CFC has updated its Cyber Proactive Response (CPR) policy to cover senior executives personally targeted in cyberattacks, add affirmative wording for AI-related exposures and extend the business interruption indemnity period from 12 to 18 months.
The changes apply to CPR, the cyber product CFC launched in April 2025 for businesses with revenues of up to $250 million. That product embedded proactive attack prevention services in the policy wording and offered unlimited reinstatements with a nil deductible.
The most distinctive addition is personal cover for senior executives. The updated policy covers personal crime and extortion exposures, temporary relocation costs for executives and their families, and trauma counseling after an attack.
"Cyber attacks no longer stop at the organisation's network," said Scott Bailey (pictured), head of global cyber underwriting at CFC.
Bailey said senior executives could face personal exposures during extortion and social engineering attacks, including credible threats, harassment and physical security concerns affecting their families. CFC said the additions reflected its view that cyber incidents are organizational crises rather than simply technology failures.
On AI, CFC said the revised wording was designed to give businesses and brokers more certainty over how cyber cover responds to AI-related exposures. The announcement does not set out the wording in detail.
CFC introduced similar affirmative AI language last month when it rebuilt the cyber section of its financial institutions suite around CPR. As Insurance Business explained at the time, that type of wording answers a narrower question than whether "AI is covered". It confirms that AI used as a tool against the policyholder, in phishing, reconnaissance or intrusion, falls within existing cyber cover.
The move is part of a broader shift in the market from silent to affirmative AI cover, as insurers try to remove ambiguity before it is tested in a claim. Insurance Business has reported on how that debate is reshaping cyber placements.
The third change extends the business interruption indemnity period from 12 to 18 months. CFC said many business interruption losses continue long after systems are restored, as customers drift away and revenue takes time to recover.
That reflects lessons from recent large cyber events, where the commercial damage lasted well beyond the technical recovery.
Bailey said the enhancements were intended to give greater certainty around emerging risks, stronger protection for the people leading organizations, and support reflecting the human as well as the financial impact of cyber incidents.
For brokers placing small and mid-sized business cyber risks, the update gives them three concrete talking points at renewal.
The executive protection extends cyber cover into territory that might otherwise fall to kidnap and ransom, personal crime or high-net-worth policies. Brokers will want to check how it sits alongside any existing personal cover a client's directors and officers hold, to avoid gaps or double insurance.
The affirmative AI wording addresses a question clients are increasingly asking. Brokers should still read the wording to see exactly which AI exposures are covered. As IB's earlier analysis noted, confirming AI-driven attacks are covered is not the same as covering every loss arising from a client's own use of AI.
The longer indemnity period is the most straightforward gain. For clients with long sales cycles or reputation-sensitive revenue, 12 months has often proved too short. Brokers comparing cyber quotes should now treat the indemnity period as a key point of difference, rather than assuming it is standard across the market.
