Short answer

Umbrella policy cyber coverage is usually not available, so buying a lower cyber limit and leaning on your umbrella typically won’t work. Umbrellas generally sit over general liability, auto and employers liability, and many exclude data and cyber losses. Some excess forms differ, so the schedule of underlying policies in your own umbrella controls.

Why doesn’t umbrella policy cyber coverage usually apply?

A firm looking at cyber quotes asked us: “These quotes seem really high. Could I buy $500K and lean on my $2M umbrella?” It’s a reasonable question, since an umbrella adds limits on top of other policies.

An umbrella or excess liability policy lists the underlying policies it sits over. That list is called the schedule of underlying insurance. It usually names general liability, commercial auto and employers liability. Cyber is typically not on that list, and many umbrellas exclude data and cyber losses outright.

If cyber isn’t scheduled, the umbrella generally won’t add to your cyber liability limit. Check the exclusions in your own form to be sure.

How to check your umbrella policy cyber coverage

Pull out your umbrella and look for these items:

  • The schedule of underlying policies, and whether cyber appears on it
  • Any exclusion for data, privacy or cyber losses
  • The limits of liability that apply and which policies they sit over

If anything is unclear, ask your broker to confirm in writing how the umbrella treats a cyber loss.

Why the cyber quotes looked so high

In that case, the quotes had been run at $2M by mistake. Once we re-quoted at $1M, the price came in between $868 and $2,317. The firm’s concern came from the limit, not from the coverage itself.

Check the limit on every quote before you decide a price is too high. We also suggest asking for a quote at your lower limit before dropping it. We don’t state a typical price difference between $500K and $1M here, because it depends on the carrier and your firm.

What if you need more than $1M of cyber?

A higher cyber limit comes from excess cyber, which is a different product from an umbrella. It sits over a cyber policy, not over your general liability or auto coverage. Ask your broker what options exist for your firm.

Related questions

Does an umbrella policy cover cyber liability?

Usually not. Umbrellas typically sit over general liability, auto and employers liability, and many exclude data and cyber losses. Your policy schedule controls.

Can I buy $500K of cyber and rely on my umbrella for the rest?

Typically no, because the umbrella usually doesn’t sit over a cyber policy. Review your umbrella form before changing any limit.

What is excess cyber insurance?

It is a separate policy that adds limit above a cyber policy. It is the usual route when a firm needs more than $1M of cyber coverage.