Warranty or representation: which one is your application answer?

SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state.

Definition

The two words carry different legal machinery. A representation is a statement of fact made to induce the insurer to enter the contract. If it turns out to be inaccurate, the consequence depends on whether it was material: an immaterial inaccuracy generally has no effect.

A warranty is a promise whose literal truth is made a term of the contract itself. Historically, a breach of warranty could defeat coverage whether or not the point was material and whether or not it had anything to do with the loss. Most US jurisdictions have softened that by statute or case law, commonly by requiring materiality or a causal connection to the loss before a breach has effect.

On US cyber applications, the answers are ordinarily representations. What varies is what the policy then does with them.

How it works in a cyber policy

The label on the form is not what decides this. Three pieces of wording do.

The incorporation clause. If the application is made part of the policy, the answers move from being pre-contractual statements to being contract terms, which is the direction of travel toward warranty-like treatment.

The attestation. Many cyber applications ask the signer to confirm that the statements are true, complete, and accurate and form the basis of the policy. The phrase "form the basis of" is the traditional language for creating a warranty. That attestation is itself an application question, and it is the one most often signed without being read.

Any minimum practices schedule. Where the policy requires the insured to continuously implement the controls the application identified, the answers have become an ongoing obligation, which is closer to a condition than to either label.

State law then applies its own overlay, and this is where the outcome actually gets decided. Several states restrict the effect of a breached warranty to cases where the breach increased the risk or contributed to the loss. Others require a knowing misstatement before a policy can be avoided.

What these two disputes actually show

Neither of the two disputes cited most often in this area turned on the warranty question. Columbia Casualty Co. v. Cottage Health System concerned an application incorporated into the policy through a Risk Control Self Assessment, but ended on a procedural ground with no ruling on the answers. Travelers Property Casualty Co. of America v. International Control Services, Inc. ended by stipulation, so no court characterised those answers as warranties or as representations.

What decides the label in practice is the wording in front of you, not those two files. The full record of both is on the rescission page.

What this means for the answer you are about to sign

For the answers cyber underwriters care most about, the distinction rarely decides anything, because those answers are material almost by definition.

Multi-factor authentication on remote access, immutable backups, and EDR coverage are the controls that determine whether a market will quote at all. An inaccuracy on one of them is material on any reading, so the representation route and the warranty route arrive at the same place. The distinction does real work at the margins, on answers that turn out to be wrong but irrelevant, which is not where the exposure lives.

The operational conclusion is the same under either label. Answer from a reading of the environment rather than from memory, and where the honest answer is partial, say so and let the broker present the plan.

Where the evidence for that answer lives

Under either characterisation, what protects you is a dated record of what was true when you signed. The question library sets out, for each application answer, which part of the answer a live read of Microsoft 365, Entra ID, and Azure can settle and which part rests on an attestation nobody can verify technically.

Frequently asked

Is a cyber insurance application answer a warranty or a representation?

On US cyber applications the answers are ordinarily representations, meaning their legal effect depends on materiality. Policy wording can move them closer to warranties, particularly where the application is incorporated into the policy and the attestation says the statements form the basis of the policy. State law then limits how far that goes, in several states by requiring the breach to have increased the risk or contributed to the loss.

Why does the difference matter?

In principle, an inaccurate representation only matters if it was material, while a breached warranty could matter regardless. In practice, on the controls cyber underwriters treat as conditions of quoting, an inaccurate answer is material on any view, so both routes lead to the same argument.

What does "form the basis of the policy" mean on an application?

It is traditional warranty language. It signals that the statements are not merely inducements to contract but terms the contract is built on. Whether it succeeds in creating a warranty depends on the rest of the wording and on the governing state law.

Does this differ between the main application and the ransomware supplemental?

Not usually. A supplemental is part of the same submission and is normally incorporated on the same terms. Check the incorporation clause rather than assuming, since some carriers handle supplementals separately.

Can the wording be negotiated?

It is a fair thing to raise. Wording on incorporation, on any minimum practices schedule, and on notice periods is sometimes negotiable, particularly at renewal with a clean loss history. Comparing policy terms and negotiating wording are activities for your licensed broker and coverage counsel; SecValley does not advise on the selection, terms, or placement of insurance.

Sources

Every statement about a court case on this page is drawn from the documents and reporting below. Links open on the publisher's own site.

• Columbia Casualty Co. v. Cottage Health System, complaint filed 7 May 2015 (copy via Internet Archive; docket available on PACER and CourtListener) Internet Archive
• Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016) Covington, Inside Privacy
• Travelers, policyholder agree to void current cyber policy (30 August 2022) Insurance Journal
• Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022) Lockton

Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015), refiled as No. 2:16-cv-03759 (C.D. Cal.); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill., stipulated judgment August 2022). Dockets are available on PACER and CourtListener.

Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship.

Related terms

Back to the glossary