Cyber Insurance Comparison

First-party coverage — your own costs: breach response, forensics, data restoration, notification.

First-party covers what you spend on your own recovery; it is the most frequently used part of a cyber policy.

Third-party / liability coverage — claims from others: lawsuits, regulatory defence, PCI assessments.

Third-party covers what others claim from you; the size of these claims is why limits exist.

Business interruption (and system failure) — lost income while systems are down.

BI is often the largest dollar figure in a serious incident, yet the most unevenly covered between carriers.

Ransomware / cyber-extortion — ransom payments, negotiation and the incident around them.

Ransomware is the dominant loss driver; check it is covered in full, not carved out or heavily sublimited.

Social engineering / funds-transfer fraud — fraudulent-instruction and invoice-manipulation loss.

Social-engineering loss is common and is almost always a separate, often small, sublimited coverage.

Dependent / contingent business interruption — loss from a vendor or cloud provider outage.

A single cloud or SaaS outage can take you down without any breach of your own; dependent BI is how that is covered.

Regulatory defence & fines (where insurable), plus PR/reputational costs.

Regulatory action and reputational cost follow many breaches; coverage and insurability vary by jurisdiction.

Ransomware/extortion is at or near the full policy limit, not cut to a small sublimit.

A headline limit means little if ransomware — your most likely large loss — is capped at a fraction of it.

Social-engineering fraud sublimit is high enough for your realistic exposure.

Social-engineering sublimits are frequently low; confirm the cap matches the payments you could be tricked into making.

Business-interruption waiting period (hours before cover starts) is short enough to be useful.

A long waiting period can exclude most short-to-medium outages before BI cover ever engages.

BI indemnity / restoration period is long enough to cover a realistic recovery.

If the indemnity period is shorter than your real recovery time, income loss past that point is uninsured.

Contingent-BI and other sublimits (notification, PR, hardware "bricking") are adequate, not nominal.

The secondary sublimits are where quotes quietly diverge; a nominal sublimit is effectively no cover.

A pre-vetted breach-response / incident-response panel (forensics, legal, PR) is available and strong.

A ready panel gets qualified responders engaged in hours; assembling your own mid-incident costs critical time.

You can use your own choice of counsel / vendors (or add them to the panel) if you need to.

Panel-only policies can force you off trusted advisors; the ability to use your own counsel matters for some buyers.

A 24/7 incident hotline / first-notice-of-loss process exists and is easy to trigger.

The speed and ease of first notice shapes the whole claim; a clear 24/7 route is a real differentiator.

The carrier has a credible claims-paying and responsiveness track record (from your broker / references).

Claims reputation — do they pay fairly and fast — is the single thing you are ultimately buying; ask your broker for references.

The model fits you: in-house IR / active response vs pure reimbursement after you spend.

Some carriers run active, hands-on response; others reimburse. The right model depends on your own IR maturity.

Retention / deductible and any coinsurance are affordable and clearly understood.

The retention is what you pay before cover engages; a low premium with a punishing retention can be the worse deal.

You can genuinely meet and evidence the MFA requirement (incl. remote access, email, privileged accounts).

MFA is the near-universal baseline; a gap between what you warrant and what you deploy is a coverage risk.

You can meet the EDR / endpoint-detection requirement across the required scope.

EDR is increasingly mandatory; confirm the coverage scope they require matches what you have deployed.

You can meet the tested, segregated/immutable backups requirement.

Backups requirements often specify testing and segregation; "we have backups" is not the same as meeting the warranty.

You can meet email-security and other specific control requirements (filtering, training, patching cadence).

Secondary control requirements vary by carrier and can be the deciding factor on eligibility and price.

You can sustain any ongoing monitoring / scanning the carrier runs or requires without surprises.

Some carriers scan you continuously; understand what they look at and how findings affect renewal before you bind.

Premium is reasonable for the limit and breadth actually provided (not just the cheapest number).

Compare premium per dollar of usable limit and coverage breadth; the lowest premium often buys the least cover.

The retention/deductible is affordable at the moment of a real claim.

A retention you cannot comfortably fund mid-incident undermines the whole policy; weigh it against the premium saving.

Bundled services (scanning, training, tabletop, threat intel) add real value you would otherwise buy.

Included services can offset cost — but only count them at the value you would actually have paid for them.

Sublimits and coinsurance do not quietly erode the effective limit you are paying for.

Effective limit = headline limit minus sublimit caps and coinsurance; this is the honest number to compare.

Price stability / renewal terms are predictable enough to plan around (per your broker).

A low first-year premium followed by a steep renewal is a different deal; ask about the renewal trajectory.