A $5 million cyber policy can still leave you paying for the loss that hurts most. If a cloud provider fails, a fraudulent payment clears, or operations stop for days, the headline limit tells you little about what the insurer will pay.
The useful question is what remains your responsibility. To answer it, you need to read the policy against the way your business operates, not against the sales summary. Start with the losses you could face.
Key takeaways
- A policy limit is not the amount available for every loss. Separate coverage parts can have smaller caps, retentions, waiting periods, and exclusions.
- Vendor outages, payment fraud, ransomware, and lost income may have different triggers. Ask which provision responds to each scenario.
- Notice rules, approved vendors, and security commitments can affect a claim. Your incident plan and renewal answers need to match the policy.
- Put material uninsured exposure in front of leadership before renewal, with an owner and a decision date.
The headline limit isn’t your usable limit
Cyber insurance is a collection of coverage promises. Each promise has its own terms. The declarations page gives you the limit; the endorsements, definitions, exclusions, and claims provisions tell you when that limit is available.
Smaller caps can sit inside a large policy
A $5 million aggregate limit may apply across the policy year, while extortion, payment fraud, or business interruption has a smaller sublimit. That sublimit may be part of the aggregate rather than extra protection.
A retention is the amount you bear before coverage responds. A waiting period can leave the first hours of an outage with your business. Ask your broker to show which limit applies to each major loss and whether several costs draw from the same bucket. Choosing cyber insurance limits based on business risk starts with those distinctions.
Exclusions depend on the wording
The National Association of Insurance Commissioners describes failure-to-maintain-security exclusions as a concern in cyber policies. Its cyber insurance materials also identify war and terrorism exclusions among terms to examine.
Don’t assume a broad exclusion applies to every incident. Don’t assume it cannot apply, either. Have your broker or coverage counsel explain the wording in your policy, including endorsements that change it.
Check what must happen before coverage responds
A loss can be expensive and still fall outside a particular coverage part. You need to know the defined event that activates it and the evidence required to connect that event to your costs.
Your costs and other people’s claims differ
First-party coverage may address your own response, restoration, notification, and lost income. Third-party coverage may address claims brought by customers or partners. A single breach can involve both, but one limit or condition won’t necessarily cover every resulting bill.
Regulatory investigations raise another question. Defense costs, fines, and penalties may be treated differently, and the law may restrict what can be insured. Ask which expenses are covered in the places where you operate.
Payment fraud may need its own provision
A compromised account and a convincing impersonation email can lead to the same financial loss. The policy may treat them differently. Social engineering and funds-transfer fraud may require an endorsement, a separate cap, or specified payment-approval procedures.
Ask a direct question: if an employee authorizes a payment after receiving fraudulent instructions, which coverage provision responds? Get the answer in writing. A general promise of “cybercrime coverage” doesn’t settle the trigger, limit, or conditions.
Vendor outages can expose an operational gap
Your systems may be healthy while your business cannot take payments, process payroll, ship orders, or serve customers. That distinction matters to a policy written around defined systems and covered events.
Name the services your revenue depends on
Check whether dependent business interruption applies to the cloud, payment, hosting, logistics, or software providers you rely on. Then check what must happen at that provider for coverage to respond. A service failure and a covered cyber event are not necessarily the same thing.
Your critical vendor risk oversight should identify those dependencies before an insurer asks about them. Vendor due diligence and contracts also matter when insurance leaves part of the loss with you.
Lost income needs a clear calculation
Read the waiting period, the period of restoration, and the definition of lost income. Finance and operations should be able to separate incident-related loss from an existing sales decline or another operational problem.
Keep the records you would need: orders, sales, shipment volumes, payroll, and a timeline of the disruption. If a provider outage stops service but doesn’t meet the policy trigger, strong financial records alone won’t create coverage. They will help you understand the exposure you retained.
Ransomware tests the policy and your response plan
An extortion event can create several bills at once: investigators, lawyers, recovery work, lost income, customer communication, and possibly a ransom demand. Those costs may fall under different terms.
Confirm notice and consent before pressure arrives
Find the notice requirement, the insurer’s emergency contact, and any rules for selecting counsel, investigators, or negotiators. Check when written consent is needed before you incur costs or make a payment.
Lloyd’s guidance on handling ransomware claims discusses due diligence and specialist vendors. It is guidance to insurers, not a statement of your policy terms. Your team needs the instructions in its own contract and incident plan.
Backups change the loss, not the contract
CISA recommends offline, encrypted backups of critical data and regular recovery testing in its ransomware prevention guide. A backup that has never been restored in a test is an assumption, not a recovery time you can defend.
Compare your actual restore capability with the downtime your policy covers. Make sure someone owns insurer notification while technical teams contain the event. Clear ownership of incident response matters when decisions cannot wait for the next meeting.
Renewal answers must match operating reality
Pull last year’s application before you review this year’s price. Compare its answers with current access controls, backups, endpoint coverage, major vendors, and business units. An acquisition, new cloud platform, or change in how administrators work may make an old answer unreliable.
Ask the people who operate each control to verify it. Can they show that multifactor authentication covers the accounts described? When was the last successful restore test? Which systems fall outside the endpoint inventory? A written policy isn’t proof that a control works across the business.
Record gaps before submitting renewal answers. Your broker and coverage counsel can help you address changes in policy language. You still need an accountable executive to resolve the operational facts. A lower premium is a poor trade if it comes with a narrower trigger or a larger loss you must fund yourself.
Build a coverage map around business losses
You don’t need to turn the CEO into a claims specialist. You do need a short record that connects likely losses to policy terms and operating owners. Use the full policy and endorsements, not the quote alone.
Start with these questions:
| Business scenario | Policy question | Evidence and owner |
|---|---|---|
| Ransomware stops operations | Which response and interruption limits apply? | Restore tests, incident timeline; technology and operations |
| A payment provider fails | Does dependent interruption cover this provider and event? | Vendor inventory, transaction records; operations and finance |
| An employee sends a fraudulent payment | Which fraud provision and approval conditions apply? | Payment controls, authorization records; finance |
| Customer data is exposed | Which response costs and third-party claims are covered? | Data inventory, incident records; legal and technology |
For each row, add the trigger, sublimit, retention, waiting period, exclusion, notice rule, and likely uninsured amount. The CEO guide to cyber coverage gaps offers a fuller way to organize that review.
Ask your broker to confirm uncertain answers in writing. Then test the map against your incident plan and vendor list. The gaps that matter are the ones between a covered event, the loss you could suffer, and the actions your team can carry out under pressure.
Give the board a decision, not a policy summary
Board cybersecurity reporting should show a small number of credible scenarios: likely business effect, expected recovery time, potential insurance response, and the loss you may retain. It should also show who owns the next decision.
Your cyber risk appetite matters here. Leadership may accept a retention it can fund, while rejecting several days of uncovered customer-facing downtime. Those are business choices. A policy limit alone cannot make them.
Use board-ready cyber risk reporting to make material gaps visible before renewal. If the policy needs a change, the control needs work, or the business accepts the exposure, record that decision and its owner.
Frequently asked questions
Does a $5 million cyber policy cover a $5 million loss?
Not necessarily. The relevant coverage part may have a smaller sublimit, a retention, a waiting period, or an exclusion. Several costs from one event may also share an aggregate limit. Check the actual wording against the type of loss you face.
Will cyber insurance pay if a cloud provider goes down?
It might. Dependent business interruption depends on how the policy defines covered providers, events, systems, and income loss. Ask about your named critical services rather than assuming all cloud outages receive the same treatment.
Can a security control gap affect a claim?
It can, depending on the policy, the statements made to the insurer, applicable law, and the facts of the incident. Verify application answers with the people responsible for the controls. Raise material discrepancies with your broker and coverage counsel before renewal.
Who should lead the policy review?
Give one executive ownership of the business scenarios and decisions. Finance, legal, operations, and technology should supply the facts. Your broker and coverage counsel should explain policy terms. That division keeps insurance questions tied to real operating risk.
Make the gap visible before an incident
The most costly surprise may be a smaller cap, a narrow trigger, or a response condition nobody knew about. Usable coverage depends on both the contract and the business you operate.
Take your largest loss scenarios to the policy, then assign owners to the gaps. You’ll have a clearer renewal conversation and a better chance of making confident decisions when time is short.