War exclusions in the age of cyber conflict | FANews April 2026 Edition
Cyberattacks are evolving into complex, state-linked operations that challenge traditional insurance frameworks. This article explores whether war exclusions can still...
Cyber Insurance Triggers
Network breach:
When someone gets into your computer system or network:
- Being hacked (unauthorised access or use)
- Data being stolen (like client information or intellectual property)
- Viruses or malware
- Overloading your system so it crashes (Denial of Service attack)
- Physical theft or loss of both devices and physical hard copy data
- Causing harm to others by attacking them through system (called a downstream attack)
Privacy breach:
This happens when private or confidential information is:
- Leaked
- Exposed
- Misused
and can involve personal data of employees, customers, contractors, suppliers or anyone else.
Our comprehensive offer
What's included?
Our comprehensive cyber insurance policy can be specifically tailored to your requirements.
First Party Cover
Loss of Business Income
- Loss of business income and ongoing operational costs following a network breach
- Loss of business income after systems are deliberately taken offline to contain or manage a cyber incident or comply with Regulator instructions
Unintentional System Failure
- Loss of business income caused by an unintentional system failure that results in a material disruption to the insured’s operations
Cyber Extortion
- Costs to investigate and mitigate a cyber extortion threat including ransom payments and the costs to procure cryptocurrency
Data Restoration
- Costs to restore, replace or recover data that is lost, stolen or corrupt following a cyber incident
Initial Response Phase
- A deductible waiver for expenses of specialists to contain and manage an incident, for a pre-determined time without a deductible being applicable
Theft of Funds
The unrecoverable loss of:
- Money belonging to the Insured, their Subsidiaries or Senior Officers
- Money the Insured is legally responsible for
- Goods provided by the Insured (on a cost price basis) as a direct result of a network breach by a third party or money transferred after receiving a fraudulent payment instruction and following proper verification process
Physical Damage
- Costs to replace or repair direct physical damage of tangible property belonging to or rented, leased or hired by you as a direct result of a system security incident
Payment Card Industry
- Cover for fines, penalties, chargebacks and assessments imposed under merchant agreements due to a card data breach
Outsourced Service Provider
Cover for exposure to outsourced IT service providers including:
- Initial Response Phase Expenses
- Crisis Management and Notification Expenses
- Data Recovery
- Loss of Business Income
- Disruption and Mitigation – costs to change to an alternate outsourced service provider if required
Phone Phreaking
- Call and/or bandwidth usage costs you are legally obligated to pay as a result of unauthorised use of your telecommunications system by a third party
Post Incident Betterment
- Cover for costs to improve security posture following an approved claim
Regulatory Fines
- Fines imposed by a government regulatory body due to an information privacy breach
Third Party Cover
Privacy Breach Liability
Defence and settlement of liability claims arising from compromised information.
Network Security Liability
Defence and settlement of liability claims resulting from a system security incident affecting systems and data as well as causing harm to third-party systems and data.
Media Liability
Defence and settlement of liability claims resulting from online content including social media posts or website material, such as defamation, copyright infringement, or privacy violations.
Contingent Bodily Injury
Defence and settlement of mental anguish claims caused by a cyber incident.
Incident Mitigation
Incident Response Costs
Costs to respond to the incident, including:
- Perform incident triage and forensic investigations, including IT experts to confirm and determine the cause of the incident, the extent of the damage including the nature and volume of data compromised, how to contain, mitigate and repair the damage, and guidance on measures to prevent reoccurrence
- Obtain professional legal, public relations and IT forensic advice, including assistance in managing the incident, co-ordinating response activities, making representation to regulatory bodies and coordination with law enforcement
- Crisis communications and public relations costs to manage a reputational crisis, including spokesperson training and social media monitoring
- Communications to notify affected parties; and
- Remediation services
Clever insurance for clever people
Comprehensively protect your business against any cyber threat.
How to get cover
DigiEase SME: For companies under R250 million revenue wanting a maximum R25 million cover – please ask your broker to send you their link to our online quoting and policy issuing platform.
Cyber Insurance for Companies: Our larger or more complex risk offering for clients who fall outside the DigiEase SME parameters and require broader or more tailored cover with higher limits – please complete a proposal form and ask your broker to contact us for a quote.
Important instructions:
- Please use our interactive electronic proposal form which has multiple dropdown options, making it quick and easy to complete. Handwritten submissions will not be accepted.
- Please have the technical questions completed by your internal IT team or external service provider.
- Please ensure all questions are completed as each question impacts the premium, pay special attention to the “Number of Records” table.
Don’t have a broker and want us to recommend possible FAIS registered brokers trained in our products? Find a broker or contact one of our experts.
Forms and documents
iTOO Commercial Cyber Product Card
This guide explains when cyber insurance coverage is activated and what protection iTOO provides—including incident mitigation, business interruption, theft of funds, liability claims, and more.
iTOO Cyber Insurance Proposal Form
For companies with a turnover above R250m or companies which do not meet the iTOO Go qualifying criteria.
iTOO-GO Product Overview
To learn more about iTOO’s Cyber Go offering for SME’s, visit the iTOO DigiEase page.
How to claim
Speed, efficiency and experience is critical to reducing the exposure, costs and reputational damage. With iTOO’s Cyber Insurance Policy you are assured of access to highly acclaimed expert resources including experienced cyber mitigation and incident response specialists with a local presence and proven capabilities.
- Call now: 0861 767 778 (or 011 351 5000)
- Email now: cyber_claims@itoo.co.za
Frequently asked questions
Why would my company be a target?
Attacks such as ransomware are indiscriminate and can affect any company and every industry. Smaller companies are often a target for hackers particularly if they are found to have less sophisticated IT infrastructure. Smaller companies can be severely impacted following a breach as they are required to absorb the high incident response costs. Compromises at larger companies tend to yield larger data sets for theft and break into the news, which can boost a hackers’ reputation.
We use state of the art protection; do we still need cyber insurance?
Having the latest technology, firewalls and encryption will reduce the risks of a breach occurring however, many cyber threats originate internally from employee mistakes (misplacing a laptop, or not disposing of confidential information securely). Having state of the art protection is not a 100% guarantee against an incident occurring.
What if we use a cloud provider to store client data?
You are the custodian of the data and remain responsible for any data lost in a breach. Look to use a cloud service provider that can provide reasonable assurance that your data will be protected, however, there is still a chance your business could be held liable for data compromised from the cloud environment (the same would apply for other outsourced providers you make use of and share data with).
Does any other liability policy provide cyber cover?
A cyber insurance policy provides the most comprehensive cover for system and data related risks.
- A Professional Indemnity policy provides limited cover for third party data loss but only as it relates to the provision of professional services.
- A General Liability policy, as data is deemed intangible provides no cover.
- A Business Interruption policy requires physical damage to trigger the policy and incidents such as ransomware or hacking a server may reflect no physical damage.
- A Commercial Crime policy provides cover for first party financial loss only.
- A Directors & Officers policy will likely be triggered after a cyber breach but will not cover the business interruption, incident response or liability damages suffered by the company.
How do I apply for cover?
DigiEase SME: for companies under R250 million revenue wanting a maximum R15 million cover – please ask your broker to send you their link to our online quoting and policy issuing platform.
Cyber Insurance for Companies: our larger or more complex risk offering for clients who fall outside the DigiEase SME parameters and require broader or more tailored cover with higher limits – please complete a proposal form and ask your broker to contact us for a quote.
iTOO Insights
Research shows cyber insurers are paying earlier and more consistently than critics claim
Despite public debate, cyber insurers are paying claims earlier, more consistently and expanding coverage to address the scale of modern...
From Remote Work to AI Risk: The New Age of Cyber Threats | FIA Cyber Quarterly
Cyber risk has evolved from basic network vulnerabilities to sophisticated AI-driven fraud and impersonation attacks. This insight explores how cyber...