16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber policies split into first-party coverages (breach response, data restoration, business interruption, cyber extortion) and third-party coverages (privacy liability, regulatory defense), and are typically written on a claims-made basis.
- Aviation insurance separates hull (physical damage to the aircraft) from liability, and is largely non-filed/manuscript because aircraft risks fall outside standard ISO programs.
- Specialty and excess/surplus lines fill gaps standard markets decline; surplus lines are placed with non-admitted insurers and are not protected by state guaranty funds.
- Umbrella and excess liability provide limits above underlying policies; a true umbrella can also drop down to cover some claims the underlying excludes, subject to a self-insured retention (SIR).
- Directors and officers (D&O), employment practices liability (EPLI), and professional liability (E&O) are claims-made specialty casualty lines requiring a retroactive date.
Cyber Insurance: First-Party vs. Third-Party
Cyber policies respond to data breaches, ransomware, and network failures - exposures the standard property and Commercial General Liability (CGL) forms increasingly exclude. Coverage divides into two halves.
Quick Answer: First-party cyber pays the insured's own costs (notification, restoration, lost income, ransom). Third-party cyber pays for liability the insured owes others (privacy claims, regulatory penalties, defense).
| Side | Typical Coverages |
|---|---|
| First-party | Breach response/notification, data restoration, business interruption, cyber extortion/ransomware, reputational harm |
| Third-party | Network security and privacy liability, regulatory defense and fines, media/content liability, PCI fines and assessments |
Most cyber forms are written claims-made with a retroactive date, so the claim must be first made during the policy period and the wrongful act must occur on or after the retro date. Because forms vary widely by carrier, cyber is heavily manuscript and non-standardized - read each form's definitions carefully on the exam.
Sublimits and waiting periods are pervasive in cyber. Cyber business interruption often carries a time-based waiting period (a 6-, 8-, or 12-hour retention) before income loss accrues, and cyber extortion/ransomware, regulatory fines, and social-engineering fraud frequently carry separate sublimits well below the aggregate. A $5,000,000 cyber policy may cap ransomware at $1,000,000 and social-engineering loss at $250,000 - so the headline limit overstates real protection for any single peril.
Aviation Insurance
Aviation insurance covers aircraft exposures that fall outside standard auto and property programs. It separates two components:
- Hull coverage - physical damage to the aircraft itself, written "in motion," "not in motion," or all-risk ground and flight. Settlement is usually on an agreed value (stated amount) basis given the difficulty of valuing aircraft.
- Liability coverage - bodily injury and property damage to others, often split among:
| Aviation Liability Component | Covers |
|---|---|
| Bodily injury excluding passengers | Third parties on the ground/other aircraft |
| Passenger bodily injury | Occupants of the insured aircraft |
| Property damage | Damage to others' property |
| Medical payments | Occupant medical costs regardless of fault |
Aviation liability is frequently written with single limits (one combined limit per occurrence) or as a smooth limit, and almost all aviation business is non-filed/manuscript and placed in specialty markets. Coverage hinges on the named pilot meeting pilot warranty requirements (ratings, hours, medical certificate); flying outside those warranties can void coverage - a classic exam trap.
Excess, Surplus Lines, and Umbrella
Excess and Surplus (E&S) Lines
When the standard (admitted) market declines a risk - an amusement park, a fireworks manufacturer, a new tech venture - it moves to the excess and surplus lines market, placed with non-admitted (unauthorized) insurers through a surplus lines broker.
Critical exam point: surplus lines insurers are not backed by the state guaranty fund. If a non-admitted insurer becomes insolvent, policyholders have no guaranty-fund protection, unlike with an admitted carrier. The broker must typically perform a diligent search (often three admitted-market declinations) before placing surplus lines.
Umbrella and Excess Liability
| Feature | Excess Liability | True Umbrella |
|---|---|---|
| Adds limits over underlying | Yes | Yes |
| Broader than underlying ("drop down") | No - follows form | Yes - can cover some claims the underlying excludes |
| Gap mechanism | None | Self-insured retention (SIR) applies where no underlying coverage exists |
A true umbrella can drop down to cover a claim the underlying policy excludes; the insured then pays a self-insured retention (SIR) before the umbrella responds. An excess (follow-form) policy simply stacks more limit on top and covers only what the underlying covers.
A manufacturer's underlying CGL excludes a particular liability claim, but its true umbrella policy does not. How does the umbrella respond?
Management and Professional Liability
Several specialty casualty lines are written claims-made with a retroactive date:
- Directors and Officers (D&O) liability - protects corporate directors/officers (and the entity) against claims alleging wrongful management decisions, breach of fiduciary duty, or misrepresentation.
- Employment Practices Liability Insurance (EPLI) - covers claims of wrongful termination, discrimination, harassment, and retaliation.
- Professional Liability / Errors and Omissions (E&O) - covers losses arising from professional negligence or failure to perform professional duties (covers economic loss, distinct from a doctor's bodily-injury malpractice form).
- Cyber (above) likewise claims-made.
Worked Example: Claims-Made Retroactive Date
A design firm buys E&O effective 1/1/2026 with a retroactive date of 1/1/2024. A client sues in March 2026 over a design error committed in June 2023 - before the retro date. The claim is made during the policy period, but because the wrongful act predates the retroactive date, the policy does not respond. Had the error occurred after 1/1/2024 and the claim been made during the period, coverage would apply.
Common Specialty-Lines Traps
- Surplus lines guaranty fund. Non-admitted insurers are not guaranty-fund protected.
- Umbrella vs. excess. Only a true umbrella drops down (with an SIR); excess follows form.
- Claims-made retro date. A wrongful act before the retro date is excluded even if the claim is timely.
- Cyber halves. First-party = your own costs; third-party = liability to others.
- Aviation pilot warranty. Flying outside warranted ratings/hours can void hull and liability coverage.
An insured places coverage for a high-hazard risk with a non-admitted surplus lines insurer that later becomes insolvent before paying a covered claim. What is the insured's recourse to the state guaranty fund?
First-Party vs. Third-Party Cyber, and Aviation Hull/Liability
Specialty lines fill gaps the standard CGL and property forms leave open. Cyber and aviation are the two most-tested.
| Specialty line | First-party (the insured's own loss) | Third-party (liability to others) |
|---|---|---|
| Cyber | Data restoration, business interruption, ransomware, notification costs | Privacy/network liability, regulatory defense, media liability |
| Aviation | Hull (physical damage to the aircraft) | Liability for BI/PD to passengers and third parties |
Cyber is essential because the CGL excludes most electronic-data damage and 'access to or disclosure of confidential information.' Aviation is excluded from both the PAP and the CGL, so aircraft owners need a stand-alone aviation hull and liability policy.
Exam Trap: A standard CGL excludes aircraft liability entirely, so a business using a corporate aircraft has no CGL coverage for an aviation loss. Likewise, the CGL's data exclusion means a ransomware or breach-notification cost is a cyber claim, not a property or CGL claim. Other specialty lines tested include kidnap & ransom, terrorism (TRIA), and media/technology E&O.