Over 99 percent of cyber claims accepted

IN Partnership with

With its high claims acceptance rate, CFC is proving that cyber insurance pays out. By eliminating exclusions and offering proactive support, the specialty insurer is building trust with clients and brokers

FEW INSURANCE products have faced more scrutiny than cyber insurance. Businesses often question whether policies will truly pay out when disaster strikes, while brokers may wonder if they can trust carriers to back up their promises. Cyber insurance’s reputation has been dented by coverage exclusions, security warranties, and claims denials that leave policyholders stranded. But CFC is challenging that narrative. The specialty insurance provider has maintained a 99.1 percent cyber claims acceptance rate, a significant benchmark, based on data from 2024. Lindsey Nelson, head of cyber development at CFC, explained its unique claims approach and what it means for clients and insurance brokers. “Too often, businesses hear about claims being denied due to some obscure exclusion or technicality. That’s not how we operate,” Nelson said. “If a client has a cyber event, we are going to help.”

CFC is a specialist insurance provider, pioneer in emerging risk, and market leader in cyber. Our global insurance platform uses cutting-edge technology and data science to deliver smarter, faster underwriting and protect customers from today’s most critical business risks. Headquartered in London with offices in New York, Austin, Brussels, and Brisbane, CFC has over 500 staff and is trusted by more than 100,000 businesses in 90 countries.

Find out more

“Cyber insurance is one of the most scrutinized products in the market, and we are committed to educating businesses on its value”

Lindsey Nelson, CFC

CFC’s 99.1 percent claims acceptance rate is not by accident. The company has designed its cyber policies from the ground up to avoid the pitfalls that often lead to claim denials. According to Nelson, one major differentiator is how CFC structures its policies. Many insurers insert strict security warranties into their contracts, she said, effectively allowing them to deny coverage if a business fails to meet a certain cybersecurity standard. However, CFC takes the opposite approach. “From a product perspective, ensuring there are no warranties on best-in-class security controls, callback provisions, and backups plays a key role in claims acceptance,” Nelson said. “We believe they are the primary factor behind our high claims acceptance rate.”

What’s behind CFC’s high cyber claims acceptance rate?

Published Apr 7, 2025

Specialty

Best in Insurance

Resources

Risk Management

News

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Specialty

Best in Insurance

Resources

Risk Management

News

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Specialty

Best in Insurance

Resources

Risk Management

News

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Application forms being part of policy wording is a secondary factor, particularly for small and midsize enterprises, which often lack sophisticated cybersecurity expertise or resources, leading to unintentional errors in security-related answers on application forms. Traditional insurers sometimes use discrepancies in security disclosures as a reason to reject claims. CFC’s experience has shown that many clients in the segment simply don’t have the budgetary means to implement security measures and instead turn to cyber insurance, which now offers both security and financial protection. CFC believes that regardless of their controls, the incident should be covered under the policy. That’s their duty to the client.

“We don’t want clients penalized for this,” Nelson said. “Insurers can’t expect startups to meet the same cybersecurity standards as Fortune 500 companies, so we’ve made a conscious decision to exclude applications from forming part of the policy.” From a coverage perspective, CFC ensures its policy responds to both suspected and actual cyber events. The worst-case scenario is covering only actual events, leaving clients exposed. Including “suspected” events allows insurers to act early, offering triage support and advice via their incident response hotline. Nelson also acknowledged that the insurance industry faces reputational challenges over exclusions, which can be seen as a way to avoid paying claims. “We’ve analyzed exclusions in our policies against actual claims and removed as many as possible to reinforce that our goal is to pay valid claims, not deny them,” she said. “Cyber insurance is one of the most scrutinized products, and we are committed to educating businesses on its value. With a 99.1 percent claims acceptance rate, we want clients to trust that their policy will respond on what could be the worst day for their business.”

Of course, no insurer can accept every claim. In CFC’s case, its 0.9 percent of denied cases share common traits. “The vast majority of our declines aren’t because of security failures,” Nelson clarified. “They’re because businesses are submitting claims that aren’t cyber-related at all.” It’s a problem that comes up when companies file claims across all their policies, hoping one of them will respond. A financial loss might be mistaken for cyber fraud, while a general business interruption might be blamed on a system outage. When a claim is denied, it’s usually because it falls outside the scope of cyber coverage, not because of a hidden exclusion, Nelson explained. This highlights another issue in the market: a lack of understanding about what cyber insurance actually covers. Education is a critical part of selling cyber insurance, and something the industry needs to improve on.

The importance of cyber education

“There’s still a perception by businesses that cyber insurance is only relevant for data breach incidents,” Nelson said. In reality, modern policies are far broader, covering social engineering scams, ransomware attacks, and even losses caused by failures at third-party service providers and dependencies. This clarity is crucial as cyber threats continue to evolve. The rise of ransomware-as-a-service has made it easier than ever for criminals to launch attacks, while business email compromise remains one of the most effective forms of fraud. Companies that once thought they were too small to be targeted are finding themselves in the crosshairs of larger attacks where they weren’t the target at all.

“We’ve analyzed exclusions in our policies against actual claims and removed as many as possible to reinforce that our goal is to pay valid claims, not deny them”

Lindsey Nelson, CFC

CFC’s entire claims management approach is built to ensure swift payouts. The insurer has invested heavily in an in-house cyber security team to streamline claims. “We have over 250 security professionals, incident responders, and claims handlers working together under one roof,” Nelson said. “That allows us to act fast, contain threats, and get businesses back online before they suffer catastrophic damage.” This proactive stance also extends to threat prevention. “We don’t sit back and watch our policyholders get hit. If we see ransomware actors targeting a client, we will intervene in real time to stop it,” she added.

Proactive intervention – the key to mitigating cyber claims

For brokers, this level of engagement is a selling point. Cyber insurance can be a tough sell, especially to businesses that have never faced a major attack. The fear of claim denial is a major deterrent. By publishing their 99.1 percent acceptance rate, CFC is trying to dismantle that fear through transparency. “We’re not just saying ‘trust us’; we’re proving that our policies work in the real world,” Nelson said. CFC’s stance is that cyber insurance should be treated like any other form of commercial coverage: straightforward, reliable, and designed to pay when things go wrong. The challenge is getting more businesses to understand its value before they suffer a loss. “Our biggest challenge isn’t going head to head with rival carriers,” said Nelson. “It’s convincing businesses that cyber insurance isn’t a luxury, but a necessity.”

No warranties around security controls in policy documentation Application forms do not form part of the policy wording Policy responds to both suspected and actual cyber events Minimal exclusions in the policy In-house claims and instant response team of over 250 security professionals Product designed by brokers for clients, built on direct feedback Broad coverage that uses catch-all terminology instead of narrowly defining specific cyber events

What's contributing to CFC's 99.1% claims acceptance rate?

Comprehensive cybercrime cover 12-month indemnity period Unlimited reinstatements for first-party cover Nil deductible on initial response costs Separate limits for IR cost Full cover for data recovery and recreation

Keys to a comprehensive cyber policy

Source: cfc.com/cyber

IN Partnership with