16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber policies split into first-party coverage (the insured's own breach costs: forensics, notification, business interruption, ransomware) and third-party liability (suits by affected customers); they are written claims-made with sublimits
- Aviation insurance is a non-filed specialty line covering hull (the aircraft) and liability; the in-flight/not-in-motion/taxiing distinction governs which hull coverage applies
- Umbrella and excess liability sit above primary CGL, auto, and employers liability; a true umbrella can drop down to cover gaps via self-insured retention, while excess simply follows form
- Difference-in-Conditions (DIC) policies fill gaps left by standard property forms, commonly adding flood and earthquake that the underlying policy excludes
- Specialty exam traps: cyber is claims-made not occurrence, umbrella drop-down requires an SIR, and aviation moving-aircraft losses turn on the in-motion definition
Cyber Insurance: First-Party vs. Third-Party
Cyber liability addresses losses from data breaches, ransomware, and network failures that standard property and CGL forms exclude or barely touch. Cyber policies are almost always written on a claims-made basis with a retroactive date and numerous sublimits, not occurrence forms.
Quick Answer: First-party cyber pays the insured's own costs; third-party cyber pays for suits brought against the insured by others.
| Coverage Side | What It Pays | Examples |
|---|---|---|
| First-party | The insured's own losses | Forensic investigation, customer notification, credit monitoring, business interruption, ransomware/extortion payments, data restoration |
| Third-party | Liability to others | Defense and damages from customer/vendor suits, regulatory fines/penalties, PCI assessments, media/content liability |
Because cyber is claims-made, the claim must be made during the policy period (or extended reporting period) and the wrongful act must occur after the retroactive date. A common trap is treating a cyber policy like an occurrence CGL — under a claims-made form, a breach reported after the policy lapses with no tail is not covered.
Aviation Insurance
Aviation is a non-filed specialty line (insurers craft their own forms and rates). It parallels auto in structure: hull coverage (physical damage to the aircraft) and liability coverage (bodily injury and property damage to others, including passengers).
The In-Motion Distinction
Hull coverage is priced and triggered around how the aircraft was operating:
- In-flight — from the start of the takeoff roll to the end of the landing roll. Highest exposure.
- In-motion (taxiing) — moving under its own power but not in flight.
- Not-in-motion — parked or moored.
A broad "all-risk ground and flight" hull form covers all three; a cheaper "not-in-motion" form covers the parked aircraft only. The exam tests which hull form responds based on whether the plane was flying, taxiing, or parked.
Liability Splits
Aviation liability is often written with a per-passenger limit and a separate limit for non-passenger bodily injury and property damage. Admitted seat liability caps the payout per occupied seat — a classic split-limit structure.
Worked Example: Split-Limit Aviation Liability
A charter operator carries aviation liability of $1,000,000 each person / $5,000,000 each occurrence for passengers. A crash injures four passengers with damages of $400,000, $900,000, $1,200,000, and $1,500,000. Apply the per-person cap of $1,000,000 to each: $400,000 + $900,000 + $1,000,000 + $1,000,000 = $3,300,000. That total is below the $5,000,000 per-occurrence cap, so the insurer pays $3,300,000. Two passengers' damages exceeding $1,000,000 each are reduced to the per-person limit.
A cyber policy is written claims-made with a retroactive date of January 1, 2025. A hacker breaches the insured on March 1, 2026, but the resulting customer lawsuit is not filed until February 1, 2027, after the policy has lapsed with no extended reporting period purchased. How does the policy respond?
Umbrella and Excess Liability
Umbrella and excess liability policies provide high limits above primary policies, but they are not identical.
| Feature | Umbrella | Excess Liability |
|---|---|---|
| Sits above | CGL, auto, employers liability | One or more underlying policies |
| Broader coverage? | Yes — can be broader than underlying | No — typically "follows form" |
| Drop-down? | Can drop down for gaps via a self-insured retention (SIR) | Generally no — only excess |
When a loss is covered by the umbrella but not by the underlying policy, the insured pays the self-insured retention (SIR) (similar to a deductible) and the umbrella drops down to pay above it. A pure excess (follow-form) policy lacks this drop-down feature.
Worked Example: Umbrella Drop-Down
A business has a $1,000,000 CGL and a $5,000,000 umbrella with a $10,000 SIR. A covered claim of $3,000,000 arises. Two scenarios:
- Loss covered by both layers: The CGL pays its $1,000,000 limit; the umbrella pays the remaining $2,000,000 on top — no SIR applies because the underlying policy was triggered.
- Loss covered by umbrella but excluded by the CGL: No underlying limit applies, so the insured pays the $10,000 SIR and the umbrella drops down to pay the remaining $2,990,000 (up to its $5,000,000 limit).
Difference-in-Conditions and Other Specialty Forms
A Difference-in-Conditions (DIC) policy is a separate, broad open-peril contract that fills gaps in the insured's standard property program — most often adding flood and earthquake that the underlying form excludes, plus other excluded perils. DIC does not duplicate the underlying coverage; it covers what the primary policy leaves out, which is why it is a favorite exam contrast with standard property.
Other Specialty Lines to Recognize
- Directors & Officers (D&O) — liability of corporate leadership for management decisions; claims-made.
- Employment Practices Liability (EPLI) — wrongful termination, discrimination, harassment; claims-made.
- Professional liability / E&O — negligence in rendering professional services; medical malpractice is the healthcare version.
- Ocean marine — hull, cargo, freight, and protection & indemnity over water (the boundary that separates it from inland marine).
- Crop / agricultural — multi-peril crop insurance (MPCI) is federally reinsured through the USDA Risk Management Agency, while private crop-hail covers a narrower peril.
Ocean marine is the original line of insurance and the source of many concepts tested elsewhere. Its four coverages are hull (the vessel), cargo (goods aboard), freight (shipping revenue lost if cargo is not delivered), and protection & indemnity (P&I) (the owner's liability for bodily injury, including crew, and damage to others).
Ocean marine introduces general average — a loss voluntarily incurred to save the whole venture (jettisoning cargo) that all parties share proportionally — and particular average, a partial loss borne by the property owner alone. These average concepts and the over-water boundary are the most-tested ocean marine points.
Common Exam Traps
- Cyber is claims-made, not occurrence — the claim must be reported in the policy period or tail.
- First-party vs. third-party cyber — own breach costs vs. liability to others.
- Umbrella drop-down needs an SIR — excess (follow-form) does not drop down.
- Aviation hull turns on in-motion status — in-flight, taxiing, or parked.
- DIC adds flood/quake — it fills gaps, it does not duplicate the primary form.
A standard commercial property policy excludes flood and earthquake. Which specialty form is most commonly used to add those perils back?