Six Ways Coverage Fails at Claim Time
These patterns show up in every community bank I review. Different carriers. Different policy forms. Same gaps. Each one creates a scenario where the bank assumes it is covered and discovers at claim time that it is not.
Community banks carry three policies that touch cyber risk: a cyber policy, a fidelity bond, and a directors and officers (D&O) policy. These policies were never designed to work together. Each carrier points the finger at the other two. The bank holds the loss.
The six gaps below are the ones I find most often. They come from actual policy reviews.
The Wire That Never Comes Back
Spoofed instructions, real wire. The cyber policy excludes "voluntary parting." The fidelity bond requires a system intrusion that never happened. Both carriers point at each other.
The Board on the Hook
After a breach, regulators go after the directors personally. The D&O policy has a cyber exclusion nobody knew was there. The cyber policy does not cover board liability. Directors face personal exposure.
The Vendor You Cannot Replace
A core processor goes down for three days. The cyber policy's business interruption coverage requires the bank's own systems to be compromised. The vendor's systems don't count.
The Ransom You Cannot Pay
Ransomware encrypts the bank's data. The carrier will not authorize payment because the threat actor is on an OFAC sanctions list. The bank chooses between an illegal payment and an indefinite outage.
The Application That Cancels the Policy
After a loss, the carrier reviews the application the bank submitted at renewal. MFA not enforced everywhere? Backups not tested? The policy can be voided as if it never existed.
The Fine Print Inside the Coverage
The policy responds, but sublimits, retentions, and carve-outs shrink the recovery. A $5 million policy can become a $500K payout. The limit on the declarations page is the ceiling. The floor is buried in language the bank never read.
For a side-by-side map of how all three policies respond to each incident type, see Five Common Cyber Incidents, Three Policies, and the Gaps Between Them.
Find Out Where Your Coverage Fails
One report. Plain English. Before your next claim, board review, or examination.
Get in Touch