You think you're covered. Most owners are not.
Most yacht owners believe they have cyber cover. Many have paid for it. A number have even read the policy summary. Almost none have mapped what that policy actually covers against the full range of losses a single cyber incident on a superyacht can produce.
That gap between assumed protection and actual protection is not a technicality. It is where significant and largely uninsured exposure quietly lives.
The standard conversation goes something like this. An owner asks their broker whether the yacht is covered for cyber. The broker confirms that yes, the cyber exclusion on the Hull and Machinery policy has been bought back, and that a cyber response policy is in place covering incident response, forensic investigation, and some element of crisis management. The owner is satisfied. The broker moves on.
What nobody has done is ask the next question. Which is: what happens when an incident on this vessel produces losses that fall across five different categories simultaneously, and only one of those categories appears in the policy schedule?
A superyacht is not an office network. The losses it can generate are not the losses a standard cyber policy is designed to address. And the assumptions baked into off-the-shelf cover were written for a different kind of risk.
Why one policy is never enough
A meaningful cyber incident on a superyacht can trigger physical damage to systems and structure, loss of navigational control, theft or exposure of highly personal data belonging to the owner and their family, extortion, reputational harm, and regulatory liability. These are not variations on a single theme. They are distinct categories of loss, and they are governed by distinct policy types, each with its own triggers, exclusions, sub-limits, and claims procedures.
No single policy is designed to address all of them. This is not a flaw in the market. It is simply the structure of how risk is transferred, and it means that protecting a superyacht properly requires building a tower of policies that work together rather than assuming one will catch everything.
The cyber buy-back on a Hull and Machinery policy reinstates cover for physical damage caused by a cyber event. Damage to a navigation system, a compromised thruster, a fire triggered by a manipulated HVAC controller. This is the layer most owners have, and it addresses one category of loss. It does not respond to data theft, extortion, reputational harm, or liability arising from a breach of personal information.
A dedicated cyber response policy covers the immediate costs of managing an incident: forensic investigation, legal notification obligations, crisis communications, and some element of system restoration. It is reactive by nature. It funds the response after the event has occurred. What it does not cover is the value of what was lost, the cost of what was compromised, or the liability that flows from personal data belonging to family members, guests, or crew finding its way into the wrong hands.
Ransomware on a superyacht is not a hypothetical. Consider what the environment actually looks like to an attacker who understands it: an owner at anchor off a remote coastline, forty nautical miles from the nearest port, with guests on board and a charter turnaround in three days. Communications degraded. The vessel unwilling to respond to the helm as expected. A demand arriving with a deadline and a threat to release personal material unless it is met. The captain is managing the situation discreetly. The owner has one phone call to make and no clear picture of who is supposed to handle it or what the policy actually authorises.
Standard cyber response policies handle ransomware payments inconsistently, and many exclude them entirely. A dedicated extortion and kidnap and ransom policy with maritime-specific coverage terms handles it properly, with a defined response protocol and pre-authorised consultants who know this environment. Most vessels do not have one.
A superyacht carries data that would be considered extraordinarily sensitive by any standard. The owner's movements, health information, financial conversations, the presence and routines of children on board, the private communications of guests. A breach of that data is not simply a technical event. It is a personal exposure with potentially serious legal consequences, particularly where European data protection law applies or where guests hold citizenship in jurisdictions with aggressive privacy regimes. This category of liability sits entirely outside most cyber response policies and must be addressed separately.
For owners with active business lives, the yacht is often where consequential conversations happen. Deal discussions, board-level matters, information that carries genuine commercial value. If that information is exfiltrated and used, the loss is not a cyber loss in any conventional sense. It is a business loss with a cyber origin, and it will not find easy cover in any of the layers described above unless it has been specifically considered and addressed.
The policy that covers an incident is not necessarily the policy that covers the loss. For a superyacht, they are rarely the same document.
What the tower actually looks like
Building proper cyber insurance for a superyacht is not a matter of adding one policy to another. It requires understanding how the layers interact, where the gaps between them open up, and which losses fall through entirely because they do not fit the defined trigger in any individual policy.
The interaction problems are often more significant than the gaps. A loss that is simultaneously a physical damage event and a data breach can trigger coverage under two policies that both apply exclusions pointing at the other. A ransom payment made under duress can create complications across the Hull policy, the extortion policy, and the data protection liability policy at the same time. These are not edge cases conjured to illustrate a point. They are the natural consequence of applying policies designed in isolation to incidents that do not respect policy boundaries.
The smarter operators are not simply buying more layers. They are having structured conversations with brokers who understand both maritime insurance and cyber risk in genuine depth, mapping the specific risk profile of the vessel against the actual policy language rather than the summary, and identifying in advance which category of loss each layer is responsible for absorbing.
That is a different conversation from the one most owners have had. It takes longer. It requires more preparation on both sides. And it produces a materially different outcome.
The questions your broker should be able to answer
Not all brokers who place yacht insurance have the depth to navigate this well. That is not a criticism. Cyber risk in maritime is genuinely complex, and the intersection of superyacht operations with data protection law, extortion response, and physical damage triggers is a relatively recent combination of specialisms. The right broker has access to all of them. The right conversation tests whether that access is real.
- If a single incident produces physical damage, data loss, and an extortion demand simultaneously, which policy responds first and how do the others interact with it?
- Where does cover for the personal data of family members, guests, and minors on board sit in this structure, and what are the notification obligations if that data is breached?
- When was the policy language last reviewed against the actual systems and data on board this vessel, not the vessel as it was when the policy was first placed?
If the answers require thought, referral, or qualification, that is useful information. It tells you where the work needs to happen before an incident makes it urgent.
Why this is harder than it looks
There is a structural problem in how superyacht insurance is typically placed. The Hull and Machinery policy is renewed on a cycle. The cyber response policy is renewed on a different cycle, often by a different team, sometimes with a different broker. The extortion cover may sit inside a personal lines umbrella arranged for the owner rather than the vessel. The data protection liability may have been addressed as part of a household or family office policy placed years ago.
Nobody has ever sat down and looked at all of them together against the specific risk profile of the yacht as it currently operates. The policies were placed at different times, by different people, in response to different prompts. They were never designed to work as a system because nobody ever designed them as one.
This is not negligence. It is the ordinary consequence of how complex risk gets managed over time: incrementally, reactively, and without a single point of view that holds the whole picture. The result is cover that looks complete until you map it against an actual incident, at which point the overlaps and the gaps both become visible at the same time.
Insurance arranged incrementally over years is not the same as insurance designed for the vessel you are operating now.
How owners who have done this properly approached it
The owners who have addressed this properly share a common approach. They have treated the insurance review not as a renewal conversation but as a risk mapping exercise. They have involved someone who understands the operational reality of the vessel alongside someone who understands the policy language in depth. They have worked through specific scenarios rather than relying on general assurances.
And they have accepted that this is not a one-time exercise. The vessel changes. The people on board change. The nature of what is carried, discussed, and stored on board changes. The threat environment changes. The policy structure that was fit for purpose two years ago may not be fit for purpose today, and the only way to know is to ask the question with current information rather than inherited assumptions.
The broker conversation that ends with "yes, you're covered" is the beginning of the work, not the conclusion of it.
At CyberPlus, we work with owners, captains, and close protection teams who want to understand where cyber and physical risk actually intersects on their vessel, and remove it without disruption or noise.
Part of that work is helping owners and their advisers understand whether the insurance structure in place reflects the actual risk profile of the vessel, and where the gaps are before an incident makes them consequential.
If you'd like to talk, you know where we are.
Nobody told you the cover was incomplete. That is the gap worth closing first.