CyberCare 2.0

Target Market Determination

Purpose of this Target Market Determination

This Target Market Determination (TMD) is designed to provide customers, distributors and Agile Underwriting Services staff with appropriate information to understand who this product has been designed for, and to describe our approach to determining that the product is likely to be consistent with the objectives, financial situation and needs of the class of consumers for whom it is intended, together with the conditions that apply to its distribution.

In this document the terms “we”, “us” or “our” refer to Agile Underwriting Services Pty Ltd (ABN 48 607 908 243, AFSL 483374) acting on behalf of certain Underwriters at Lloyd’s. This TMD is not a substitute for the terms and conditions of the product. Consumers and distributors should refer to the CyberCare 2.0 Policy Wording and Product Disclosure Statement and the Policy Schedule for the full terms, conditions, limits and exclusions of cover.

Product

Name of product / product category

CyberCare 2.0. Agile’s CyberCare 2.0 product provides insurance for cyber risks.

This Target Market Determination applies to CyberCare 2.0 Insurance, issued under the CyberCare 2.0 Policy Wording and Product Disclosure Statement. The target market for the product is set out in the Appendix to this document.

Class of consumers comprising the target market

CyberCare 2.0 has been designed for commercial businesses domiciled in Australia that hold, process or rely on data or computer systems in the course of their operations and that want to protect against the financial and liability consequences of cyber incidents, including privacy and security breaches, cyber crime, business interruption and associated response costs.

The product is designed for businesses operating in the industries within our underwriting appetite. Appetite includes, but is not limited to, the following:

Acceptance is subject to Agile’s underwriting acceptance criteria. The product is not designed for consumers who fall outside these criteria, or who require cover for the matters excluded under the policy. See the Appendix and “Key acceptance criteria” below.

Key product attributes

CyberCare 2.0 is arranged around five pillars of cover. The summary below is a general description only. Each benefit applies only if selected and shown on the Policy Schedule, and is subject to the applicable limits, sub-limits, excesses, terms and exclusions set out in CyberCare 2.0.

1. Liability

• Privacy and security liability.
• Media liability.
• Regulatory proceedings, fines and penalties (where insurable at law), with “Regulatory Proceeding” broadly defined to include an investigation.

2. Breach Response

• Breach notification costs.
• Computer and legal experts costs.
• Public relations costs.
• Data restoration costs.
• Cyber extortion.
• Security improvements and rewards.

3. Cyber Crime

• Computer fraud.
• Funds transfer and social engineering fraud, including fraudulent impersonation, invoice manipulation and vendor payment fraud.
• Telecom fraud and cryptojacking.

4. Business Loss

• Business interruption, with an 8-hour waiting period and a 365-day indemnity period, including cover for system failure and voluntary shutdown.
• Reputation harm.
• Dependent business interruption – IT provider, including outages caused by IT provider system failure.
• Dependent business interruption – non-IT provider.

5. Additional Benefits

• Initial Breach Response Excess Waiver — no excess applies to Computer and Legal Experts Costs incurred under Insuring Clause 1.5 within the first 48 hours following discovery of an actual or suspected breach or cyber extortion threat (Clause 1.18).
• Bodily injury arising from a covered privacy, security or media act (Clause 1.19).
• First party property damage caused by a security breach (Clause 1.20).
• Goodwill coupons, extended reporting periods, and an express artificial intelligence clause so that cover is not excluded simply because a breach or fraudulent instruction was made or facilitated using AI or deepfake technology.

Every CyberCare 2.0 policy also includes access to a 24/7/365 cyber incident hotline. Full details of all benefits, limits and conditions are set out in CyberCare 2.0.

Key exclusions

The product is not suitable for consumers seeking cover for losses arising from the matters excluded under the policy. The main exclusions include (this is a summary only — refer to Section 2 of CyberCare 2.0 for the complete list and their carve-outs):

• Criminal, dishonest, fraudulent or malicious acts of the insured (as defined).
• Pollution.
• Property damage and bodily injury, except where expressly covered under the Additional Benefits.
• Failure or interruption of infrastructure and utilities not under the insured’s control.
• War and certain cyber operations.
• Liability assumed under contract, except as provided in the policy.
• Intellectual property infringement and prior known circumstances.
• Claims made or brought in, or under the laws of, the United States of America.

Key acceptance criteria

Agile makes risk-based decisions about the cover that can be offered. This policy can only be purchased by customers domiciled in Australia. Key acceptance criteria relevant to this target market determination may include:

• Total annual revenue.
• Activities undertaken during the period of cover, and whether they fall within appetite.
• Previous claims experience for this type of risk.
• The benefit and/or sum insured limits sought.
• Location (the insured must be domiciled in Australia).
• IT Security and privacy controls.

Distribution of this product

This product is issued by Agile Underwriting Services Pty Ltd (ABN 48 607 908 243, AFSL 483374) on behalf of certain Underwriters at Lloyd’s, and is designed to be distributed via:

• Insurance brokers and their representatives who hold an Australian Financial Services Licence, via the Powered by Agile broker portal.

Distribution conditions

Only insurance brokers and their representatives are authorised to distribute this product, as they understand the class of consumers for whom it has been designed. Distributors must take reasonable steps to ensure the product is distributed in a manner consistent with this TMD, and must apply Agile’s acceptance criteria. These conditions make it likely that consumers who acquire the product are within the target market, because distribution is limited to licensed professionals applying defined acceptance criteria to businesses within appetite.

Reviewing this document

We will review this TMD within one year of the effective date, and thereafter every 12 months, to ensure it remains appropriate and consistent with the objectives, financial situation and needs of the target market.

We will also review this TMD if any event or circumstance (a “review trigger”) occurs that would reasonably suggest the determination is no longer appropriate, including:

• A material change to the cover provided by the product.
• A change in our acceptance criteria that affects the suitability of the product for the target market.
• A material change to the distribution of the product.
• The discovery of a relevant and material deficiency in the product’s disclosure documentation.
• Systemic complaints or claims issues indicating the product is no longer suitable for the described target market.
• Material and relevant reductions in key product suitability metrics such as customer satisfaction, product acceptance, financial performance, benefits to customers, and product value and affordability.

We will review this TMD within 10 business days of the occurrence of any review trigger.

Reporting

We record all complaints received about this product on a weekly basis (the Complaints Reporting Period). Our distributors are required to provide us with written details of any complaints about the product received during the Complaints Reporting Period within 10 business days of the end of the period.

Distributors and their representatives are also required to report to us if they become aware of a significant dealing in this product that is not consistent with this TMD, within 10 business days of becoming aware of the dealing.

If complaints are systemic and indicate that the product is no longer suitable for the described target market, we will review and update the TMD within the timeframe indicated above.

Record keeping

We will maintain records of the reasonable steps we have taken to ensure this product is sold in a manner consistent with this TMD. We will also prepare and maintain complete and accurate records of our decisions, and the reasons for them, in relation to all target market determinations for this product, the identification and tracking of review triggers, the setting of review periods, and any other matters documented in this TMD.

Appendix – Suitability

CyberCare 2.0 has been designed for commercial businesses domiciled in Australia that want to protect against the financial and liability consequences of cyber incidents. The product is subject to the acceptance criteria. A summary of the target market and of key benefits and exclusions is set out below. For the complete schedule of benefits and exclusions, refer to CyberCare 2.0.