"We carry a million-dollar cyber policy, so we're covered, right?" Owners ask some version of that question at nearly every renewal, and the honest answer is that the number on the declarations page is the most the insurer will ever pay, not what it will pay for the incident you are most likely to have. Your cyber insurance payout gets decided by the clauses beneath that headline limit, and most businesses read them for the first time after a claim is filed.
Our position is a little uncomfortable for anyone who treats insurance as the backstop for everything else: a policy you bought and that remains in force can still pay a fraction of a ransomware loss, entirely according to its terms. Nobody has to deny anything. The sublimit, coinsurance share, retention, waiting period, and exclusion wording each take their cut first, and the business absorbs whatever is left over.
A cyber insurance payout is usually smaller than the policy limit because the loss passes through several reductions before money moves. Ransomware may sit under its own sublimit, a coinsurance clause may leave you paying a share, the retention comes off the top, business interruption only starts after a waiting period, and exclusions can remove whole categories of cost.
None of that means the policy is bad; the coverage summary probably just rounded off the details that matter in a real incident. The rest of this article walks through those details in the order they tend to bite, so you can test your own policy against the incident you actually fear.
Start with the most basic question: does your business own a standalone cyber policy at all, or a cyber endorsement attached to a businessowners or package policy? It matters because endorsements tend to carry modest limits and narrower definitions, and they are far more common than most owners realize.
According to the NAIC's 2025 Report on the Cybersecurity Insurance Market, endorsements made up 55.1% of all cyber policies in force in 2024, while primary standalone policies made up 41.6%. Insurance Journal's October 2026 coverage of the newest NAIC data reports that endorsements were nearly 53% of policies in force in 2025 but only about 4% of cyber premium, which NAIC described as the practice of bundling modest amounts of cyber protection into other commercial lines.
The same NAIC report also shows how often a claim ends without a check. Across all policy types, insurers reported 28,555 cyber claims closed without payment against 9,941 closed with payment. Those figures include claims that fell under the retention, were withdrawn, or never turned into a covered loss, so they are not a denial rate. They do show that filing a claim and getting paid are two very different events.
Ohio businesses have a particularly clear lesson on the endorsement problem. In EMOI Services v. Owners Insurance Co., decided by the Supreme Court of Ohio in December 2022, a medical billing company hit by ransomware paid three bitcoins, about $35,000 at the time, to recover its systems. It then sought reimbursement under the electronic equipment endorsement on its businessowners policy.
The court ruled that the endorsement did not apply because it required direct physical loss of or damage to covered media, and, in the court's words, software "is an intangible item that cannot experience direct physical loss or direct physical damage." The lesson is not about one carrier. It is that coverage language written for property losses rarely maps cleanly onto a cyber incident, and you find that out only when someone reads it carefully under pressure.
A ransomware sublimit caps ransomware-related losses at a figure below the overall limit, and coinsurance makes you pay a fixed percentage of each covered loss yourself. Applied together, they can cut a ransomware recovery to a small share of the declared limit before the retention is even subtracted.
These provisions became widespread during the hard market. Gallagher's February 2022 cyber market conditions report noted that many carriers imposed sublimits and coinsurance specific to ransomware claims, often limiting coverage to 50% of the policy limit or less. Pricing has softened since then, and many policies renewed without those restrictions, but clauses added in 2022 have a way of surviving renewal after renewal because nobody asked to remove them.
One correction to a common misconception: cyber coinsurance generally works as a straight percentage split of the covered loss, such as the insured paying 25% of every dollar. It is not the property-insurance "insure to 80% of value" penalty, and you cannot fix it by raising your limit. The only ways to change it are to negotiate it out or to qualify for better terms through stronger controls.
Here is a hypothetical to make the arithmetic concrete. A business carries a $1 million policy with a $250,000 ransomware sublimit, 25% ransomware coinsurance, and a $25,000 retention, then suffers a $600,000 ransomware loss. The sublimit caps the covered loss at $250,000; after the retention and the 25% coinsurance share, the insurer pays roughly $168,750. The owner who expected a full recovery is now funding more than $430,000 of the incident from operating cash.
Most of the reduction comes from a short list of provisions. The table below shows what each one does and the question to put to your broker in writing.
| Clause | What it does to a payout | Question to ask |
|---|---|---|
| Ransomware or extortion sublimit | Caps ransomware losses below the headline limit | What is the ransomware sublimit as a dollar figure? |
| Coinsurance | Makes you pay a set percentage of each covered loss | Which coverages carry coinsurance, and at what percentage? |
| Retention | Comes off the top before the insurer pays | Is there a separate retention for ransomware or fraud? |
| Business interruption waiting period | Leaves the first hours of downtime uninsured | How many hours, and does the clock start at the attack or at discovery? |
| Funds transfer and social engineering terms | Often a separate, smaller limit or an excluded loss | Is fraudulent payment loss covered, and up to what amount? |
| War and state-backed attack exclusions | Can remove coverage for attacks attributed to a nation-state | How does the policy decide attribution? |
The business interruption waiting period is a time deductible: the policy pays nothing for income lost during the first hours of an outage. Corvus explains that cyber waiting periods are typically 8 to 12 hours in sophisticated markets, that some standard or package forms use 24 hours, and that weak trigger wording can delay when the clock starts. Coalition notes that waiting periods of 10 to 12 hours are common and also lists costs many policies omit, such as losses at third-party vendors and replacement of hardware whose firmware has been corrupted.
For a business whose real exposure is two days of downtime, the waiting period may be a small fraction of the loss. For a dental office or a distributor that loses most of its revenue in the first morning, it can be most of it. That is why recovery speed is not only an IT metric; it decides how much of your interruption loss falls inside or outside the policy.
Exclusions matter most where they intersect with the incidents SMBs actually experience. Fraudulent payment losses frequently sit under their own small limit, which we cover in depth in our look at BEC and deepfake voice fraud insurance gaps. At the larger end of the market, Lloyd's market bulletin Y5381 has required standalone cyber policies written at Lloyd's to exclude losses from qualifying state-backed cyber-attacks since March 31, 2023, with a clear basis for attributing an attack. Newer exclusions are also appearing around AI-related losses, which our AI Lab covers in the new AI exclusion hiding in your insurance policy.
Exclusions are different from claim denials based on what you told the insurer. If your application promised controls that were not actually in place, the problem is the attestation, not the policy wording, and we unpack that risk in the attestation trap behind denied cyber claims. This article assumes the claim is valid and asks a different question: how much of it gets paid.
You close the gap by pricing a realistic incident against your own policy before renewal, then deciding which reductions to negotiate away and which to absorb on purpose. The goal is not to eliminate every retention; it is to make sure the shortfall is a number you chose rather than one you discover.
Two of those steps are financial and three are operational. The contract sets the terms, but your security and recovery posture decide where in those terms an actual incident lands.
When we review a client's cyber coverage, we read it as an incident plan rather than a compliance artifact. We map the policy's sublimits, coinsurance, and waiting periods against the client's real recovery times and revenue exposure, show leadership the projected out-of-pocket number for a ransomware event, and help assemble the control evidence a broker needs to negotiate better terms at renewal.
On the operational side, we work to make the insured loss smaller to begin with: immutable backups with tested restore times, monitored endpoints, and an incident response process that starts the right clocks and documentation from the first hour. Our incident response and policy verification checklist shows how those pieces fit together before a claim, not after.
Before your next renewal, take one realistic ransomware scenario and run it through your actual policy wording, line by line. If the answer is a six-figure shortfall you never planned for, you still have time to negotiate terms, change carriers, or cut your recovery time.
Securafy's business continuity services are built to shorten the downtime that sits inside waiting periods and to give underwriters the recovery evidence that earns better terms.
If you would rather work through your own policy and environment with us, book a strategy call with Securafy and we will show you where your payout is likely to fall short and what it would take to close the gap.