A cyber policy combines two types of cover: first-party cover for your own costs and losses, and third-party cover for claims made against you. Here's how the parts fit together. Your policy wording and schedule set out exactly what applies to you.

First-party cover: your own losses

Incident response and breach costs

Specialist IT forensics to find out what happened, legal advice on your obligations, notifications to the Information Regulator and affected people under POPIA, call-centre support and crisis communications.

Ransomware and extortion

Expert negotiation and response, and extortion payments where lawful, insurable and approved in advance by the insurer.

Data and system restoration

Costs of restoring, recreating or recollecting data and software damaged or encrypted in a cyber event.

Business interruption

Lost net profit and extra costs of working while systems are down, after a waiting period. Some policies extend to outages at key suppliers or non-malicious system failure.

Cyber crime (where included)

Some policies include limited cover for funds stolen through social engineering or invoice fraud. This is often sub-limited and subject to verification conditions. [TODO: confirm whether and how this is offered].

Third-party cover: claims against you

Network security liability

Claims alleging your security failure harmed others, for example by spreading malware or enabling access to a partner's systems.

Privacy liability

Claims from individuals or organisations whose personal or confidential information was compromised, and the costs of responding to regulatory investigations.

Regulatory fines and penalties

Covered only where insurable under South African law and the policy wording. [TODO: confirm position with the carrier].

See how these sections apply to your business. Start a Cyber Risk Check.

Get a Cyber Risk Check

Common exclusions worth understanding

Every policy has exclusions. These are the ones that most often surprise buyers. Wording varies, so always read your own policy.

  • Known or prior incidents. Events you knew about before cover started.
  • Betterment. The cost of upgrading systems beyond their pre-incident state.
  • Infrastructure failure. Widespread outages of power, internet or telecoms infrastructure.
  • War and state-backed attacks. Wording in this area has changed in recent years. Check it carefully.
  • Physical damage and bodily injury. Usually left to property and liability policies.
  • Failure to maintain stated controls. Some policies attach conditions to controls you declared, such as MFA.
  • [TODO: align this list with the actual policy wording]

How limits, sub-limits and deductibles work

The overall limit is the most the policy pays across all claims in a period. Sub-limits cap specific sections, such as cyber crime or extortion. The deductible (excess) is the amount you carry before cover responds, and for business interruption there's usually a waiting period in hours. [TODO: add product-specific defaults].

This guide is general information, not advice. Cover depends on the terms, conditions, limits and exclusions of your policy wording.