16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber liability splits into first-party (the insured's breach-response, BI, ransomware) and third-party (privacy/network liability) coverage, usually claims-made.
- Aviation is a specialty line with hull (in-motion/not-in-motion), admitted vs. non-admitted liability, and per-seat passenger limits.
- Split limits like 100/300/50 cap per-person BI, per-accident BI, and property damage separately; a CSL is one combined number.
- D&O, EPLI, E&O, and K&R round out specialty lines and typically use a claims-made trigger with a retroactive date.
- Claims-made policies cover only claims first made and reported during the term, bounded by the retroactive date and any extended reporting period (tail).
Cyber Liability Insurance
Standard CGL policies do not reliably respond to data breaches - the 2014 ISO endorsement (CG 21 06) excludes access-or-disclosure injury and electronic data. Cyber is therefore a stand-alone, mostly non-standard line, but exams test the two-bucket structure:
- First-party coverage - the insured's own losses: breach-response/forensics, notification costs, credit monitoring, business interruption from a network outage, cyber extortion (ransomware), and data restoration.
- Third-party coverage - liability to others: privacy and network-security liability, regulatory defense and fines (where insurable), and media/content liability.
Most cyber forms are written on a claims-made basis with a retroactive date, mirroring professional liability.
Aviation Insurance
Aviation is excluded from standard auto, CGL, and homeowners forms, so it is a specialty line with its own terminology:
- Hull coverage - physical damage to the aircraft, often split into in-motion and not-in-motion sub-limits.
- Liability - bodily injury and property damage to third parties. Admitted (passenger) liability covers passengers; non-admitted liability covers everyone else.
- Medical payments and hangarkeepers (a maintenance operator's liability for aircraft in its care).
A recurring trap: aviation liability may be written with a single limit or with passenger liability limited per seat ("each-passenger" limit times number of seats), which can cap recovery below an aggregate.
Split Limits vs. Combined Single Limit - Worked Example
Liability limits on auto and aviation are quoted two ways:
- Split limits like 100/300/50 mean $100,000 per person bodily injury, $300,000 per accident bodily injury, $50,000 property damage.
- Combined Single Limit (CSL) is one number for all BI and PD combined.
Worked split-limit settlement
An accident under 100/300/50 injures three people - $80,000, $120,000, and $60,000 in damages - plus $40,000 property damage.
- Person 1: $80,000 (under $100K per-person cap) -> $80,000
- Person 2: capped at $100,000 (the per-person cap) -> $100,000
- Person 3: $60,000 -> $60,000
- BI subtotal = $240,000, within the $300,000 per-accident cap, so all paid.
- Property damage $40,000, under the $50,000 cap -> $40,000
Total paid = $280,000. Under a $300,000 CSL, the insurer could still pay only up to $300,000 total but without the per-person ceiling that capped Person 2.
First-Party vs. Third-Party Cyber and the Specialty Market
Cyber liability splits into two halves the exam tests by whose loss is paid.
| Side | Pays for |
|---|---|
| First-party | The insured's own costs: forensics, notification, credit monitoring, business interruption, ransomware/extortion |
| Third-party | Liability to others: lawsuits and regulatory fines from a data breach |
Exam trap: Most cyber policies are claims-made, so the claim must be first made during the policy period. A breach that occurred earlier but is claimed now is covered only if a policy is in force and the event postdates any retroactive date - the same trigger logic as professional liability and D&O.
Aviation and Other Specialty Lines
Aviation insurance covers hull (the aircraft) and liability (passengers and third parties), often with admitted-market limits inadequate for catastrophic exposure, pushing large risks to the surplus-lines market. Surplus-lines (nonadmitted) coverage is placed only after a diligent search of admitted carriers and is not protected by the state guaranty fund - so an insolvent surplus-lines insurer leaves the insured without that backstop. This guaranty-fund gap is the most-tested surplus-lines point.
Under a 100/300/50 split-limit policy, one claimant has a covered bodily-injury judgment of $150,000. How much does the policy pay that claimant for bodily injury?
Other Specialty Lines
Several additional specialty lines appear as a few questions each:
| Line | What it covers |
|---|---|
| Directors & Officers (D&O) | Liability of corporate directors/officers for wrongful management acts |
| Employment Practices Liability (EPLI) | Wrongful termination, discrimination, harassment claims |
| Errors & Omissions (E&O) | Professional negligence of agents, brokers, and other professionals |
| Kidnap & Ransom (K&R) | Ransom, extortion, and crisis-response costs |
| Inland/ocean marine | Cargo, transit, and instrumentalities of transportation |
Most of these write on a claims-made trigger with a retroactive date; a claim is covered only if both the wrongful act and the claim fall within the policy's reporting window.
The Claims-Made Trigger - A Frequent Trap
Unlike occurrence policies (which respond to events happening during the term no matter when reported), claims-made policies respond only to claims first made and reported during the policy period (plus any extended reporting period).
- The retroactive date sets the earliest wrongful-act date that can be covered.
- An Extended Reporting Period (ERP / "tail") lets the insured report, after cancellation, claims for acts during the active period.
Moving from occurrence to claims-made, or letting a retroactive date lapse, can create silent gaps - which is exactly what the exam probes.
Surplus Lines and the Non-Admitted Market
Many specialty risks - large cyber towers, complex D&O, aviation, K&R - are placed in the surplus (excess) lines market through non-admitted insurers when no admitted carrier will write the risk. Tested points:
- A surplus lines broker must hold a separate license and perform a diligent search (usually three admitted-carrier declinations) before placing coverage non-admitted.
- Non-admitted insurers are not backed by the state guaranty fund, so insolvency leaves the insured without that safety net.
- The broker collects and remits surplus lines premium tax to the home state.
This is why specialty lines so often carry warnings about financial-strength ratings: with no guaranty-fund backstop, the carrier's solvency is the insured's only protection.
A cyber liability policy is written on a claims-made basis with a retroactive date of January 1, 2025. A data breach occurs in March 2024 but the lawsuit is first filed and reported during the 2026 policy period. Is the claim covered?