Cyber Insurance and Warranty

In Short

Cyber insurance is a policy from an insurer that pays for breach response, lost income and claims from others after an incident, whether for your MSP or for a client. A warranty is a promise from a security vendor to pay out if its product fails in a specific way, and it is much narrower. Neither replaces the other, and neither replaces the professional liability cover your MSP carries for its own mistakes.

What It Does

• Breach response. Pays for forensics, legal advice, notification and recovery after an incident.
• Business interruption. Covers income lost while systems are down, usually after a waiting period.
• Third-party claims. Covers claims from clients or others harmed by an incident, where the policy includes it.
• Responder panel. Gives access to approved incident responders, whose use may be required rather than optional.
• Underwriting scans. Some insurers scan your external systems before and during the policy and flag what they find.
• Warranty payout. A vendor warranty pays a set amount when its product is shown to have failed under the warranty's terms.

When You Need One

What to Look For

How It Is Priced

Insurance is quoted, never listed: the premium depends on your revenue, the controls you can prove, the clients you serve and your claims history. Warranties are usually bundled with a security product or priced per endpoint alongside it. Watch the deductible, the waiting period on business interruption, sub-limits on particular losses, and exclusions that turn on a control you said was in place.

Switching

Policies renew each year, so changing insurer is mostly a matter of timing, but make sure there is no gap in cover and that incidents from before the switch are still covered. A warranty simply ends when you stop using the product it comes with. Before you sign, read which controls the policy assumes you have, because a claim can be refused if one was missing.

Questions to Ask a Vendor

1. 01Which controls must be in place for a claim to pay, and how do you check them after an incident?
2. 02Does the policy cover an incident that starts in my own remote management tools and spreads to clients?
3. 03Must I use your incident response panel, or can I bring a firm I already know?
4. 04What are the sub-limits for social engineering and fraudulent payment requests?
5. 05How many warranty claims have you paid, and what evidence did each one need?
6. 06What happens to an incident that is discovered after the policy ends?