policy covers losses when they’re offline.
12. Unauthorized Data Collection and Tracking
Insurers are increasingly excluding claims that arise from a company’s own improper collection or use of data. That can include website tracking pixels, biometric data and marketing data collected without proper consent. These claims have grown in recent years, especially in the United States.
What to do: Review your website’s tracking tools and privacy practices. If you handle biometric or marketing data, ask the insurer how these claims are treated.
Limits That Feel Like Exclusions
Some things aren’t technically excluded but can still leave you short. These are common limitations:
- Sublimits. Ransomware, funds transfer fraud and regulatory fines are often capped far below your main limit. Learn how this works in Business Email Compromise Coverage: What to Look for in a Policy.
- Waiting periods. Business interruption coverage often begins only after a set number of hours.
- Retentions. The deductible you pay before coverage kicks in.
- Panel vendor rules. Many policies require you to use the insurer’s approved forensic and legal providers, and using others can reduce your payout.
- Notice requirements. Late notification can jeopardize a claim.
How to Check Your Own Policy
- Read the exclusions section line by line, not only the coverage summary.
- Check endorsements, because add-ons can narrow or expand coverage.
- Look at definitions. Terms like “security failure,” “war” and “insured” decide how exclusions apply.
- Compare at least three quotes with the wording in hand, not only the price. See Best Cyber Insurance for Small Business: 10 Providers Compared.
- Ask your broker to explain every exclusion in writing.
For why claims get denied in practice, read Why Cyber Insurance Claims Get Denied (and How to Avoid It).
Frequently Asked Questions
Does cyber insurance cover ransomware?
Often yes, but with limits. Coverage can include negotiation, data recovery and sometimes the ransom payment, usually subject to sublimits and the law. See Ransomware Coverage Explained: How Claims Actually Work.
Will my claim be denied if an employee clicks a phishing link?
Usually not. Employee error is one of the most common causes of incidents, and policies are designed to respond. Claims are more likely to be challenged if you misrepresented your security controls.
Does cyber insurance cover lost income?
Many policies include business interruption coverage for lost income after a covered event, often with a waiting period and a time limit. It generally doesn’t cover long-term lost customers or future revenue.
Is a nation-state attack always excluded?
Not always. It depends on the policy’s wording on war and state-backed attacks, which varies a lot. Ask for the exact definition before you buy.
Can I remove or negotiate an exclusion?
Sometimes. Brokers can request endorsements that narrow an exclusion, add coverage back or increase a sublimit, often for an additional premium.
The Bottom Line
Cyber insurance is valuable, but it isn’t unlimited. The most important exclusions to understand are the ones you can control: be honest on the application, put the required security controls in place and keep them running. For everything else, read the wording closely and ask questions.
For a view of what you can expect to pay for the coverage you do get, see How Much Does Cyber Insurance Cost for Small Businesses in 2026?
Disclaimer: This article is for general information only and is not insurance, legal or financial advice. Policy terms vary by insurer and state. Review the actual policy wording and consult a licensed insurance professional before making a decision.