First-Party and Third-Party: The Two Halves of Cyber Risk

Cyber insurance confuses people because it is sold as one product but is really two risks stapled together, and they behave nothing alike. The clean way to hold it is the same first-party versus third-party split that organizes all of insurance. First-party cover pays for harm you suffer. Third-party cover pays for harm you cause others. Almost every argument about what cyber does and does not cover is really an argument about which of these two buckets a given loss falls into.

Start with first-party. When an attacker encrypts your systems and demands payment, the costs land on you directly: the forensic investigators who determine what happened, the incident-response firm that contains it, the cost of rebuilding systems, the lost income while operations are down, and — controversially — the ransom itself, where paying is legal. This is the cyber analogue of business interruption, and for an operator running critical digital infrastructure it can be the largest exposure of all. A facility does not need its building to burn to lose weeks of revenue; it only needs its control systems locked. First-party cyber also typically funds the specialized machinery a breach demands — breach notification, credit monitoring for affected individuals, public-relations help — costs that are real, immediate, and yours.

Third-party cover is the other half. When your breach harms someone else — customers whose data leaked, partners whose systems you infected, regulators who levy penalties — third parties sue, and third-party cyber responds to those claims and their defense. For a company holding other people's data or running workloads for other businesses, this liability tail can be long and expensive, because the harm surfaces slowly and litigation moves slower still. The structural parallel to casualty insurance is exact: first-party is your loss, third-party is your fault, and the timing and reserving of the two are completely different problems.

Sitting beside cyber, and often blurred with it, is technology errors and omissions — tech E&O. This is professional liability for technology companies: cover for claims that your product or service failed to perform, causing a client financial loss. If a provider's platform goes down and a customer sues for the business they lost, that is E&O territory, not a data breach. The line between cyber and tech E&O is genuinely fuzzy — a single outage can trigger both a security question and a performance question — and modern policies increasingly blend them. But the conceptual distinction is worth keeping sharp: cyber is fundamentally about security failures and their fallout; tech E&O is about your service not doing what you promised. One is a break-in; the other is a broken promise.

The reason this taxonomy matters operationally is coverage disputes. The largest fights in cyber claims are almost never about whether a company had a policy. They are about which bucket the loss belongs in and whether an exclusion applies. Did the loss stem from a covered security failure or an uncovered infrastructure fault? Was this a third-party liability or a first-party expense? Policies draw these lines in dense definitional language, and the definitions decide who pays. An operator who understands the first-party/third-party frame reads a cyber policy the way an underwriter does: not asking 'am I covered?' but asking 'covered for which harm, up to what limit, with which carve-outs?'

One durable warning belongs here. Cyber policies contain exclusions that can quietly gut the cover, and the two to watch are war and infrastructure. After state-linked attacks caused enormous correlated losses, the market tightened its war-and-hostile-act exclusions, and the boundary between ordinary crime and state action is exactly where the hardest disputes now sit. Separately, a policy meant to cover data breaches may explicitly exclude losses arising from physical infrastructure failure — precisely the seam where a facility operator is most exposed. The lesson is not that cyber cover is worthless. It is that in this class, more than almost any other, the exclusions are the product. The frame to carry forward is simple and load-bearing: first-party is what happens to you, third-party is what you did to others, tech E&O is your service breaking its promise, and the exclusions decide which of these the policy will actually pay for.