Cyber

Cyber insurance terms

TERMS

Data Breach

A data breach occurs when personal information held by an organisation is subject to unauthorised access, unauthorised disclosure, or loss, and may expose individuals to risks such as identity theft, financial loss, or reputational damage.

Notifiable Data Breaches (NDB) scheme

The NDB scheme is a legal obligation under the Australian Privacy Act which requires certain organisations to notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm.

Eligible Data Breach

An Eligible Data Breach is the term used under the Privacy Act to describe a data breach involving personal information that is likely to result in serious harm and has not been mitigated, triggering mandatory notification obligations under the NDB scheme.

Cryptojacking

The covert, unauthorised use of computing resources to mine cryptocurrency.

Cyber Extortion

Threats to disrupt, expose, or withhold digital assets unless a ransom or demand is met.

Mandatory Ransomware Payment Reporting laws

Australia's world-first mandatory ransomware payment reporting laws, enacted under the Cyber Security Act 2024, requires businesses with an annual turnover exceeding AUD$3 million and critical infrastructure operators to report ransomware payments within 72 hours.

Incident Response

Incident response refers to a structured process for detecting, containing, investigating, and recovering from cybersecurity incidents.

Direct Financial Loss

The actual monetary loss directly caused by a covered cyber event.

Approved Provider / Panel Vendor

A vendor pre-authorised or endorsed by the insurer to perform response services.

Host System

The primary system or server that supports applications, data storage, or operations.

Hacker

An individual or group who gains unauthorised access to systems or data.

Known Threat Actor

A known threat actor is an identified cyber criminal or hacking group with a documented history of attacks and known methods.

Outsourced Service

Third-party services performing critical business functions including cloud providers, managed service providers (MSPs), payment processors, or software-as-a-service (SaaS) platforms.

Qualified Incident Response Firm

Specialist firm pre-approved by insurers to manage incidents, including cybersecurity experts, lawyers, and loss adjusters.

Ransomware

Ransomware is malicious software that encrypts organisational data or systems, demanding payment (typically in cryptocurrency) for restoration.

Recovery Time Objective (RTO)

The targeted time within which critical systems or operations must be restored after a disruption.

Security Breach

An incident compromising the confidentiality, integrity, or availability of systems or data.

Third-Party Liability

Legal obligations to compensate external parties for damages resulting from a cyber incident affecting their data, systems or operations.

Service Interruption

A temporary unavailability or degradation of a service due to a cyber event, causing operational disruption.

Third-Party Dependency

Operational reliance on external parties whose failure could impact the insured’s operations.

Unauthorised Access

Access to systems or data without permission.

Unauthorised Modification

Alteration, deletion, or corruption of data or systems without proper authority, including malware installation, configuration changes, or data tampering.

Vulnerability

A weakness in systems, applications, processes, or configurations that could be exploited to compromise security.

Zero-Day Exploit

A cyberattack leveraging previously unknown vulnerabilities with no available patches, giving defenders zero days to prepare.

Zero Trust

A security architecture assuming no implicit trust, requiring continuous verification of every transaction regardless of source.

Account Takeover

The compromise and unathorised use of legitimate user credentials to access systems or conduct fraudulent activities.

Access Control Failure

The breakdown (or misconfiguration) of mechanisms designed to regulate user permissions, allowing unauthorised system or data access.

Bodily Injury

Physical harm to individuals resulting from cyber incidents, such as medical device failures, infrastructure disruption, or industrial control system attacks.

Business Continuity Plan

A documented framework outlining a response plan, ensuring critical business functions continue during and after cyber incidents.

Malware

Malicious software designed to infiltrate, damage, or provide unauthorised access to computer systems.

Application Outage

The downtime or unavailability of a specific software application due to a cyber incident.

Cyber Event

Any incident involving digital systems that threatens confidentiality, integrity, or availability.

Business Email Compromise (BEC)

Business Email Compromise (BEC) is a scam where attackers impersonate executives, vendors, or trusted partners via email to trick employees into transferring funds or disclosing sensitive data.

Botnetting

Botnetting is the process of compromising and controlling a network of devices (a "botnet") to perform coordinated malicious actions.

Breach Coach

A breach coach is an independent legal expert engaged immediately after a cyber incident to guide the insured through response, privilege, and notification decisions.

Credential Stuffing

Credential Stuffing is an automated attack where adversaries use stolen username and password pairs to gain unauthorised access to accounts.

Cyber Extortion Demand

A specific demand made by attackers to pay to prevent data release, system shutdown, or corruption.

Cyber Theft

Cyber Theft is the unauthorised acquisition of data, funds, or digital assets through cyber means.

Cyber War / Acts of War Exclusion

This is a policy exclusion that removes coverage for cyber incidents attributable to war, including state-sponsored hostilities or declared cyber warfare.

Data Integrity Loss

The corruption, alteration, or unintended modification of data.

Data Retention Failure

The inability to preserve data according to legal, operational, or contractual requirements.

Data Retention Period

The Data Retention Period is the length of time data (including logs or communications) is required or chosen to be stored.

Data Subject Access Request (DSAR)

A DSAR is a request by an individual to obtain the personal information an organisation holds about them.

Denial of Service (DoS)

An attack that overwhelms systems or networks, rendering services unavailable.

Data Theft

Data Theft is the unauthorised extraction or exfiltration of data from systems, typically for malicious purposes such as financial gain, competitive advantage, or further criminal activity.

Dependent Service Interruption

Disruption experienced by the insured due to failure at a service provider or third-party dependency.

Digital Forensics

The technical investigation of cyber incidents to determine cause, scope, and impact.

Electronic Data

Information stored or transmitted in digital form.

Disaster Recovery

The set of procedures and capabilities to restore systems and operations after a major cyber disruption.

Encryption Failure

Encryption Failure occurs when data encryption systems fail to adequately protect information, whether due to misconfiguration, compromised encryption keys, weak encryption methods, or system malfunctions.

Email Compromise

The takeover or spoofing of email accounts to conduct fraud or illicit activity.

Ethical Hacking

Authorized testing of systems to identify vulnerabilities before they are exploited.

Governance Failure

Governance Failure refers to a breakdown or inadequacy in the systems, processes, policies, or oversight mechanisms that an organisation uses to direct and control its operations.

Incident Response Plan

An Incident Response Plan is a predefined strategy for detecting, containing, communicating, and recovering from cyber incidents.

External Threat

A risk originating outside the organisation, such as hackers, ransomware gangs, or nation-state actors.

Identity Theft

The wrongful use of someone’s personal information to impersonate them for gain.

Infrastructure Failure

Infrastructure Failure is the breakdown of foundational IT systems (networks, servers, storage) that affects system availability or business operations.

Malware Propagation

Malware Propagation is the spread of malicious software (such as viruses, worms, or ransomware) across systems or networks.

Multi-Factor Authentication (MFA)

Multi-factor authentication is a security control requiring users to present two or more verification factors to gain access to systems.

Operational Disruption

Operational Disruption is any interruption to normal business processes caused by cyber events or their consequences.

Notification Failure

Notification Failure occurs when an insured fails to notify their insurer of a claim, incident, or circumstance within the timeframes specified in the policy.

Mean Time to Recovery (MTTR)

The average time taken to restore systems after a disruption.

Privacy Impact Assessment (PIA)

A PIA is a process to evaluate how a project or system affects personal information privacy.

Security Awareness Training

Security Awareness Training is education provided to employees on cyber risks, threats, and proper security behaviors to reduce human-related security incidents.

Security Event

A Security Event is any observable occurrence in a system that may indicate a cyber threat or potential breach.

Resilience Measures

Controls and plans implemented to anticipate, absorb, recover, and adapt to cyber incidents.

Service Degradation

Reduction in system performance or quality without complete outage.

Phishing

Phishing refers to deceptive attempts, typically via email or messages, to trick individuals into revealing credentials, sensitive information, or performing actions that compromise security.

Silent Cyber

Silent Cyber refers to cyber risks that are not clearly addressed—neither expressly covered nor excluded—in traditional insurance policies.

Social Engineering

Social engineering is a method by which attackers manipulate people into divulging confidential information or performing actions that compromise security.

Supply Chain Attack

Supply Chain Attack refers to cyber attacks targeting third-party vendors or service providers to compromise their clients' systems.

Transaction Fraud

Fraudulent activity that manipulates transactions, often via social engineering or account takeover.

System Failure

The malfunction or breakdown of IT systems affecting availability or function.

Trigger Event

A Trigger Event is the specific cyber incident or condition that activates coverage under a cyber insurance policy.