1E9Ct5D

okers to ensure that they have adequately disclosed their risks and matched theirinsurance to those risks. Cyber policy forms vary greatly in structure, terms andcoverages offered. Ensuring you have the coverage you need and expect requires acareful review of the insuring agreement, definitions, and exclusions.1. Definition of claimThe new cyber policies generally have a broader definition of claim, moving away from“bodily injury”, “property damage” and “personal and advertising injury.” The broadeneddefinition includes a demand for monetary and non-monetary damages.Cyber policies may limit coverage to internal and/or external cyber attacks. Likewise,coverage may be provided for directed viruses or malware, while excluding untargetedthreats distributed across the Internet.Cyber policies are being written as claims made, providing that a claim be made againstthe insured, and reported to the carrier within the policy period or the extended reportingperiod. But some policies also require that the cyber breach also take place during thepolicy period. This limitation can be deadly since the median time between an intrusioninto a company’s network and the discovery of the breach is 229 days. 18The longestreported presence without detection is over 2000 days. 19To avoid the gaps betweenthe intrusion and discovery, consider purchasing a policy with a retroactive date (that isinsurance jargon for pre-dating coverage to a specific time before the inception of thepolicy). Companies can also purchase policies with extended reporting (or tail)18 Mandiant, 2014 Threat Report – Beyond the Breach, https://dl.mandiant.com/EE/library/WP_M-Trends2014_140409.pdf19 Id.