16.3 Cyber, Aviation, and Other Specialty Lines

Cyber Liability Insurance

Standard CGL and property forms were never designed for data breaches, so insurers developed cyber liability policies, almost always written on a claims-made basis (response is triggered by the claim/discovery date, subject to a retroactive date, not by when the breach actually occurred). Cyber coverage splits into two grants:

• First-party — the insured's own losses: forensic investigation, data restoration, business interruption, cyber extortion (ransomware) payments, and breach-notification costs.
• Third-party — liability to others: defense and damages for network/privacy liability, regulatory fines and penalties (where insurable), and media/content liability.

Many standard CGL policies now attach the ISO exclusion CG 21 06 — Exclusion - Access Or Disclosure Of Confidential Or Personal Information, which strips data-breach coverage out of the CGL and pushes it to a dedicated cyber form. Underwriting hinges on the insured's security controls (MFA, encryption, backups), and sublimits commonly apply to extortion and social-engineering fraud.

Aviation Insurance

Aircraft are excluded from the Personal Auto Policy and from most CGL/property forms, so aviation insurance is a specialty line with its own terminology:

• Hull coverage — physical damage to the aircraft. Written as 'in-motion' (taxiing, takeoff, flight, landing) or 'not-in-motion' (parked/moored), or all-risk.
• Liability — bodily injury and property damage to third parties, often split between passenger liability and public (non-passenger) liability.
• Admitted vs. non-admitted seat liability — limits are frequently stated per passenger seat.

Aviation liability is commonly written with a combined single limit (CSL) or with split limits expressed per seat / per occurrence. Coverage can be voided by operating outside the 'purpose of use' (e.g., flying for hire under a private-use policy) or by a pilot who fails the policy's pilot warranty (minimum hours, ratings, medical certificate).

Worked Example — Aviation Split (Per-Seat) Limits

A charter aircraft carries liability of $1,000,000 per passenger seat with 8 passenger seats and a $5,000,000 per-occurrence cap on passenger liability. A crash injures all 8 passengers, with adjudicated damages of $900,000 each (total $7,200,000). How much does the policy pay for passenger injuries?

• Each passenger is within the $1,000,000 per-seat limit, so each $900,000 award is fully within limits: 8 x $900,000 = $7,200,000 of covered damages.
• But the $5,000,000 per-occurrence cap applies and is the controlling limit.
• Insurer pays $5,000,000; the remaining $2,200,000 is uninsured. The lower of (per-seat aggregate) and (per-occurrence cap) governs.

Other Specialty Lines

The national exam samples several additional specialty and excess products:

Umbrella Mechanics and the Surplus-Lines Trap

The most-tested trap is that non-admitted (surplus lines) insurers are NOT backed by the state guaranty association, so an insurer insolvency leaves the surplus-lines insured unprotected. That is the trade-off for accessing capacity the admitted market refuses to write.

A commercial umbrella drops down to pay only when scheduled underlying limits are exhausted by covered claims. If the insured lets an underlying limit lapse or carries less than the schedule requires, the umbrella treats the shortfall as a self-insured retention (SIR) the insured must absorb before the umbrella responds. Where the umbrella is broader than the underlying (a claim covered by the umbrella but excluded below), the umbrella pays after the insured satisfies the SIR.

A worked illustration: an insured carries CGL with a $1,000,000 occurrence limit and a $5,000,000 umbrella. A covered judgment is $4,500,000. The CGL pays its $1,000,000; the umbrella drops down and pays the next $3,500,000, well within its $5,000,000 limit. Had the insured allowed the CGL to lapse, the insured would owe the first $1,000,000 itself as a retained SIR before the umbrella engaged.

Cyber Coverage: First-Party vs. Third-Party

Cyber liability splits into first-party coverage (the insured's own losses — data restoration, business interruption from a breach, ransomware/extortion payments, notification and credit-monitoring costs, and forensic investigation) and third-party coverage (liability to others — privacy and network-security liability, regulatory defense and fines where insurable, and media liability). Because the CGL and property forms increasingly exclude cyber and data losses (data is often not "tangible property"), standalone cyber policies fill the gap.

These are claims-made for the liability sections and tested for the distinction between restoring your own systems and defending suits by affected customers.

Aviation, Surplus Lines, and a Per-Seat Walkthrough

Aviation insurance covers hull (the aircraft) and liability, often with a per-passenger seat sublimit. A policy with $10,000,000 each-occurrence liability but a $100,000 per-seat limit on a plane carrying four passengers caps passenger bodily-injury recovery at $400,000 even though the occurrence limit is far higher — a classic split the exam computes.

Hard-to-place and unusual risks (aviation, large cyber, ocean marine, certain professional risks) often move to the surplus-lines (excess and surplus) market, written by non-admitted insurers through specially licensed surplus-lines brokers who must first show the risk was rejected by admitted carriers (the diligent-search/declinations requirement).