Category: Claims Handling

Salvage and Recovery

Also known as: Salvage Recovery, Salvage

Simply put

Salvage and recovery is the process by which an insurer regains some of the money it paid on a claim by taking ownership of the damaged or written-off property and selling or otherwise extracting value from it. For example, after paying for a total-loss item, the insurer may sell the remains to offset the payout. It is a way of reducing the net cost of a settled claim rather than a form of coverage.

Formal definition

Salvage and recovery refers to an insurer's post-settlement process of recouping a portion of a claim payment by realizing residual value from damaged or total-loss property, typically after the insurer takes title to that property upon settling the loss. In practice the insurer sells, disposes of, or otherwise extracts value from the salvaged asset to offset the indemnity paid. The evidence provided defines this concept primarily in the context of property and physical-asset claims (including marine and vehicle salvage) and does not establish its application to cyber-specific or intangible losses; where a term such as 'recovery' is used in resilience contexts it refers to restoring operations rather than recouping claim value, and those meanings should not be conflated. Salvage should also be distinguished from subrogation, which involves an insurer pursuing recovery from a liable third party rather than realizing value from insured property; the evidence here addresses salvage of property, not subrogation.

Why it matters

Salvage and recovery matters because it directly affects the net cost of a settled claim, which in turn influences an insurer's loss experience and, over time, the pricing and availability of coverage. When an insurer can recoup part of a payout by realizing residual value from damaged or total-loss property, the true economic impact of a claim is lower than the gross indemnity paid. For risk managers and brokers analyzing loss runs, understanding that a reported gross loss may be partially offset by salvage helps produce a more accurate picture of an account's performance.

It is important to keep this concept in its proper lane. The evidence establishes salvage and recovery primarily in the context of property and physical-asset claims, including marine and vehicle salvage, where there is a tangible remnant that can be sold or otherwise valued. It does not establish an application to cyber-specific or intangible losses, where there is typically no physical asset to take title to and sell. Professionals working in cyber insurance should not assume that salvage mechanics transfer neatly to data-restoration, business-interruption, or cyber-extortion losses.

Equally important is not conflating salvage with two adjacent ideas. Salvage is distinct from subrogation, in which an insurer pursues a liable third party to recover payment rather than extracting value from the insured property itself. It is also distinct from the resilience sense of 'recovery,' which refers to restoring operations after a disruption rather than recouping claim dollars. Treating these as interchangeable can lead to misreading both coverage outcomes and preparedness metrics.

Who it's relevant to

Insurers and Claims Professionals

Claims teams manage the salvage process directly, deciding whether to take title to damaged or total-loss property and how to realize residual value to offset the indemnity paid. Accurate handling of salvage affects reported net losses and the insurer's overall loss experience.

Risk Managers and Insurance Brokers

When reviewing loss runs and evaluating an account's performance, brokers and risk managers should recognize that a gross claim figure may be partially offset by salvage. Understanding this helps distinguish gross from net losses and supports more accurate assessments of an insured's risk profile.

Resilience and Continuity Planners

For planners, the key point is what salvage is not. The 'recovery' in salvage and recovery concerns recouping claim value from property, not restoring operations after a disruption. Salvage does not reduce the likelihood of an incident and is not a resilience measure, so it should not be counted toward continuity or recovery objectives.

Legal and Compliance Professionals

Because taking title to salvaged property and the resulting rights depend on settlement terms and applicable law, legal and compliance staff have a role in ensuring salvage is handled correctly and kept distinct from subrogation, which involves pursuing a liable third party rather than realizing value from insured property.

Inside Salvage and Recovery

Salvage

The recovery of value from property or assets after an insurer has paid a claim. In the cyber context, the concept is applied more loosely than in traditional property lines, since digital losses often lack physical residual value; it typically refers to any amounts or assets recovered that offset the loss the insurer has indemnified. Whether and how salvage applies depends on the specific policy wording.

Recovery (subrogation)

The insurer's pursuit of amounts from responsible third parties after paying the insured, typically through subrogation rights transferred from the insured under the policy conditions. In cyber claims this may involve action against a negligent vendor, service provider, or other liable party, subject to the wording and applicable law.

Recovered funds

Monies retrieved after a loss event, such as funds clawed back or traced following a fraudulent transfer or social engineering incident. Recovery of such funds may reduce the net indemnifiable loss. Whether a recovery accrues to the insurer, the insured, or is shared depends on policy terms and the order in which the loss and payment occurred.

Allocation of recoveries

The contractual rules governing how recovered amounts are distributed among the insured, the insurer, and sometimes excess carriers, and how they interact with retentions, sublimits, and any uninsured portion of the loss. This is determined by the specific policy language rather than a uniform market standard.

Insured's duty to cooperate

A condition commonly found in policies requiring the insured to assist in and not prejudice recovery efforts, for example by preserving evidence and rights of action against third parties. The precise obligations are set by the policy conditions.

Common questions

Answers to the questions practitioners most commonly ask about Salvage and Recovery.

Does salvage and recovery reduce the loss my cyber policy pays me?

Salvage and recovery generally does not reduce the loss you are paid; rather, it addresses what happens after the insurer has indemnified you. In many policies, once the insurer pays a covered loss, it may pursue recovery from responsible third parties (through subrogation) or realize value from recovered assets. Any amounts recovered typically flow according to the policy's recovery provisions rather than being deducted from your original claim payment. However, the precise allocation of recovered funds depends on the specific policy wording, applicable priority-of-recovery clauses, and jurisdiction.

Is salvage and recovery the same thing as restoring my data or systems after an incident?

No. Salvage and recovery is an insurance concept concerning the disposition of recovered value and the insurer's rights after paying a claim; it is distinct from the technical resilience activity of restoring data or systems. Data restoration and system recovery fall under first-party coverage concepts and operational disaster recovery processes, and they may be governed by recovery time objectives and recovery point objectives. Salvage and recovery, by contrast, deals with recouping value or funds after indemnification and does not itself describe or measure the technical rebuild of your environment.

Who controls the pursuit of salvage or recovery after a claim is paid?

In many policies, once the insurer has paid a covered loss, the right to pursue recovery from responsible parties transfers to the insurer under subrogation provisions, subject to the specific wording. The insured is often required, as a condition, to cooperate and to avoid prejudicing the insurer's recovery rights, for example by not signing waivers that would bar future recovery. Whether the insured retains any control, and how joint recovery efforts are coordinated, depends on the policy conditions and any negotiated endorsements.

How are recovered amounts allocated between the insurer and the insured?

Allocation typically follows the recovery or subrogation provisions in the policy and any applicable priority rules under governing law. Depending on the wording, recovered amounts may first reimburse recovery costs, then compensate the insurer for what it paid, with any surplus potentially returning to the insured, though the order and treatment of uninsured portions, retentions, and sublimits vary. Because approaches differ across insurer forms and jurisdictions, the applicable clause and local law should be reviewed rather than assumed.

What should the insured do to preserve potential recovery rights during and after an incident?

As a practical matter, policies often include conditions requiring the insured to preserve evidence, avoid actions that impair the insurer's rights, and cooperate with recovery efforts. This can include retaining relevant logs and documentation, not releasing or settling with potentially responsible third parties without insurer consent, and notifying the insurer promptly. Failing to meet such conditions precedent may affect coverage or recovery, so the specific policy wording and any cooperation clauses should be consulted.

Can amounts recovered from an extortion payment or ransom be subject to salvage and recovery provisions?

Whether recovered funds, including amounts linked to a cyber extortion payment, fall within salvage and recovery provisions depends on the policy wording and applicable law. Some recoveries may arise from law enforcement action, third-party liability, or asset seizure, and how any such recovered value is treated relative to the insurer's payment is governed by the recovery and subrogation clauses. Because outcomes and legal treatment vary by jurisdiction and by the specific form, this should be assessed case by case rather than assumed to be covered or excluded.

Common misconceptions

Salvage and recovery work the same way in cyber policies as they do in traditional property insurance.

Cyber losses frequently involve data, business interruption, or extortion payments that have no physical residual value to salvage in the traditional sense. Recovery in the cyber context is often oriented toward subrogation against liable third parties or the retrieval of misdirected funds, and how these apply is subject to the specific policy wording and applicable law rather than to property-line conventions.

Any funds recovered after a loss automatically belong to the insured.

Once an insurer has indemnified a loss, it typically holds subrogation or recovery rights, and recovered amounts are allocated according to the policy conditions among the insured, the insurer, and any excess carriers. The distribution, including how it interacts with the retention and any uninsured portion, depends on the specific wording.

Pursuing recovery is solely the insurer's responsibility once a claim is paid.

Policies commonly impose a duty to cooperate on the insured, requiring it to preserve evidence and rights of action and to avoid prejudicing potential recoveries. Failure to meet these conditions can affect the insurer's ability to recover and, depending on the wording, the insured's own position.

Best practices

Review the policy's subrogation, salvage, and recovery-allocation conditions before a loss occurs so the parties understand how recovered amounts will be shared between insured, insurer, and any excess layers.

Preserve evidence and potential rights of action against negligent vendors, service providers, or other third parties, since prejudicing these rights can undermine recovery and may breach the duty to cooperate.

Coordinate early with the insurer and forensic teams when funds have been misdirected, as prompt tracing and clawback efforts can materially affect the amount recovered and the net indemnifiable loss.

Clarify how recoveries interact with the retention, sublimits, and any uninsured portion of the loss, and confirm this understanding in writing given that market practice is not uniform.

Document all recovery efforts and communications to support both the insured's cooperation obligations and any later allocation of recovered amounts.

Confirm the applicable law and jurisdiction governing subrogation and recovery, since these can affect whether and how rights against third parties can be pursued.