What is not covered under cyber insurance?

What is not covered under cyber insurance in Australia varies by policy, but there are common exclusions across most policies from QBE, Chubb, Zurich, Allianz and AIG. Cyber insurance typically does not cover physical property damage or bodily injury caused by a cyber incident unless you have specific cyber-physical endorsement, so if a cyber attack causes a fire or equipment damage, property insurance is needed. It does not cover infrastructure failure or power outage that is not caused by a cyber attack, for example if your internet goes down due to telco outage, business interruption from that is not covered. It does not cover known vulnerabilities you failed to patch, if you knew about a critical vulnerability and did not fix it within reasonable time, insurer may deny claim. It does not cover fraudulent or dishonest acts by directors or employees intentionally causing breach. It does not cover prior known breaches or circumstances you knew about before policy started. It does not cover fines and penalties from regulators unless specifically included, many policies exclude regulatory fines. It does not cover loss of future profits or reputational damage beyond defined business interruption period, typically 3 to 12 months. It does not cover cryptocurrency theft unless specifically endorsed. It does not cover war, terrorism or state-sponsored attacks if classified as act of war, though many insurers are removing war exclusion for cyber. It also does not cover failure to backup data, if you have no backups, data restoration costs may be limited. Always check Product Disclosure Statement for exclusions.