16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
Cyber liability is claims-made and splits into first-party (insured's own forensics, notification, ransomware, business interruption) and third-party (liability to customers and regulators); the CGL excludes electronic-data losses.
Watch cyber sublimits - ransomware and social-engineering/fraudulent-instruction losses often sit under separate, smaller limits than the policy aggregate.
Aviation hull is written on an agreed-value basis (no coinsurance) and is subject to pilot warranties; it covers accidental physical damage, not mechanical breakdown.
Equipment Breakdown (Boiler and Machinery) covers sudden and accidental breakdown that property forms exclude, and DIC policies fill property gaps by adding flood and earthquake.
Excess and surplus (non-admitted) markets place hard-to-place risks but carry no state guaranty-fund protection if the insurer becomes insolvent.
Cyber Liability - First-Party vs. Third-Party
Cyber liability is the fastest-growing commercial line. The CGL and standard property forms largely exclude data-breach and intangible-information losses (ISO added the CG 21 06 and CG 21 07 electronic-data exclusions and access-or-disclosure exclusions to the CGL), so a dedicated cyber policy is required. Cyber coverage splits into two halves.
| First-Party (the insured's own costs) | Third-Party (liability to others) |
|---|---|
| Breach response, forensics, customer notification | Defense and damages from privacy/breach lawsuits |
| Credit monitoring for affected customers | Regulatory fines and penalties (where insurable) |
| Business interruption from a network outage | Liability for transmitting malware to others |
| Cyber extortion / ransomware payments | Media/content injury (online libel) |
Quick Answer: First-party cyber pays the insured's own recovery costs (forensics, notification, ransomware, lost income); third-party cyber pays the insured's liability to customers, partners, and regulators.
Most cyber policies are written claims-made, mirroring professional liability. The application typically requires security controls (MFA, backups), and an insured's failure to maintain them can void coverage.
Cyber - Worked Trigger Scenario
A retailer suffers a ransomware attack. Hackers encrypt point-of-sale systems and exfiltrate 50,000 customer records.
- First-party pays: the $200,000 ransomware payment (if the policy permits and authorities allow), forensic investigation, and the business income lost while systems are down.
- First-party notification pays: the statutory cost to notify 50,000 customers and provide credit monitoring.
- Third-party pays: defense and settlement of a class-action by affected customers, plus any insurable regulatory penalty.
The coinsurance and ACV concepts from property do not apply here — cyber limits are stated per-claim and aggregate with sublimits for ransomware, social-engineering fraud, and regulatory defense. A common trap: social-engineering / fraudulent-instruction losses (an employee tricked into wiring funds) often sit under a separate sublimit, not the full policy limit.
A company's network is breached, and it incurs forensic costs, customer-notification expenses, and a ransomware demand. Which part of a cyber policy responds to these costs?
Third-party coverage, because a breach always involves outside parties
First-party coverage, because these are the insured's own recovery costs
Neither - cyber policies exclude ransomware entirely
The CGL policy, under bodily injury and property damage
Aviation Insurance
Aviation is a highly specialized line, usually placed in surplus or specialty markets. It parallels auto's physical-damage/liability split but uses its own terminology.
| Coverage | What It Insures |
|---|---|
| Hull (All-Risk) | Physical damage to the aircraft, on the ground and in flight |
| Hull - Not in Motion | Damage only while the aircraft is parked/stationary (cheapest) |
| Liability - Bodily Injury (excluding passengers) | BI to people outside the aircraft |
| Passenger Liability | BI to passengers aboard the aircraft |
| Liability - Property Damage | Damage to property of others on the ground |
| Admitted (combined single limit) | One limit covering BI and PD together |
Aircraft hull is typically written on an agreed-value basis (no coinsurance, no depreciation argument at total loss) because each aircraft is unique. A key underwriting factor is pilot warranties — coverage can be voided if the aircraft is operated by a pilot not meeting the rating and hours stated in the policy. Component parts and breakdown are excluded; hull covers accidental physical damage, not mechanical failure.
Other Specialty Lines
Boiler and Machinery (Equipment Breakdown)
Written on the ISO/specialty Equipment Breakdown form, it covers sudden and accidental breakdown of pressure vessels, boilers, electrical systems, and mechanical equipment — exactly the mechanical-failure loss that property and inland-marine forms exclude. It includes inspection services as a core value, since loss prevention reduces catastrophic boiler explosions.
Difference in Conditions (DIC)
A DIC policy fills gaps in a property program, typically adding flood and earthquake coverage that the underlying property policy excludes. It "differs in conditions" by covering perils the primary form leaves out.
Other specialty placements
- Kidnap & Ransom (K&R) — reimburses ransom, crisis-response, and negotiation costs.
- Event cancellation — pays lost revenue/expenses when a covered event is cancelled.
- Pollution / Environmental (CPL) — covers cleanup and third-party pollution liability the CGL excludes.
- Excess & Surplus (E&S) — non-admitted markets for hard-to-place risks; rates and forms are not state-rate-regulated, and there is no state guaranty-fund protection if the insurer fails.
Specialty-Line Traps to Memorize
| Trap | The Correct Rule |
|---|---|
| "Cyber is just an endorsement to the CGL" | The CGL excludes electronic data and access/disclosure; cyber is a separate claims-made policy |
| "Aircraft hull pays for engine wear/breakdown" | Hull covers accidental physical damage, not mechanical breakdown — that is equipment-breakdown territory |
| "Boiler explosion is a property loss" | Property forms exclude mechanical breakdown; the Equipment Breakdown form responds |
| "DIC adds liability limits" | DIC adds property perils (flood/quake), not liability |
| "E&S risks have guaranty-fund backing" | Non-admitted/surplus-lines insurers are not covered by state guaranty funds |
Exam Key: Specialty lines exist precisely to cover what mainstream forms exclude. When a question describes a loss the CGL or standard property policy would deny (data breach, boiler explosion, flood/quake gap, ransom), the answer is almost always the matching specialty form.
Two administrative points often appear on the national portion. First, surplus-lines placements require the producer to confirm the risk was first declined or unavailable in the admitted market (a "diligent search"), and surplus-lines tax is owed. Second, specialty forms are frequently manuscript policies — negotiated, non-standard wording — so the agent cannot assume ISO defaults apply. Always read the form: a cyber, aviation, or pollution policy from one carrier may insure or exclude very different exposures than a competitor's.
A manufacturer's high-pressure boiler suddenly ruptures from internal pressure, destroying the unit and damaging the surrounding plant. The commercial property policy denies the claim. Which specialty form is designed to respond?
Difference in Conditions (DIC)
Aviation hull coverage
Equipment Breakdown (Boiler and Machinery)
Kidnap and Ransom
Sections you finish are checked off in the contents.