Short answer
Does umbrella cover cyber? Generally no. An umbrella adds limits over the specific policies listed on its schedule, usually general liability, auto and employers liability. If you don’t carry a cyber policy, an umbrella does not give you one. Some umbrellas are written differently, so check the schedule of underlying policies on yours.
What an umbrella actually does
An umbrella liability policy adds limits on top of specific underlying policies. It does not create new coverage on its own. It generally extends coverage that already exists below it.
The schedule of underlying policies shows exactly which ones the umbrella sits over. Read that page first, since it answers most questions about what the umbrella reaches.
Does umbrella cover cyber losses?
Cyber coverage protects against your own losses, such as ransomware, data restoration and business interruption. It can also respond to your liability to others after a data breach.
Those losses are not general liability or auto losses. An umbrella that sits over general liability and auto generally does not reach them. A cyber policy responds to the loss with its own terms and limits.
Many owners assume they have cyber because they carry an umbrella. One person put it this way: “I thought I had cyber, so I thought the umbrella would be that coverage over the cyber.” That is an easy assumption to make, and it is worth checking your policies before you rely on it.
A simple example
A design firm carries general liability, auto and an umbrella over both. An employee receives a fake email and wires funds to a fraudulent account. The firm assumes the umbrella will help. Because the umbrella sits over general liability and auto, and the firm has no cyber policy, the loss may not be covered. A standalone cyber policy with social engineering coverage is built for this kind of event.
Terrorism coverage is a separate line
Some clients confuse the TRIA terrorism line on their general liability policy with cyber or umbrella coverage. It is neither.
The terrorism line is a separate item tied to certified acts of terrorism. It does not provide cyber protection, and it does not turn an umbrella into a cyber policy. If you see it on your quote and wonder whether it is normal, it often appears on commercial policies. Ask your insurance agent to explain how it applies to yours.
What design firms should have instead
Most design firms looking at cyber risk want a standalone policy. Many also look for social engineering and wire fraud coverage, since fraudulent payment requests are a common concern. Social engineering coverage can come with sublimits and conditions, so read how it is written.
Our cyber liability page explains what these policies typically cover. If you already have quotes in hand, our guide to comparing cyber quotes shows what to look at side by side.
Some cyber policies pay covered costs on your behalf rather than reimbursing you later. The pay on behalf wording matters, so check how yours handles payment. Coverage always depends on the actual policy terms, exclusions and underwriting.
What we see at Hardcover
A client thought they had cyber coverage and that their umbrella sat over it. They had neither. It was an honest mistake, and we quoted a standalone cyber policy.
What to check
- Which policies does your umbrella’s schedule of underlying policies list?
- Do you carry a separate cyber policy?
- Does that cyber policy include social engineering or wire fraud coverage?
- Does a contract require cyber coverage from your firm?
- What does the terrorism line on your policy actually refer to?
Related questions
Does an umbrella policy cover cyber attacks?
Generally no. Umbrellas sit over the specific policies listed, usually general liability, auto and employers liability. Check your schedule of underlying policies.
Is TRIA terrorism coverage the same as cyber?
No. It is a separate line item for certified acts of terrorism.
Is it true that an umbrella does not cover cybersecurity?
Generally, yes. Cyber needs its own policy unless your umbrella specifically says otherwise, so confirm with your carrier or insurance agent.
What is the terrorism line on my policy?
It is a separate charge or notice related to certified acts of terrorism. It is not a cyber or umbrella feature.