Cyber Risk Insurance: What It Covers and What It Skips
Direct answer: Cyber risk insurance covers a business's own costs after an incident (first-party) and claims from others (third-party), up to limits and sublimits in the policy. Insurers commonly ask for proof of basics like MFA, tested backups and patching, and they exclude things like known prior incidents. Read the sublimits and exclusions before you compare prices.
Cyber risk insurance is a policy that helps a business pay for the financial fallout of an incident such as ransomware, a data breach or a business email scam. It does not stop attacks, and it only pays within the limits and conditions you agree to. The details of those limits matter more than the headline coverage amount.
This guide explains what the policy covers, what it commonly leaves out, how insurers judge your security, and how to compare quotes without guessing.
What a cyber policy actually pays for
Most policies split into two parts. First-party coverage pays for your own losses. Third-party coverage pays when someone else blames you for harm.
Wording varies by insurer, but these are the usual building blocks:
Coverage type | What it usually pays for | Side |
|---|---|---|
Incident response | Forensic investigators, breach counsel, a response hotline | First-party |
Notification and monitoring | Letters to affected people, call center, credit monitoring | First-party |
Data restoration | Rebuilding systems and recovering data | First-party |
Business interruption | Lost income and extra costs while systems are down | First-party |
Cyber extortion | Negotiation and, in some policies, ransom payments | First-party |
Funds transfer or social engineering | Money lost to fake invoices or payment fraud | First-party, often sublimited |
Privacy and network liability | Lawsuits and claims after a breach | Third-party |
Regulatory defense | Legal costs and some fines where the law allows insurance | Third-party |
Media liability | Claims over content such as copyright or defamation | Third-party |
Not every policy includes every row. Some add them as optional endorsements, and some cap them at a small amount.
A worked example: how sublimits shrink a payout
The policy limit is not what you will always receive. Here is a made-up example to show the math. The amounts are not real prices and not typical premiums or losses.
*Illustrative amounts, not real prices*
A company has an aggregate limit of 1,000,000 (illustrative), a retention (the deductible) of 25,000 (illustrative) and a sublimit of 250,000 (illustrative) for extortion payments. It suffers a ransomware attack.
*Illustrative amounts, not real prices*
Cost | Amount (illustrative) |
|---|---|
Forensics | 60,000 |
System restoration | 90,000 |
Legal and notification | 70,000 |
Lost income | 80,000 |
Extortion payment | 300,000 |
Total | 600,000 |
The extortion payment is capped at 250,000, so 50,000 of it is not covered. That leaves 550,000 eligible. After the 25,000 retention, the insurer pays 525,000. The company pays 75,000 out of pocket, even though the loss was well under the 1,000,000 limit.
When you compare quotes, look for sublimits on ransomware, social engineering and business interruption first.
What cyber insurance commonly does not cover
Exclusions are where claims get denied. Read these sections line by line:
Known issues. Incidents or weaknesses you knew about before the policy began are often excluded.
Security warranties. If you said you use MFA everywhere and you did not, the insurer may dispute the claim.
Upgrades. Many policies pay to restore systems, not to make them better than before.
War or state-backed attacks. Wording differs a lot here, so ask how the policy treats them.
Physical damage and bodily injury. These usually sit under other policies.
Lost value of intellectual property. Some policies exclude it or treat it narrowly.
Unencrypted or lost devices. Some policies limit claims when a device without encryption goes missing.
Ransom payments need extra care. Whether a policy covers them, and whether you can legally make them, depends on the policy and on sanctions rules. Ask your broker and a lawyer before an incident, not during one.
What insurers check before they quote you
Underwriters commonly send a questionnaire. The answers affect price, limits, and whether you get coverage at all. Typical topics are:
Multi-factor authentication on email, remote access and admin accounts
Backups that are offline or immutable, and tested restores
Endpoint detection and response (EDR) on laptops and servers
A patching process and a way to prove it
An incident response plan someone has actually practiced
Staff training against phishing and payment fraud
Vendor and third-party access controls
Questionnaires often focus on a few common threats: phishing, ransomware, stolen credentials, unpatched software and compromised vendors. Fake login pages make phishing and stolen credentials easier for attackers, which is why insurers ask about MFA. See how AI-generated fake login pages make account takeovers easier.
Collect evidence before you apply
You will answer faster, and more accurately, if you can show the facts. Start with MFA, since it is usually the first questionnaire topic. In your identity provider's admin console, export the MFA enrollment or status report. Check that it lists every user, admin and service account, and save it with the date.
Then collect patching and encryption proof. These commands are examples for a Windows or Linux admin:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-BitLockerVolume
manage-bde -status
lsblk -o NAME,FSTYPE,MOUNTPOINTGet-HotFix lists recently installed Windows updates. Get-BitLockerVolume and manage-bde -status show whether drives are encrypted. On Linux, crypto_LUKS in the FSTYPE column of lsblk means a volume uses disk encryption. Save the output with dates.
Pre-application checklist
Turn on MFA for email, VPN, remote desktop and all admin accounts. Then confirm no exceptions remain in the exported MFA report.
Run a restore test from backup and write down how long it took.
List your critical systems and the maximum downtime you can survive. This sizes business interruption cover.
Count the personal records you hold (customers, employees). This sizes notification costs.
Write a one-page incident plan with phone numbers for your insurer, counsel and IT lead.
Have a second person review the questionnaire before you sign. Wrong answers can hurt a later claim.
How to compare quotes and pick an insurer
There is no single best cyber insurer, because fit depends on your size, industry and security setup. We do not rank providers here. Compare these points instead.
*Illustrative questions, no prices involved*
Question | Why it matters |
|---|---|
What are the sublimits? | They can cut the real payout, as in the example above. |
Is the limit shared or separate for defense costs? | Legal fees may eat into your limit. |
What is the waiting period for business interruption? | A long wait reduces covered income. |
Does it cover social engineering fraud, and up to how much? | This is a common small-business loss. |
Do you get a response team on call? | Early help often matters more than price. |
Can you pick your own vendors? | Panel-only rules may limit choices. |
A broker who handles cyber policies can compare several insurers for you. Ask how they are paid, and ask for the full policy wording, not only a summary.
Skills that make you valuable in this field
Cyber insurance has created demand for people who can turn technical controls into evidence: auditors, security analysts and IT admins who can answer an underwriter's questions. Baseline security knowledge helps. Our CompTIA Security+ study guide is a good free start, and the Cybersecurity certification category lists more options.
If you want analyst-level skills, the CompTIA CySA+ CS0-003 voucher is $224.99 and is delivered by email within 12 hours.
Trend data for this topic comes from Google Trends. Policy terms vary by insurer, so confirm everything against your own policy wording.
Sources
Questions about this topic
Does cyber insurance pay a ransom?
Some policies do, often up to a sublimit, and some exclude it. Sanctions laws can also limit payments. Ask your broker and a lawyer how your policy treats extortion before you ever need it.
Is cyber insurance required by law?
Generally no, though some contracts, lenders or large customers may require it. Check your client agreements. Certain industries also have their own rules, so ask your legal adviser.
Can a small business or freelancer get cyber insurance?
Yes, small businesses commonly buy it, and some insurers offer simplified applications. Smaller firms still get asked about MFA and backups. Coverage limits are often lower, so read the sublimits.
What happens if my application answers were wrong?
The insurer may dispute or deny a claim if a material answer was false, and in some cases may cancel the policy. Verify each answer with evidence before you sign, and update the insurer if your setup changes.
When should I tell my insurer about an incident?
As soon as you suspect one. Many policies require prompt notice and may require you to use approved response vendors. Check the notice clause in your policy and keep the insurer's hotline number handy.
What does "big 4 in cyber security" mean?
It usually refers to the four large professional services firms: Deloitte, PwC, EY and KPMG. They sell cyber advisory services and are not insurers. Some people use the phrase for four security pillars, so check the context.