Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. A cyber policy shows an overall limit of 5 million euros, with a 250,000 euro sub-limit for funds transfer fraud. A fraudulent transfer costs 800,000 euros. What does the cover allow?
250,000 euros, the sub-limit capping this head of cover
A sub-limit is a specific cap, lower than the overall limit, applying to one particular head of cover. The point to hold onto is that it never adds to the overall limit: it subdivides it. A sub-limited head can therefore consume only a fraction of the headline figure, and the difference cannot be recovered elsewhere. It is a central steering tool in cyber, where the insurer bounds its exposure on the most volatile or hardest to model heads, ransoms, funds transfer fraud, interruption caused by a third party supplier. It is also the commonest source of misunderstanding at claim time: a high overall limit can sit above much lower internal caps on precisely the covers that will respond. Reading a policy means reading its sub-limits before its limit.
Glossary entry →2. A policy carries a 1 million euro limit per claim and a 2 million euro annual aggregate. Two full losses hit in March and June. A third occurs in October. What happens?
The cover is exhausted and it is not covered until renewal, absent a reinstatement clause
The aggregate limit is the maximum payable across all losses in a period, every event combined, and it differs from the per-claim limit which caps each event on its own. A contract often carries both, and it is the combination that decides: here, two full one million losses have consumed the two million annual aggregate, so the per-claim limit has nothing left to cap. The insured is left without cover until renewal while still paying an annual premium, and that is the least anticipated consequence of the mechanism. Aggregates are an essential exposure control for insurers in high frequency or accumulation-prone lines, cyber among them. Reinstating cover after exhaustion is possible, through a reinstatement clause, whose financial terms are read at inception and not at the third loss.
Glossary entry →3. A cyber policy carries a 50,000 euro deductible per claim. An attack costs 200,000 euros. What share does the insurer pay?
150,000 euros
The deductible is the share of a loss the insured keeps before cover responds: here the first fifty thousand, the insurer settling the remaining hundred and fifty. It serves three functions that reinforce each other. It lowers the premium, since the insurer no longer handles small losses whose administration often costs more than the payment itself. It curbs moral hazard, keeping the insured financially interested in prevention and in limiting damage. And it refocuses the cover on events that genuinely warrant a transfer of risk. Two main forms exist, and confusing them changes the answer: an absolute deductible is always taken off the settlement, while a franchise deductible falls away entirely once the loss passes an agreed threshold. There are also annual aggregate deductibles, capping what the insured retains across the whole year.
Glossary entry →4. A cyber policy carries a twelve hour waiting period on business interruption cover. An outage lasts eight hours. What does the insurer pay?
Nothing, the outage not having reached the waiting period
A waiting period is a deductible expressed in time rather than money: it runs from the moment of loss, and during that window the insured bears the consequences alone. An outage shorter than the period therefore produces nothing at all, and that is the consequence that surprises most. For a longer stoppage, only the part beyond the first hours is indemnified: a three day outage with a twelve hour waiting period is covered for everything past those twelve hours. The economic role is twofold, screening out the short frequent interruptions whose handling would be disproportionate, and leaving the insured with the first phase, which is usually the one good preparation can control. In cyber it is a decisive underwriting parameter for business interruption, because the distribution of outage durations is heavily concentrated at the low end: moving the period by a few hours moves a large share of the loss burden.
Glossary entry →5. A company changes liability insurer. A client complains of a defect that occurred two years earlier. The new policy is claims-made with a retroactive date later than the fact, and the old one carried no extended reporting period. Who pays?
Neither, the loss falls into a gap in cover
The trigger basis decides which contract responds when years separate an act from its consequences. On an occurrence basis, the cover in force when the act happened responds, whatever the date of the claim. On a claims-made basis, the cover in force when the claim is made responds instead, provided the act is not earlier than the retroactive date. Most professional liability and cyber policies are written claims-made, which makes changing insurer delicate. Here both boundaries fail at once: the new policy rejects the act because it predates its retroactive date, the old one rejects the claim because it comes after expiry with no extended reporting period to carry it. The company was insured without interruption and still finds nobody to pay, which is the definition of an orphan claim.
Glossary entry →6. In a claims-made cover, what exactly does the retroactive date fix?
The maximum age of triggering facts capable of being covered
The retroactive date sets a boundary looking backwards: any triggering fact earlier than that date is excluded, even where the claim itself falls squarely inside the policy period. It tempers the logic of the claims-made basis, which would otherwise look only at the claim date and expose the insurer to indefinitely old facts. Its continuity is the decisive practical point when changing insurer: the new policy must pick up a date old enough to cover acts already committed but not yet claimed. A date set at inception, which looks innocuous, leaves the whole of the prior activity bare. In professional liability as in cyber, where consequences surface late, checking this single line decides the real worth of the contract.
Glossary entry →7. A consultant ceases trading and buys a five year extended reporting period. Three years later, a former client alleges an error committed before he stopped. What happens?
The claim is met, the extension covering exactly this case
An extended reporting period prolongs, after a claims-made contract expires, the window in which the insured may still notify claims relating to facts predating that expiry. It is the exact counterpart of the retroactive date: one bounds the cover backwards, the other forwards. Its usefulness comes from the lag peculiar to liability, where the claim is often born long after the act. Without it, someone changing insurer or ceasing to trade would lose all cover for late claims aimed at their trading period, even though they were properly insured when the acts occurred. Its length runs from a few years to unlimited in certain cessation cases, notably for regulated professions. Its presence and its length are therefore matters to examine at inception, not only at cancellation, because once trading has ceased it is too late to obtain one.
Glossary entry →8. A painting is insured on an agreed value basis for 2 million euros. Three years later it is destroyed in a fire, the artist's market having fallen 30 percent. What does the insurer pay?
2 million euros, with no valuation, the agreement prevailing over the market
Agreed value is the central mechanism for insuring property whose worth cannot be objectively established, art and collectibles first among them. Rather than deferring valuation to the date of loss, as ordinary indemnity insurance does, the parties settle in advance the amount payable on a total loss, with no valuation and no argument. Market wordings state that the figure is fixed for the purposes of the contract alone, with no representation as to what the item would fetch if sold: it is a convention, a number the parties agree to treat as true so that they can contract at all. It therefore departs deliberately from the indemnity principle, since the insurer pays the agreed sum even where market value has fallen between inception and loss. That is the price of certainty, and it is what the insured is buying.
Glossary entry →9. An airline holds a parametric product indexed on wind. The threshold is breached at a covered airport on a day when none of its flights were scheduled there, and 500,000 euros pay out automatically. What can a regulator challenge?
The existence of an insurable interest at the moment of trigger
Insurable interest is a condition of validity of the insurance contract in many legal systems: the insured must have an economic or proprietary interest in the preservation of the property or situation covered. Without it the contract is no longer insurance but a wager on an event, which most systems either void or treat as contrary to public policy. The interest can take several forms, ownership of property, a debt owed, a contractual relationship whose rupture would cause loss, or a person's life and health. It is assessed in principle at inception and at the time of loss, and it is that second requirement parametric insurance strains: the trigger is automatic and verifies no actual loss. A payment can therefore land with no matching damage, which exposes the structure to recharacterization. That is why structurers build in a minimum operational nexus between the index and the insured's activity.
Glossary entry →10. The Lloyd's Market Association cyber war clauses run from LMA 5564 to LMA 5567A. What does the write-back that separates them denote?
A restoration of cover for a subset of risks the exclusion had removed
A write-back is the mechanism by which an exclusion carries an exception restoring cover for a subset of the risks it had removed. In the Lloyd's Market Association cyber war clauses it measures exactly the residual cover the insurer is willing to keep despite the main exclusion, and the scale is explicit: LMA 5564 is a total exclusion with no write-back, while LMA 5567A carries the widest one. In between, LMA 5565 caps the write-back with sub-limits to be filled in the contract, while LMA 5566 and 5567 leave it uncapped within the clause itself, the policy limit then applying. For property policies, LMA 5400 writes back only physical damage caused by fire or explosion following a non-malicious cyber incident. Two policies can therefore carry the same war exclusion and deliver very different cover: what separates them is the clause number, not its title.
Glossary entry →