Category: Claims Handling

Subrogation

Also known as: subrogation right, right of subrogation

Simply put

Subrogation is the process by which an insurer, after paying a claim to its policyholder, steps into the policyholder's shoes to recover those costs from the party that was actually responsible for the loss. In practical terms, if someone else caused the harm, the insurer can pursue that at-fault party or its insurer to recoup what it paid out. This helps ensure the ultimate cost falls on the responsible party rather than remaining with the insurer or policyholder.

Formal definition

Subrogation is a legal doctrine under which one party assumes another party's (the subrogor's) legal rights to collect debts or damages, typically substituting one creditor for another. In an insurance context, it refers to the insurer's right, arising after it has indemnified an insured for a covered loss, to recover the amounts paid from the responsible third party (or that party's insurer). The insurer effectively stands in the place of the insured to enforce that recovery. In practice, the availability and mechanics of subrogation depend on the specific policy wording, any waiver-of-subrogation provisions, applicable jurisdiction, and the underlying legal rights of the insured against the third party; the doctrine does not itself alter which losses are covered.

Why it matters

Subrogation matters because it determines where the ultimate financial burden of a cyber loss comes to rest. When a cyber insurer pays a first-party claim, such as business interruption or data restoration, the loss may have been caused by a third party, for example a managed service provider, software vendor, or another organization whose failure contributed to the incident. Subrogation gives the insurer a mechanism to pursue that responsible party and recover what it paid, which in turn shapes loss ratios, pricing, and the broader allocation of risk across the market. For policyholders, understanding subrogation clarifies that receiving a claim payment is not always the end of the matter, because the insurer may continue pursuing recovery in the policyholder's name.

The practical significance often turns on waiver-of-subrogation provisions and contracts negotiated before any loss occurs. Organizations frequently agree, in vendor and service contracts, to waive subrogation rights against their counterparties. Because the insurer's recovery right is derivative of the insured's own legal rights against the third party, such waivers can extinguish the insurer's ability to recover, which is why underwriters may scrutinize these arrangements and why risk and legal teams should understand the downstream effect of contractual language.

Subrogation should not be confused with risk mitigation or resilience. It operates after a loss has already occurred and been paid; it does nothing to reduce the likelihood or severity of an incident. It is a recovery and cost-allocation mechanism, subject to the specific policy wording, applicable jurisdiction, and the underlying legal rights the insured holds against the responsible party.

Who it's relevant to

Underwriters and insurers

Subrogation affects an insurer's ability to recover paid losses from responsible third parties, which bears on loss ratios and pricing. Because the recovery right is derivative of the insured's rights, underwriters may examine waiver-of-subrogation provisions and vendor contracts that could limit or extinguish that right.

Risk managers and insurance buyers

Risk managers should understand that a claim payment may be followed by the insurer pursuing recovery in the policyholder's name, and that contractual waivers of subrogation agreed with vendors or partners can affect the insurer's rights. Subrogation is a post-loss cost-allocation mechanism, not a form of risk mitigation or resilience.

Legal and compliance professionals

Legal teams negotiating vendor, service, and technology contracts should recognize that waiver-of-subrogation language can extinguish an insurer's derivative recovery rights. The mechanics of subrogation depend on the specific policy wording, applicable jurisdiction, and the underlying legal rights the insured holds against the third party.

Insurance brokers

Brokers advising clients on cyber programs should flag how subrogation interacts with the client's contractual commitments, since agreements waiving subrogation may become a point of underwriting scrutiny and can shape how a claim is ultimately resolved.

Inside Subrogation

Right of Subrogation

The insurer's right, after paying a covered loss, to step into the insured's position and pursue recovery from a third party whose act or omission caused or contributed to that loss. In cyber claims this may target a negligent vendor, a managed service provider, or another party alleged to bear responsibility, subject to the specific policy wording and applicable law.

Trigger Following Indemnity

Subrogation typically arises only after the insurer has indemnified the insured under first-party coverage (for example business interruption, data restoration, or cyber extortion) or discharged a third-party liability on the insured's behalf. Until payment is made, the recovery right generally remains with the insured rather than the insurer.

Waiver of Subrogation

A contractual provision, often found in vendor or service agreements, by which the insured agrees in advance not to pursue (and by extension may prevent its insurer from pursuing) certain parties. Many policies condition coverage on the insured not impairing subrogation rights, so pre-loss waivers can have coverage consequences depending on the specific wording.

Cooperation and Anti-Prejudice Conditions

Policies commonly include conditions precedent requiring the insured to preserve the insurer's recovery rights and to assist in pursuing them. Actions by the insured that prejudice these rights, such as releasing a responsible third party after a loss, may affect coverage subject to the policy terms and jurisdiction.

Allocation of Recoveries

The framework governing how amounts recovered through subrogation are shared between insurer and insured, which can involve the insured's retention or deductible, uninsured portions of the loss, and recovery costs. The order and method of allocation depend on the specific policy wording and applicable legal rules.

Jurisdictional Variation

Whether and how subrogation operates, including doctrines such as the made-whole rule or anti-subrogation rules, varies by jurisdiction and by policy form. This is a legal and coverage matter and is not a resilience or security control.

Common questions

Answers to the questions practitioners most commonly ask about Subrogation.

Does subrogation mean the insured gets to keep any money recovered from the party that caused the loss?

Not typically. Subrogation transfers the insured's recovery rights against a responsible third party to the insurer after it has paid a claim. In many policies, amounts the insurer recovers first go toward reimbursing what it paid, subject to the specific wording and to how recovery proceeds are allocated. Some policies address the order in which the insured and insurer share recoveries, particularly where the insured has uninsured losses such as a retention, but this depends on the policy language and applicable jurisdiction rather than a universal rule that the insured retains the recovery.

Is subrogation the same as the insurer recovering money directly from the insured?

No. Subrogation runs against a third party who bears responsibility for the loss, not against the insured whom the insurer has indemnified. It is a mechanism for the insurer to step into the insured's shoes to pursue the at-fault party, such as a vendor or service provider whose failure contributed to the incident. Recovery of amounts from the insured itself is a different matter governed by other provisions, such as retentions, deductibles, or rescission for misrepresentation, and should not be confused with subrogation.

What can the insured do to avoid inadvertently defeating the insurer's subrogation rights?

Policies commonly include conditions requiring the insured to preserve subrogation rights and to avoid prejudicing them, for example by not signing releases or waivers with third parties after a loss without the insurer's consent. Subject to the specific wording, an insured that settles with or releases a responsible party may impair the insurer's recovery and potentially affect coverage. Coordinating with the insurer before entering post-loss agreements with vendors or other parties helps preserve these rights.

How do waiver-of-subrogation clauses in vendor contracts interact with a cyber policy?

Contracts signed before a loss, such as agreements with technology vendors or service providers, may contain waivers of subrogation that limit the insurer's ability to pursue that party. Whether such a pre-loss waiver is permitted or affects coverage depends on the policy wording, which sometimes distinguishes waivers agreed before a loss from those agreed after. Risk managers reviewing vendor contracts should identify these clauses and consider how they may interact with the cyber policy's subrogation conditions.

Does subrogation apply differently to first-party and third-party cyber coverages?

The mechanism can arise in both contexts, but the recovery target differs. For first-party losses the insured has suffered, such as business interruption or data restoration costs, the insurer may seek recovery from a third party whose conduct caused those losses. In the third-party liability context, the dynamics are shaped by how the insured's liability to others was established and whether other responsible parties exist. In all cases whether and how subrogation proceeds depends on the specific policy wording and jurisdiction.

What documentation supports a successful subrogation effort after a cyber incident?

Because subrogation depends on establishing a third party's responsibility for the loss, evidence developed during incident response and forensic investigation can be relevant, including records identifying the cause, the responsible party, and the losses paid. Preserving forensic findings, relevant contracts, and communications, and avoiding actions that release potentially responsible parties, supports the insurer's ability to pursue recovery. The value of any subrogation claim ultimately depends on the facts, the applicable law, and the terms of the relevant contracts and policy.

Common misconceptions

Subrogation reduces the insured's own risk of a cyber incident.

Subrogation is a post-loss recovery mechanism for the insurer and does not lower the likelihood or impact of an incident. It is distinct from risk mitigation, and like insurance generally, it does not by itself constitute resilience.

The insurer can pursue a third party at any time once a claim is reported.

Subrogation rights typically arise only after the insurer has indemnified the covered loss. Before payment, the right to pursue a responsible third party generally belongs to the insured, subject to the specific policy wording and applicable law.

Signing a vendor contract with a waiver of subrogation has no effect on the cyber policy.

Because many policies condition coverage on the insured preserving the insurer's recovery rights, a pre-loss waiver or a post-loss release of a responsible party may affect coverage depending on the exact policy conditions and jurisdiction.

Best practices

Review vendor and service contracts for waiver-of-subrogation clauses before signing, and assess their potential effect on cyber policy conditions in consultation with broker and counsel.

Read the policy's subrogation, cooperation, and anti-prejudice conditions carefully to understand what actions could impair recovery rights and potentially affect coverage.

Preserve evidence and avoid releasing or settling with potentially responsible third parties after a loss without first coordinating with the insurer, given that such actions may prejudice subrogation rights.

Clarify in advance how recoveries will be allocated between insurer and insured, including treatment of the retention or deductible and any uninsured portion of the loss, based on the specific policy wording.

Confirm the jurisdiction-specific rules that may apply, such as made-whole or anti-subrogation doctrines, with legal counsel, since these vary by jurisdiction and policy form.

Treat subrogation as a distinct post-loss legal and coverage matter separate from resilience planning, and do not rely on it as a substitute for risk mitigation or continuity measures.