Should I Switch Cyber Insurers? Checklist
Switch cyber insurers only if the new quote is at least as good as your current policy on the terms that decide a claim, and you keep continuity: the same retroactive date, no gap between policies, and every known incident notified before expiry. This worksheet puts your current policy and the new quote side by side on 18 terms, checks the switching risks, and gives you a switch, stay or negotiate-first answer with red flags and broker questions. It works for any insurer and runs in your browser.
For each term, mark whether the new quote is better, the same or worse than your current policy. Typing the actual figures is optional; they go into the copied report.
1. Continuity and timing
The risks that only exist because you are switching. A problem here can leave a claim covered by neither policy.
2. Limits and sublimits
The headline limit rarely decides it. The sublimits for the losses you are most likely to have usually do.
- Aggregate policy limit
The most the policy pays in the policy period, across all claims. Check whether defence costs erode it.
- Ransomware and cyber extortion sublimitDeal-breaker if worse
Look for a separate, lower limit for extortion, ransom payment, or ransomware-driven business interruption, and any coinsurance on it.
- Social engineering and funds transfer fraud
Often a small sublimit, sometimes an endorsement you must ask for. Check whether a call-back verification condition applies.
- Business interruption
The limit, what triggers it (a security failure only, or system failure too) and how lost income is measured.
- Dependent / contingent business interruption
Cover when a supplier or cloud provider you depend on goes down. Check which providers count and the sublimit.
- Regulatory fines and penalties (where insurable)
Whether fines are covered "where insurable by law" and whether the regimes you face are in scope. Insurability depends on the jurisdiction.
3. Retention and waiting period
What you pay before the policy pays, in money and in hours of downtime.
- Retention / deductible
Per-claim retention, and any higher retention for ransomware or for a specific type of loss.
- Business interruption waiting period
The hours of outage before business interruption cover starts. A longer wait means you carry more of a short outage.
4. Exclusions and definitions
Two policies with the same limits can cover very different events. Read these clauses in both.
- War and state-backed cyber-attack exclusionDeal-breaker if worse
How the clause defines war and state-backed attacks, how attribution is decided, and whether impact on your systems outside an affected state is carved back.
- Unpatched or known-vulnerability exclusionDeal-breaker if worse
Some wordings exclude or reduce cover when a loss exploits a vulnerability that was public, or had a patch available, for a set time.
- Infrastructure / utility outage exclusion
Excludes failures of power, telecoms, internet or other infrastructure you do not control. Check whether cloud outages are caught by it.
- Other new exclusions or narrower definitions
A narrower "computer system" definition, bricking (hardware replacement), betterment, prior-knowledge wording, or anything the new quote adds that your current policy does not have.
5. Claims, panel and services
How you get help in the first hours of an incident, and what you must do to keep the claim valid.
- Panel vendor requirements (incident response, legal)
Whether you must use the insurer’s panel of incident response firms and breach counsel, and whether your own retainer firm can be pre-approved.
- Claims notification requirements
How soon you must notify, through which channel (hotline, email, broker), and whether costs before notification or consent are covered.
- Pre-loss services
Scanning, training, tabletop or response-planning services included with the policy. Value them only if your team will use them.
6. Underwriting and attestations
A new insurer means a new application. Every answer on it can become a reason to deny a claim.
- Control conditions and warrantiesDeal-breaker if worse
New required controls (MFA, EDR, backups, patching timelines) written as conditions or warranties, and whether a failure voids cover or only reduces it.
7. Premium and terms
Price matters, but only after the cover is like for like.
- Premium (total, with taxes and fees)
Compare the total cost, not the base premium. Add the cost of any endorsement you need to match current cover.
- Payment terms
Annual or instalments, any finance charge, and the return premium if the policy is cancelled early.
General information, not insurance or legal advice. The tool weighs only what you enter; it does not know or rate any insurer. Confirm every term against the policy wording with your broker.
What this tool is
- A side-by-side worksheet: your current cyber policy against a new quote, on 18 terms plus the continuity and timing checks that only matter when you switch.
- Terms covered: aggregate limit, ransomware, social engineering, business interruption and dependent BI sublimits, regulatory fines, retention, waiting period, war, unpatched-vulnerability and infrastructure exclusions, panel vendors, claims notice, pre-loss services, control warranties, premium and payment terms.
- You get a switch, stay or negotiate-first recommendation with the reasons, a list of red flags (such as losing prior-acts cover or a gap between policies) and the questions to ask your broker.
- It is carrier-agnostic: it does not know, rate or rank any insurer. It weighs only what you enter from your own policy and quote.
- Copy the result as a plain-text report for your broker, CFO or board. Runs in your browser; nothing is uploaded.
The full switching checklist
Continuity and timing (check these first)
- Retroactive date and prior acts. Cyber policies are usually claims-made. If the new quote’s retroactive date is later than your current one, a claim made after the switch about earlier events may be covered by neither policy. Ask for the same retroactive date or full prior acts.
- No gap. The new policy should start the moment the current one ends. Check the dates and times on both.
- Known circumstances. Notify the current insurer of anything that could become a claim before it expires. A new policy usually excludes matters you knew about before it started.
- Open claims. An open claim stays with the policy it was made under. Keep cooperating with the current insurer and disclose it on the new application.
- Application answers. A new insurer means a new application. An inaccurate control answer can lead to a denied claim or a rescinded policy.
- Timing. Switching at renewal is simpler than mid-term, where the return premium on cancellation may be reduced. Leave time for underwriting questions and subjectivities, and get the incumbent’s renewal terms in parallel.
Limits and sublimits
- Aggregate policy limit. The most the policy pays in the policy period, across all claims. Check whether defence costs erode it.
- Ransomware and cyber extortion sublimit. Look for a separate, lower limit for extortion, ransom payment, or ransomware-driven business interruption, and any coinsurance on it.
- Social engineering and funds transfer fraud. Often a small sublimit, sometimes an endorsement you must ask for. Check whether a call-back verification condition applies.
- Business interruption. The limit, what triggers it (a security failure only, or system failure too) and how lost income is measured.
- Dependent / contingent business interruption. Cover when a supplier or cloud provider you depend on goes down. Check which providers count and the sublimit.
- Regulatory fines and penalties (where insurable). Whether fines are covered "where insurable by law" and whether the regimes you face are in scope. Insurability depends on the jurisdiction.
Retention and waiting period
- Retention / deductible. Per-claim retention, and any higher retention for ransomware or for a specific type of loss.
- Business interruption waiting period. The hours of outage before business interruption cover starts. A longer wait means you carry more of a short outage.
Exclusions and definitions
- War and state-backed cyber-attack exclusion. How the clause defines war and state-backed attacks, how attribution is decided, and whether impact on your systems outside an affected state is carved back.
- Unpatched or known-vulnerability exclusion. Some wordings exclude or reduce cover when a loss exploits a vulnerability that was public, or had a patch available, for a set time.
- Infrastructure / utility outage exclusion. Excludes failures of power, telecoms, internet or other infrastructure you do not control. Check whether cloud outages are caught by it.
- Other new exclusions or narrower definitions. A narrower "computer system" definition, bricking (hardware replacement), betterment, prior-knowledge wording, or anything the new quote adds that your current policy does not have.
Claims, panel and services
- Panel vendor requirements (incident response, legal). Whether you must use the insurer’s panel of incident response firms and breach counsel, and whether your own retainer firm can be pre-approved.
- Claims notification requirements. How soon you must notify, through which channel (hotline, email, broker), and whether costs before notification or consent are covered.
- Pre-loss services. Scanning, training, tabletop or response-planning services included with the policy. Value them only if your team will use them.
Underwriting and attestations
- Control conditions and warranties. New required controls (MFA, EDR, backups, patching timelines) written as conditions or warranties, and whether a failure voids cover or only reduces it.
Premium and terms
- Premium (total, with taxes and fees). Compare the total cost, not the base premium. Add the cost of any endorsement you need to match current cover.
- Payment terms. Annual or instalments, any finance charge, and the return premium if the policy is cancelled early.
How the recommendation works
Each term carries a weight (1 to 3) for how often it decides a switch. Better adds the weight, worse subtracts it, same and not sure add nothing. The weighted balance runs from -100 (worse on everything you compared) to +100 (better on everything). A balance of +15 or more with no blockers suggests switch. A balance of -15 or less, a quote that is better on nothing, or a cheaper quote with narrower cover suggests stay. Anything in between is negotiate first. Blockers stop a switch whatever the balance: a later retroactive date, a gap between policies, un-notified circumstances, application answers you cannot give truthfully, or a worse ransomware sublimit, war exclusion, unpatched-vulnerability exclusion or control warranty turn a would-be switch into negotiate first, because those are the terms that leave a claim uncovered.
Two exclusions worth reading word by word
War and state-backed cyber attacks. Lloyd’s Market Bulletin Y5381 (17 August 2022) requires standalone cyber-attack policies written at Lloyd’s to carry a state-backed cyber-attack exclusion, in addition to any war exclusion, from 31 March 2023 at inception or renewal. Wordings differ on how attribution is decided and what stays covered, so compare the actual clause in both documents, not just whether one exists. Source: Lloyd’s Market Bulletin Y5381.
Unpatched or known vulnerabilities. Some wordings exclude, sublimit or apply coinsurance to losses that exploit a vulnerability that was publicly known or patchable for a set time. If a quote has one, your patching evidence matters more. CISA’s Known Exploited Vulnerabilities catalog is a sensible list to prove you patch first.
Comparing two named insurers?
Our neutral head-to-heads explain how the insurers’ models differ and what to check on each quote. None of them, and nothing on this page, says one insurer is better or cheaper: that depends on your quotes.
Frequently asked questions
Should I switch from Chubb to Coalition cyber insurance?
Not on the insurer’s name alone, in either direction. Switching makes sense when the new quote matches or beats your current policy on the terms that decide a claim (the ransomware and social engineering sublimits, business interruption, the exclusions, the retention and the control warranties) and when continuity is safe: the same retroactive date or full prior acts, no gap between the policies, and every known circumstance notified to the current insurer before it expires. This checklist works the same way for any pair of insurers. General information, not insurance advice.
How does Coalition compare to my current cyber insurer?
The only reliable comparison is your current policy against the actual quote you receive, term by term. Put the two documents side by side and check limits and sublimits, retention and waiting period, the retroactive date, exclusions (war and state-backed attacks, unpatched vulnerabilities, infrastructure), panel vendor rules, notification requirements and the control answers you would have to warrant. This page does not rate any insurer; it helps you compare the two documents you hold.
Is Coalition cheaper than AIG for cyber insurance?
Nobody can answer that in general. Cyber premiums are quoted for your organisation: industry, revenue, controls, claims history and the limit and retention you choose, and they move with the market. Compare total premium (with taxes, fees and any endorsement you need) only after the cover is like for like. A lower premium that buys a ransomware sublimit, a longer waiting period or a broader exclusion can cost more in a bad year.
How do Coalition and At-Bay compare on claims response time?
There is no reliable public figure that ranks insurers on claims response or settlement speed. What you can compare is in the policy and the quote: how and how quickly you must notify, whether there is a hotline, whether you must use the insurer’s incident response and legal panel, whether your own firms can be pre-approved, and whether costs before notice or consent are covered. Ask your broker for recent claims references for both options.
What is the biggest risk when switching cyber insurers?
Losing continuity. Most cyber policies are written on a claims-made basis, so the retroactive date decides whether something that happened before the new policy started is covered. If the new quote resets that date, or there is a gap between the policies, or you knew about an incident and did not notify the current insurer before expiry, a claim can fall between the two policies. Check those three before comparing price.
What should I ask my broker before switching cyber insurance?
Will the new policy match our current retroactive date or give full prior acts? Do the dates line up with no gap? Which sublimits, exclusions or definitions on the new quote are narrower than on our current policy? Which application answers are warranties or conditions precedent? Must we use the insurer’s panel, and can our own incident response firm be pre-approved? Are there subjectivities to meet before or after binding? The tool builds this list from your answers.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.