How claims-made cyber insurance policies work

The information on this website is general in nature and does not take into account your objectives, financial situation, or needs. Consider seeking personal advice from a licensed adviser before acting on any information.

Cyber insurance policy wording can be difficult to interpret, especially when it describes cover as "claims-made" or refers to notification requirements, retroactive dates and known circumstances. These terms matter because a cyber incident may begin, be discovered and be reported at different times.

For Australian business owners reviewing cyber insurance, understanding how claims-made cover works can help you ask better questions before you buy, renew or change a policy. This article explains the general concepts, but it is not a substitute for reading your own policy wording or seeking professional advice about your circumstances.

What does claims-made mean in cyber insurance?

A claims-made insurance policy generally responds to claims first made against the insured during the policy period, provided the claim falls within the policy terms and is notified in accordance with the policy requirements. In cyber insurance, the wording may also refer to notifying incidents, facts or circumstances that could later give rise to a claim.

This is different from an occurrence-based policy, where the focus is usually on when the event occurred. In a claims-made cyber insurance policy, timing often turns on when the claim is made, when the insured first becomes aware of relevant facts or circumstances, and when the insurer is notified.

For example, a business might experience unauthorised system access in March, discover suspicious activity in April, receive a customer complaint in May and notify its insurer in June. A claims-made policy will not simply ask, "When did the hacker first get in?" It will look at the policy period, the wording, the date the business became aware of the issue, any notification obligations, any retroactive date and any exclusions.

Why cyber insurance is commonly claims-made

Cyber incidents can be complex and may unfold over time. A data breach, ransomware event, business email compromise or privacy complaint may not be fully understood when the first warning sign appears. The financial, legal and operational consequences may emerge gradually.

Claims-made wording is often used for liability-style risks where a claim or allegation may be made after the underlying conduct or event. Cyber insurance can include both first-party cover, such as incident response and recovery costs, and third-party liability cover, such as claims by customers, suppliers or regulators. Policy structure varies between insurers, so it is important to check how your wording treats each type of cover.

The key timing points in a claims-made cyber insurance policy

When reading cyber insurance policy wording, focus on the dates and notification requirements. The following concepts are especially important.

Policy period

The policy period is the start and end date of the cover. Under a claims-made policy, a claim will usually need to be first made against the insured during that period. Some policies also require notification to the insurer during the same period or within a specified time after the period ends.

If a policy expires and is not renewed, there may be no ongoing right to notify new claims unless the wording includes an extended reporting period or separate run-off cover has been arranged.

Notification date

The notification date is when you tell the insurer about a claim, cyber incident, fact or circumstance. Policy wording often requires notice as soon as practicable, immediately, within a specified timeframe, or before the policy expires. The exact requirement depends on the policy.

Notification timing matters because late notification can create disputes about whether the policy should respond. It may also affect access to the insurer's approved incident response vendors, breach coaches, forensic specialists or legal support where those services are included in the policy.

Retroactive date

A retroactive date is a date before which certain acts, errors, omissions or events may not be covered. If your policy has a retroactive date, the insurer may not cover claims arising from matters that occurred before that date, even if the claim is made during the current policy period.

Some cyber insurance policies may have a retroactive date that matches the first date continuous cover began. Others may use a different date or may have no retroactive date for certain sections. Do not assume all policies treat retroactive cover the same way.

Known circumstances

A known circumstance is generally a fact, event, issue or situation that you knew about, or ought reasonably to have known about, before cover began and that could give rise to a claim or loss. Policies often exclude claims arising from known circumstances that were not disclosed before the policy started.

In cyber insurance, examples might include unexplained system intrusions, unresolved malware alerts, an existing privacy complaint, a suspected compromise of email accounts, or evidence that customer information may have been accessed without authorisation. Whether something is a known circumstance depends on the policy wording and the facts.

How notification works: claims, incidents and circumstances

Cyber insurance notification is not always limited to a formal legal claim. Depending on the policy, you may need to notify different types of events.

The distinction matters. A business may not have received a formal claim yet, but it may already know about a circumstance that could lead to one. For instance, if a business discovers that a customer database may have been accessed, it may not yet know whether customers will complain or whether legal costs will arise. The policy may still require prompt notice of the incident or circumstance.

Why notification timing can affect cover

Notification timing can affect cyber insurance in several ways.

• Policy rights may depend on timely notice. If the wording requires notification during the policy period, waiting until after expiry may create a coverage issue.
• Insurers may need to approve response costs. Some policies require insurer consent before engaging forensic, legal, public relations or remediation providers, except in urgent circumstances specified by the policy.
• Evidence can disappear quickly. Logs, emails and system data may be overwritten or lost, which can make investigation and claim assessment harder.
• Regulatory and contractual obligations may have their own timelines. A cyber incident may trigger privacy, customer, supplier or contractual notification considerations. Insurance notice does not replace those obligations.
• A later claim may relate back to an earlier notice. Some policies allow a later claim to be treated as made when a properly notified circumstance was first reported. This depends on the wording.

If you are dealing with an active incident, it can be useful to review the practical steps in Cyber Insurance Claims: What Small Business Owners Need to Know, while also checking the exact notice provisions in your policy.

Retroactive dates and continuity of cover

Retroactive dates are closely connected to continuity of cover. If your business has held cyber insurance continuously with no gaps, the retroactive date may preserve cover for earlier unknown events, subject to the policy terms. If there is a gap between policies, a change of insurer or a change in wording, the position may be different.

When renewing or switching cyber insurance, ask how the proposed policy treats prior acts, prior incidents and known circumstances. A cheaper premium is not necessarily helpful if the new policy narrows the period of cover or introduces a retroactive date that creates uncertainty for your business.

Continuity can be especially important because cyber incidents are sometimes discovered months after initial compromise. If a business changes cover without understanding retroactive dates and prior circumstances exclusions, it may be harder to work out which policy, if any, should respond.

Known circumstances and cyber insurance applications

Known circumstances can arise during application, renewal and claim stages. When you apply for cyber insurance, the insurer may ask about previous incidents, current vulnerabilities, suspected breaches, unresolved complaints and your security controls. These questions are designed to help the insurer assess risk and decide whether to offer cover, on what terms and at what premium.

It is important to answer application and renewal questions carefully and honestly. If your business is aware of a possible cyber issue before the policy starts, failing to disclose it may affect cover later. This does not mean every minor IT issue will automatically be a known circumstance, but it does mean businesses should take suspicious activity seriously and keep records of what was known and when.

Common examples of matters worth discussing before placement or renewal may include:

• recent ransomware, malware or phishing incidents;
• unauthorised access to email, cloud accounts or internal systems;
• customer, supplier or employee complaints about data handling;
• unexplained data loss or system outages;
• security alerts that have not yet been investigated;
• previous insurance claims or declined claims relating to cyber events.

If you are unsure how to interpret policy wording or application questions, consider speaking with an appropriately licensed insurance professional. The brokers page may be a useful starting point for businesses that want help comparing wording or explaining circumstances to an insurer.

What business owners should check in policy wording

Before buying, renewing or changing a cyber insurance policy, read the timing provisions carefully. These questions can help guide your review:

• Is the policy claims-made? Check whether all sections are claims-made or whether different sections operate differently.
• What must be notified? Look for definitions of claim, loss, incident, cyber event, circumstance and notification.
• When must notice be given? Identify whether notice is required immediately, as soon as practicable, within a set number of days, before expiry or within any extended reporting period.
• Who must receive notice? Policies may specify an insurer, claims administrator, emergency response hotline, broker or nominated email address.
• Is there a retroactive date? Check whether it applies to all cover sections or only some.
• How are prior or known circumstances treated? Review exclusions for prior acts, prior claims, known incidents and non-disclosure.
• Are response costs pre-approved? Check whether you need insurer consent before engaging specialists or incurring costs.
• What happens if the policy is cancelled, not renewed or replaced? Look for extended reporting period, run-off or continuity provisions.

Keep a copy of each policy schedule, wording, endorsement and renewal document. If a claim arises later, these documents may be needed to identify which policy period applies.

Practical record-keeping for notification

Good records can reduce confusion if a cyber incident later becomes an insurance claim. Your business should consider keeping a clear incident log that records:

• when the issue was first detected;
• who detected it and who was informed internally;
• what systems, data or accounts appeared to be affected;
• what immediate containment steps were taken;
• when external IT, legal or forensic support was contacted;
• when the insurer or broker was notified;
• what instructions or approvals were received from the insurer.

This record does not need to be complicated, but it should be factual. Avoid guessing about the cause or scale of an incident before it has been investigated. Clear, time-stamped notes can help your business, your advisers and the insurer understand the sequence of events.

Common mistakes with claims-made cyber insurance

Many timing problems are avoidable. Common mistakes include:

• Waiting for certainty before notifying. Some businesses delay notice because they are not sure whether an incident will become serious. Policy wording may require notice before the full impact is known.
• Assuming IT remediation is separate from insurance. Technical decisions can affect evidence, recovery costs and insurer approval requirements.
• Changing insurers without checking retroactive dates. A new policy may not automatically preserve the same prior acts protection.
• Treating renewal as routine. New incidents, changed systems, acquisitions, remote work arrangements or increased data holdings may affect disclosure and underwriting.
• Not involving the right internal people. Cyber notification may require input from owners, directors, IT staff, legal advisers, privacy officers and finance teams.

What to do if you discover a possible cyber incident near renewal

A suspected cyber incident close to renewal can be sensitive. Do not ignore it or assume the next policy will automatically cover it. Consider taking these steps:

1. Review the current policy's notification requirements immediately.
2. Preserve relevant logs, emails, alerts and system records.
3. Contact your broker or insurer using the notice method specified in the policy.
4. Disclose relevant facts accurately during renewal or when seeking alternative quotes.
5. Ask how any notified circumstance will be treated if a formal claim arises later.
6. Keep written records of notifications, acknowledgements and insurer instructions.

The right approach depends on the wording, the facts and your business's obligations. Early advice can help avoid accidental gaps in cover.

The main takeaway

Claims-made cyber insurance is highly dependent on timing. The policy period, notification date, retroactive date and known circumstances wording can all affect whether a cyber incident is covered. For Australian businesses, the safest practical habit is to treat suspicious cyber events as potential insurance matters early, check the policy wording and notify through the required channel within the required timeframe.

Cyber insurance can be an important part of managing cyber risk, but policy outcomes depend on the individual business, the facts of the incident, the policy wording and the insurer's assessment. Understanding claims-made mechanics before an incident occurs can make it easier to respond quickly and protect your position if something goes wrong.

Published: Tuesday, 18th Aug 2026
Author: Paige Estritori