When a cyber incident strikes, most organisations discover two things in quick succession: the damage is worse than expected, and their contracts were not written with this in mind.
Most commercial contracts contain a liability cap that was set by reference to fees, precedent, or negotiating habit, not by reference to what a cyber-attack would actually cost. That mismatch is now generating real financial losses and real disputes. This article explains how to address it.
What is a liability cap?
A liability cap is a contractual ceiling which states the liability that a party is responsible for in the event of consequential or indirect damages. This could be a fixed standard value or a multiple of the fees charged under the contract.
In practice, it is the number that determines how much of your loss you can actually recover, and for many organisations, that number has not kept pace with the scale of modern cyber threats.
When the cap does not cover the damage
A cyber event that could cause a party to unintentionally breach their obligations under the contract requires a liability cap sufficient to prevent extensive financial damage. However, it is not always possible to negotiate a cap which provides adequate protection. On the other hand, a party which suffers due to another party's cyber event should be able to claim reasonable damages under the contract, to cover the damages suffered, which may be significantly higher than the amount the standard liability cap provides.
The numbers make the problem concrete. A report prepared by KPMG in 2025 for the Department for Science, Innovation and Technology (DSIT) sets out the average cost to a UK organisation of different types of cyber attack. Following a scam or fraud cyber-attack, that figure is £2,564,422. For many contracts, that figure comfortably exceeds the liability cap.
For suppliers, an uncapped or very high liability exposure following a cyber event is a genuine business risk. For customers, a cap that falls far short of actual losses leaves them absorbing damage caused by someone else's failure. The answer is not a single standard cap, it is a cap calibrated to the specific risk.
Beyond the anticipated financial losses following a cyber event, organisations must also contend with business interruption, operational downtime and the diversion of management time towards incident response. Cyber incidents are no longer an outlying risk to be managed by a boilerplate clause, they are a near-certain operational reality that demands specific contractual attention.
The UK Government's Cyber security breaches survey 2025/2026 found that 43% of UK businesses reported a cyber security breach or attack in the previous 12 months. Given that not all cyber attacks are reported, this number is likely to be higher in reality. This demonstrates that cyber incidents are no longer a remote possibility but a recurring business risk and therefore should be carefully assessed when drafting contractual liability provisions.
Additionally, liability caps cannot compensate for the damage that the organisation's reputation may face following the cyber-attack and the costs required for an increased marketing presence, new protective software and specialist employee training.
Liability caps under pressure
As cyber incidents increase in both frequency and severity, so too does the litigation they generate. Disputes are arising with greater regularity over what a liability cap actually covers, whether cyber-related losses are caught by it at all, whether they constitute indirect or consequential loss, and whether losses such as business interruption, reputational damage, and regulatory costs fall within its scope. Where contractual language was drafted without cyber risk in mind, those questions rarely have comfortable answers.
It is essential to implement robust strategies to minimise the risk that your organisation may be facing.
Closing the gap before it costs you
There are a number of strategies that can be implemented within an organisation to reduce the risk of devastating loss following a cyber-attack
- Review your existing caps against current cyber cost data
- Negotiate a dedicated cyber super-cap in new and renewing contracts
- Treat cyber insurance as a complement to contractual protection, not a replacement for it
Firstly, start by auditing your existing contracts against current cyber cost data. The DSIT's 2025 report estimated the average cost of a significant cyber-attack on a UK organisation at £2,564,422, pull your current liability caps and measure them against that figure. Where the cap falls materially short, that is a gap that needs addressing, either on renewal or, where the exposure is significant enough, sooner. It is also worth examining how your contracts define recoverable losses: even a cap set at the right level will fail to protect you if business interruption losses, regulatory costs, or reputational damage are excluded as indirect or consequential losses. The cap and the carve-outs need to work together.
Secondly, it is becoming more common for organisations to implement a second, 'super-cap' into their contractual terms increasing the liability cap for damages relating to a cyber event. When negotiating a dedicated cyber event super-cap, organisations should carefully consider the types of losses they are most likely to face relating to their industry, including data recovery costs, business interruption losses, third-party claims, regulatory investigations and incident response expenses. The objective should be to ensure that contractual protections clearly reflect the organisation's actual cyber risk profile rather than relying solely on standard contractual provisions.
Thirdly, alongside enhanced liability caps, cyber insurance plays an important role in a broader risk management strategy. A well-structured policy can cover direct losses, including data recovery, business interruption, and incident response costs, as well as third-party liability claims arising from a breach. It is, however, a financial backstop, not a substitute for contractual clarity or effective security controls. Whilst cyber insurance can assist organisations in managing the consequences of ransomware attacks, data breaches, business interruption losses and legal or regulatory action following an incident, it should be incorporated into your organisation's cyber strategy as one component and not as a substitute for effective cyber security controls.
Cyber threats are not static, and neither should your contractual protections be. Directors should treat cyber risk as a board-level strategic concern: one that requires regular review of liability provisions, updated risk assessments, and incident response plans that have actually been tested, not simply filed.
If this article has highlighted gaps in your organisation's contractual protections or wider cyber strategy, contact a member of our cyber team to discuss how to close those gaps before they are tested.
