Where Cyber Insurance Claims Break: Judy Selby on Business Interruption, War Exclusions and Buying Right

In this episode of the Cyber Intelligence 4U podcast, Ariel Evans talks with Judy Selby, Partner at Tittmann Weix and an insurance coverage attorney who moved into cyber and privacy well before most of the market. They cover where cyber insurance claims actually get contested, why many reported "denials" are really underinsurance, and what buyers should check before they bind.

Key takeaways

• Business interruption and contingent BI are where the next coverage fights are: when the period of restoration ends, what counts as reasonable and necessary extra expense, and whether lost revenue was caused by the incident at all.

• Many headline "denials" are really notice failures, consent failures or underinsurance. Limits matter even more once cyber, privacy, media, BI, CBI and tech E&O sit on one policy.

• Cybercrime coverage is almost always sublimited, and losses often exceed a typical $250,000 sublimit. Know how it fits your tower and keep strong payment-verification practices even if the policy no longer requires them.

• Merck was a property-policy dispute, not a cyber one; the cyber tower paid its limits. The decision turned on New Jersey's reasonable-expectations rule, so it settled little on attribution.

• Misrepresentation and control-warranty disputes turn on exact wording and state law. "Do you use MFA?" doesn't tell anyone whether it covers every system, and with AI changing environments monthly, a 12-month underwriting cycle looks dated.

• Paying threat actors to suppress stolen data is the live debate: deletion can't be verified, notice obligations remain, and payments may fund the next attack. Sanctions due diligence comes first on any ransom payment.

• In a soft market, build your tower rather than shop on price, reassess mid-year when risks change, and weigh each insurer's claims-handling record.

Chapters

• 01:22 Why cyber needed its own coverage practice

• 03:32 Real coverage disputes vs. notice failures and underinsurance

• 06:55 Silent cyber: forcing cyber losses into CGL and other lines

• 11:34 Why buyers were slow, and the insurer "cyber SWAT team"

• 18:21 Policy terms that surprise buyers at claim time

• 23:01 Merck, war exclusions and attribution

• 27:09 The next wave: misrepresentation, controls and annual underwriting

• 30:56 Business interruption: extra expense, causation, restoration

• 35:07 Control warranties and conditions precedent

• 36:29 Ransom payments, sanctions and paying for data suppression

• 42:28 Panel vs. off-panel incident response vendors

• 46:13 What makes a good breach coach

• 47:42 Five-year outlook: cloud platforms, API keys and coverage boundaries

• 51:27 Practical advice for cyber insurance buyers

Recorded November 2, 2026 · 56 min. This conversation is for general information and is not legal advice.