Insurance Glossary
The reason cyber insurance wording is hard to read is largely its dense terminology. This page explains the most common terms in everyday language, so you can cross-reference them while reading a policy or article.
Underwriting and Cover-Related
| Term | Explanation |
|---|---|
| Underwriting | The process by which an insurer assesses risk when you apply for cover. Cyber insurance underwriting usually requires a security controls checklist (such as multi-factor authentication, endpoint detection, offline backups). |
| Duty of fair presentation | When applying, you must honestly and completely disclose matters the insurer asks about, including past cyber incidents, deployed security measures and data volume. |
| Utmost Good Faith | The foundational principle of an insurance contract: both parties must disclose material information to the highest degree of good faith. The insured's side is mainly reflected in fair presentation. |
| Material Fact | Information that would affect the insurer's decision on whether to accept the risk, or how to price it. Failure to disclose a material fact may affect the validity of the policy. |
| Prior Known Circumstances | Cyber events or vulnerabilities that occurred, or reasonably should have been known, before the policy took effect; generally not covered. |
| Standard / Loaded / Exclusionary underwriting | Three common underwriting outcomes: cover on standard terms, cover with an increased premium, or cover after excluding certain risks from protection. |
Premium and Cost-Related
| Term | Explanation |
|---|---|
| Premium | The amount paid periodically in exchange for coverage. The cyber insurance premium usually depends on industry, data volume, maturity of security controls and past incident history. |
| Deductible / Excess | The amount the insured must bear for each claim, with the insurer paying only the portion above it. The higher the deductible, the lower the premium usually is. |
| Co-insurance | An arrangement where the insurer and insured share costs in proportion, e.g. the insurer pays 80% and the insured bears 20%. |
| Sub-limit | A separate compensation cap set under the overall limit for a specific coverage item, usually non-fungible. For example, incident response, business interruption and ransom each have their own sub-limit. |
Coverage Structure-Related
| Term | Explanation |
|---|---|
| Exclusions | Circumstances explicitly listed in the policy as not covered. Common cyber exclusions include prior known circumstances, war, specific AI risk exclusions, and failure to meet minimum security requirements. |
| Sum Insured / Benefit Limit | The maximum amount a policy will pay for a coverage item, which may be per occurrence, per year, or for the policy period. |
| Indemnity | Payment based on actual expenditure, not exceeding the actual cost, usually subject to a cap. |
| Fixed Benefit | Payment of an agreed amount, irrespective of actual expenditure. |
| Cooling-off Period | A specified period after policy delivery during which the policyholder may cancel and recover premiums paid (possibly less any fees incurred). |
Claims and Incident-Related
| Term | Explanation |
|---|---|
| Claim | The procedure by which the insured applies to the insurer for compensation under the policy wording. Cyber incidents usually require notification as soon as possible to trigger incident response. |
| Claim Period / Time Limit | The time limit set in the wording for submitting a claim. Missing it may affect claim rights. |
| Settlement | The insurer's decision on a claim, which may be full, partial or denied. |
| Subrogation | After paying, the insurer acquires the right to recover from the third party that caused the loss (e.g. the attacker or a negligent service provider). |
| Double Insurance | More than one policy covering the same risk and same interest. Compensation is usually shared proportionally, without any extra profit. |
| Insurance Complaints Bureau | An independent complaints body handling insurance claims and related disputes. Please refer to its public guidelines for the exact scope and monetary limits. |
Liability and Operations-Related
| Term | Explanation |
|---|---|
| Public Liability | Legal liability arising from bodily injury or property damage to third parties caused by business activities. Cyber insurance's third-party liability covers compensation and notification costs arising from a client data breach. |
| Employee Compensation Insurance | Insurance an employer takes out for its statutory liability for work-related injury or death of employees during employment. |
| Business Interruption | Coverage for lost profits or fixed expenses during a business suspension caused by an insured incident (e.g. systems down due to ransomware); one of the core first-party covers in cyber insurance. |
| Replacement Cost | The cost to rebuild or repurchase with new equivalent items, usually higher than depreciated actual value. |
| Actual Value | The value of an item at the time of loss (after depreciation). |
Cyber Security and AI-Related
These terms have a dedicated section: Cyber Security and AI Insurance (including Products and Coverage Structure and the Education Hub).
| Term | Explanation |
|---|---|
| Cyber Insurance | Insurance covering both the insured's own losses (first-party) and liability to third parties (third-party) arising from cyber incidents, usually with incident response services attached. |
| First-party Cover | Covers the insured business's own losses, such as incident response costs, business interruption, and data restoration. |
| Third-party Liability | Covers the insured business's liability to others (clients, partners, regulators), such as data breach notification and compensation. |
| Incident Response | A series of actions after an incident — digital forensics, legal, PR and crisis management — mostly carried out by a specialist team arranged under the policy. |
| BEC (Business Email Compromise) | Attackers impersonate or hack email accounts to induce a business to transfer funds to their account; many policies set a separate sub-limit. |
| Ransomware | Malware that encrypts a business's files and demands payment for the decryption key; recently it also steals data to threaten public release. |
| Digital Forensics | Professional work to collect and analyse digital evidence after an incident, to determine cause, scope and impact. |
| Social Engineering | Tricks that exploit human weakness (rather than purely technical vulnerabilities) to obtain credentials, funds or data, such as scams impersonating executives or suppliers. |
| Prior Known Circumstances | Circumstances that occurred or should have been known before the policy took effect; generally not covered. |
| AI Exclusion | A clause in a policy that excludes "legal liability arising from the use or deployment of artificial intelligence". |
| AI Hallucination | AI-generated content that appears plausible but is actually wrong, potentially causing third-party reliance loss. |
| Agentic AI | An AI system that can plan and execute tasks on its own, e.g. calling tools or making decisions autonomously. |
| Human-in-the-loop | An AI oversight model in which a human retains decision authority. |
| Embedded Insurance | An arrangement that embeds insurance directly into a product or service sales flow, e.g. obtaining coverage when purchasing a technology service. |
| Cyber Resilience | An enterprise's ability to maintain operations and recover quickly after a cyber attack. |
| Cyber Resilience Assessment Framework (CRAF) | An assessment framework under the Insurance Authority's Cyber Security Guideline, comprising inherent risk assessment, maturity assessment, and threat-intelligence-based attack simulation. |
| Underwriting Questionnaire | The security and risk questionnaire an insurer requires before cover; the core basis for cyber insurance pricing and underwriting. |