First-party cyber covers
The part of the cyber policy that indemnifies losses suffered by the insured itself, incident response, restoration, business interruption, extortion, as opposed to its liability to third parties.
A cyber policy is made of two halves that the underwriter prices separately. First-party covers indemnify losses the insured suffers itself as a result of an incident: incident response and technical investigation costs, legal and notification costs, data and system restoration, business interruption and extra expense, extortion, sometimes replacement of hardware made unusable and fraud. Third-party covers address its liability to others: customers whose data leaked, infected partners, authorities. The distinction drives underwriting. First-party covers are exposed to ransomware frequency and outage length, and therefore to the quality of the insured's backups and detection. They are also the ones that accumulate most, since a single attack or supplier outage hits the business interruption of thousands of insureds at once. Liability, by contrast, develops slowly, at the pace of litigation, and follows a logic close to financial lines. Since 2020, most cyber losses have come from the first-party side.
A large technology group's annual study on the cost of data breaches estimated the average global cost of a breach in 2024 at 4.88 million dollars, most of it from detection, remediation and lost business, that is, first-party items.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.