16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber liability is claims-made and splits into first-party (insured's own forensics, notification, ransomware, business interruption) and third-party (liability to customers and regulators); the CGL excludes electronic-data losses.
- Watch cyber sublimits - ransomware and social-engineering/fraudulent-instruction losses often sit under separate, smaller limits than the policy aggregate.
- Aviation hull is written on an agreed-value basis (no coinsurance) and is subject to pilot warranties; it covers accidental physical damage, not mechanical breakdown.
- Equipment Breakdown (Boiler and Machinery) covers sudden and accidental breakdown that property forms exclude, and DIC policies fill property gaps by adding flood and earthquake.
- Excess and surplus (non-admitted) markets place hard-to-place risks but carry no state guaranty-fund protection if the insurer becomes insolvent.
Cyber Liability - First-Party vs. Third-Party
Cyber liability is the fastest-growing commercial line. The CGL and standard property forms largely exclude data-breach and intangible-information losses (ISO added the CG 21 06 and CG 21 07 electronic-data exclusions and access-or-disclosure exclusions to the CGL), so a dedicated cyber policy is required. Cyber coverage splits into two halves.
| First-Party (the insured's own costs) | Third-Party (liability to others) |
|---|---|
| Breach response, forensics, customer notification | Defense and damages from privacy/breach lawsuits |
| Credit monitoring for affected customers | Regulatory fines and penalties (where insurable) |
| Business interruption from a network outage | Liability for transmitting malware to others |
| Cyber extortion / ransomware payments | Media/content injury (online libel) |
Quick Answer: First-party cyber pays the insured's own recovery costs (forensics, notification, ransomware, lost income); third-party cyber pays the insured's liability to customers, partners, and regulators.
Most cyber policies are written claims-made, mirroring professional liability. The application typically requires security controls (MFA, backups), and an insured's failure to maintain them can void coverage.
Cyber - Worked Trigger Scenario
A retailer suffers a ransomware attack. Hackers encrypt point-of-sale systems and exfiltrate 50,000 customer records.
- First-party pays: the $200,000 ransomware payment (if the policy permits and authorities allow), forensic investigation, and the business income lost while systems are down.
- First-party notification pays: the statutory cost to notify 50,000 customers and provide credit monitoring.
- Third-party pays: defense and settlement of a class-action by affected customers, plus any insurable regulatory penalty.
The coinsurance and ACV concepts from property do not apply here — cyber limits are stated per-claim and aggregate with sublimits for ransomware, social-engineering fraud, and regulatory defense. A common trap: social-engineering / fraudulent-instruction losses (an employee tricked into wiring funds) often sit under a separate sublimit, not the full policy limit.
A company's network is breached, and it incurs forensic costs, customer-notification expenses, and a ransomware demand. Which part of a cyber policy responds to these costs?
Aviation Insurance
Aviation is a highly specialized line, usually placed in surplus or specialty markets. It parallels auto's physical-damage/liability split but uses its own terminology.
| Coverage | What It Insures |
|---|---|
| Hull (All-Risk) | Physical damage to the aircraft, on the ground and in flight |
| Hull - Not in Motion | Damage only while the aircraft is parked/stationary (cheapest) |
| Liability - Bodily Injury (excluding passengers) | BI to people outside the aircraft |
| Passenger Liability | BI to passengers aboard the aircraft |
| Liability - Property Damage | Damage to property of others on the ground |
| Admitted (combined single limit) | One limit covering BI and PD together |
Aircraft hull is typically written on an agreed-value basis (no coinsurance, no depreciation argument at total loss) because each aircraft is unique. A key underwriting factor is pilot warranties — coverage can be voided if the aircraft is operated by a pilot not meeting the rating and hours stated in the policy. Component parts and breakdown are excluded; hull covers accidental physical damage, not mechanical failure.
Other Specialty Lines
Boiler and Machinery (Equipment Breakdown)
Written on the ISO/specialty Equipment Breakdown form, it covers sudden and accidental breakdown of pressure vessels, boilers, electrical systems, and mechanical equipment — exactly the mechanical-failure loss that property and inland-marine forms exclude. It includes inspection services as a core value, since loss prevention reduces catastrophic boiler explosions.
Difference in Conditions (DIC)
A DIC policy fills gaps in a property program, typically adding flood and earthquake coverage that the underlying property policy excludes. It "differs in conditions" by covering perils the primary form leaves out.
Other specialty placements
- Kidnap & Ransom (K&R) — reimburses ransom, crisis-response, and negotiation costs.
- Event cancellation — pays lost revenue/expenses when a covered event is cancelled.
- Pollution / Environmental (CPL) — covers cleanup and third-party pollution liability the CGL excludes.
- Excess & Surplus (E&S) — non-admitted markets for hard-to-place risks; rates and forms are not state-rate-regulated, and there is no state guaranty-fund protection if the insurer fails.
Specialty-Line Traps to Memorize
| Trap | The Correct Rule |
|---|---|
| "Cyber is just an endorsement to the CGL" | The CGL excludes electronic data and access/disclosure; cyber is a separate claims-made policy |
| "Aircraft hull pays for engine wear/breakdown" | Hull covers accidental physical damage, not mechanical breakdown — that is equipment-breakdown territory |
| "Boiler explosion is a property loss" | Property forms exclude mechanical breakdown; the Equipment Breakdown form responds |
| "DIC adds liability limits" | DIC adds property perils (flood/quake), not liability |
| "E&S risks have guaranty-fund backing" | Non-admitted/surplus-lines insurers are not covered by state guaranty funds |
Exam Key: Specialty lines exist precisely to cover what mainstream forms exclude. When a question describes a loss the CGL or standard property policy would deny (data breach, boiler explosion, flood/quake gap, ransom), the answer is almost always the matching specialty form.
Two administrative points often appear on the national portion. First, surplus-lines placements require the producer to confirm the risk was first declined or unavailable in the admitted market (a "diligent search"), and surplus-lines tax is owed. Second, specialty forms are frequently manuscript policies — negotiated, non-standard wording — so the agent cannot assume ISO defaults apply. Always read the form: a cyber, aviation, or pollution policy from one carrier may insure or exclude very different exposures than a competitor's.
A manufacturer's high-pressure boiler suddenly ruptures from internal pressure, destroying the unit and damaging the surrounding plant. The commercial property policy denies the claim. Which specialty form is designed to respond?