What is the difference between first-party and third-party cyber coverage?
First-party cyber coverage pays for the losses you suffer yourself, including rebuilding systems, income lost while you are down, and the cost of responding to a breach. Third-party cyber coverage pays what you become legally responsible for to somebody else, such as a customer whose records you held or a regulator that fines you.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
The detail
First-party coverage responds to the policyholder's own loss, while third-party coverage responds to the policyholder's legal liability to other people.
Business interruption, data restoration, cyber extortion and breach response costs sit on the first-party side of a cyber policy.
Privacy liability, network security liability, media liability and regulatory defense costs sit on the third-party side.
Individual cyber coverages frequently carry their own sublimits and their own retentions, so the headline policy limit is not the amount available for every kind of loss.
What this means for you
- The half you need depends on what you hold, not on what you do. A business holding twenty thousand customer records has a third-party problem whatever industry it sits in, because the exposure is the duty owed to those people. A business that would stop trading after four days offline has a first-party problem even if it holds no personal data at all.
- Cheap policies tend to be thin on the first-party side. Liability limits look generous because liability claims are slower and rarer. The coverages that pay out fastest and most often, meaning extortion, restoration and lost income, are where the sublimits hide.
- A contract almost always asks for the third-party half. When a client requires cyber liability at a stated limit, they are protecting themselves against your failure, so they are describing your third-party coverage. Meeting that requirement says nothing about whether you could fund your own recovery.
- Read the retentions separately from the limit. A policy can carry a large limit above a waiting period long enough that a typical outage never reaches it, which is a first-party gap that no amount of limit fixes.
Go deeper on any of these
Related questions
- Is cyber liability insurance first-party or third-party?
Both, in almost every modern policy. The phrase "cyber liability" points at the third-party half, and it is used loosely as the name of the whole product, which is where the confusion starts. A policy sold under that name normally includes first-party coverages as well, and the only way to know what yours includes is to read the schedule rather than the title.
- Which half pays for ransomware?
First-party. A ransom demand, the negotiation around it, the forensic work and the cost of rebuilding what was encrypted are all your own losses, so they respond under first-party coverages such as cyber extortion and data restoration. If the same incident exposed customer records, the claims from those customers respond under the third-party half, which is why one attack often opens two very different parts of the policy.
- What the crime and extortion coverages actually pay for
- Does third-party cyber coverage include regulatory fines?
Often, though not everywhere and not always in full. Regulatory defense costs, meaning the expense of responding to an investigation, are commonly covered. The fines themselves are covered only where the law of the relevant state permits a fine to be insured, so the answer changes with where you operate and what the penalty is for.
- How privacy and regulatory coverage is written
- My general liability policy mentions personal and advertising injury. Is that third-party cyber coverage?
No, and it is a common misreading. That wording responds to a narrow set of offenses such as libel and slander, and modern general liability policies carry explicit electronic data exclusions that remove anything resembling a breach. The overlap is in the vocabulary rather than in what would pay.
- We are a technology company. Does tech E&O cover the third-party half already?
Not on its own. Technology errors and omissions answers for your work failing a client, while third-party cyber answers for personal information being exposed, and a single incident can trigger either or both. The two are frequently written together on one policy, which is why the boundary is worth understanding before a claim asks you where it sits.
- Tech E&O against cyber, side by side
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Written by the licensed brokers at Boring Insurance. Last updated 2026-09-09. See all guides.