Cyber Session: Coverage Gaps Nobody Talks About

Most coverage conversations focus on what a policy covers. This session focuses on what falls between the policies. As cyber losses increasingly cross traditional lines of coverage, gaps and overlaps can leave policyholders exposed and carriers, brokers, and counsel in disagreement over which policy responds. We will examine where cyber and crime coverages intersect and diverge, including ownership of property, third-party losses, social engineering, and client and vendor payment fraud. We will also explore broader gaps in business interruption coverage, from differing recovery and waiting period structures across carriers to the treatment of dependent business interruption, where named-vendor schedules, unnamed providers, and infrastructure exclusions for power, utility, and telecommunications failures can determine whether a vendor-driven outage is covered at all. The session will then turn to losses that do not fit neatly into any one policy. When a cyber event causes physical damage, such as a compromised refrigeration or industrial control system, cyber, property, and general liability forms can each point to the other. We will close with two emerging issues: “silent cyber” and its newer counterpart, “silent AI.” Where do these exposures sit across cyber, crime, E&O, property, and other policies, and what happens to coverage when an AI bot or agent causes the loss?