What if the last page of your cyber policy deleted the coverage you bought it for?

Cyber insurance is hard to compare because the differences that decide a claim don't live on the price quote. They live in endorsements, sublimits, and definitions — often on the last pages of the policy. This review is the clearest example we've published: the reviewed CFC policy is genuinely strong on breach response and business interruption, and then a one-page endorsement at the back — the Absolute Theft of Funds Exclusion Clause — removes coverage for “theft of money or financial assets in any format, including but not limited to cash, bank notes, electronic currency, customer account balances, and stock or bond certificates.”

There is an important structural reason this happens. CFC's Cyber Proactive Response is a modular, highly customizable policy — its coverage sections are switched on or off at placement based on the insured's industry class. Some classes are offered the full form; for others, specific insuring clauses are removed before the policy is ever issued. In our experience, for the Title Agent and Real Estate Agent & Broker classes, the Cyber Crime coverages — the very sections that respond to wire fraud and theft of funds — are frequently excluded. That is what happened here: the Cyber Crime insuring clause wasn't sublimited or merely conditioned, it was removed for the class before issuance. Which coverage you actually have on this paper depends heavily on how your class was underwritten — one more reason to read your own Declarations closely.

For real estate brokerages, escrow and title companies, and property managers, two differences matter above all the rest. First: whose money is covered. Real estate firms hold other people's money — earnest deposits, security deposits, rent rolls, closing funds. On the reviewed policy, the entire Cyber Crime insuring clause was removed at placement (marked NO COVER GIVEN on the Declarations), and the absolute exclusion was added behind it — naming customer account balances specifically.

Second: who defends you when a client loses her own money. When a bad actor breaches your network or email, reads a client's closing details, and uses that private information to deceive her into wiring her own funds to a fraudulent account, she has a claim against you — because a breach of your systems exposed the information that harmed her. We call this 3rd Party Wire Fraud coverage. The reviewed CFC policy does include a Network Security & Privacy Liability part — but her claim is a claim about stolen funds, and the absolute theft-of-funds exclusion applies to the whole policy.

An honest review cuts both ways, so we say this plainly: in seven of the thirty-four areas we checked, the reviewed CFC policy is stronger than Arch NetSafe® 2.0 — including a $1,000,000 hardware/bricking limit, a shorter business-interruption waiting period, and a longer recovery period. Those rows are marked green in CFC's column below. They are real advantages. They also don't touch the #1 cyber loss in real estate: wire fraud and the theft of funds — where the reviewed policy provides no coverage at all.

The Arch program is shown at a $1,000,000 aggregate limit with a $1,000 deductible. The reviewed CFC policy carries $1,000,000 limits with a $5,000 single aggregate deductible (paid once, then no further deductible that policy year) — a different deductible structure, which we note rather than score. Because these two policies were not issued to the same firm, we compare what actually decides claims — coverage structure, sublimits, conditions, and exclusions — not premium. A green cell marks the stronger coverage; where both cells are green, the policies are comparable. Select any row for the details and why they matter.