The four families that get confused

A cyber policy is not one cover but four, housed in the same contract and triggered by the same event, which pay neither the same things, nor the same people, nor at the same time. Response costs pay providers who come and work. Business interruption pays what the company did not earn. Third-party liability pays what others claim. Extortion reimburses a ransom under conditions. An insured notifying "my cyber loss" to its insurer has said nothing useful: one must name which of those four covers is being called, and the order in which they are called decides the final amount.

That confusion comes from a habit formed elsewhere. In property insurance, a loss is notified, surveyed and settled: the insured suffers, then claims, and the time between the two does not change the amount much. In cyber, that pattern is wrong and expensive. The first two days decide the extent of encryption, the volume of data taken out, the length of the interruption and therefore three items out of four. The insured that waits until it has an amount to claim has already lost the part of the loss it could control.

The first cover to respond is therefore response costs, and it responds before anyone knows what has been lost. It pays for a technical investigation that will say what happened, legal advice that will protect that investigation, notification logistics, and communications. It is the only one of the four whose good use reduces the other three: a practised team on site at six in the morning shortens the interruption, limits exfiltration, and therefore bounds future liability. That is why its ceiling, almost always below the policy's, deserves to be read before the loss.

The second is business interruption, and it has a feature property insurance does not know: it triggers without damage. The servers are intact, the building is standing, and the company is not producing. Its starting point is not physical damage but a system interruption, measured in hours, and its duration ends not at technical restart but at the return to expected activity. Between the two there are often several weeks of partial production the insured forgets to claim because it considers that it has restarted.

The third, third-party liability, obeys a timetable entirely different from the first two. It is not quantified at the time of the loss: claims arrive over years, brought by people whose data leaked, by corporate customers whose contracts provide for indemnification, and sometimes by a supervisory authority. It is a long-tail item grafted onto an instantaneous event, and one must resist the urge to settle it quickly to close the file.

The fourth is extortion, and it is the only one where the policy decides nothing. Whether to pay a ransom is the company's decision, taken under time pressure, and insurance reimburses it under conditions rather than steering it. Those conditions are not formalities: prior consent, verification of the recipient against sanctions regimes, use of a negotiator. An insured that pays first and notifies later turns a cover into a contentious discussion, on an expense it can no longer undo.

The order in which these four covers wake is therefore not an architectural curiosity, it is the conduct of the loss. Call first the cover that sends people, because it reduces the other three. Then measure the interruption day by day, rather than estimating it in the third month. Let liability develop without rushing. And treat extortion as a company decision bounded by conditions, not as a cover that would decide in the executive's place. An insured that knows this order has already done half the work of the first two days.