The short answer
Cyber policies may provide first-party incident response and loss coverage as well as defense or liability coverage for specified third-party claims. Ransomware, business interruption and privacy terms vary. Compare covered events, conditions, exclusions and sublimits—not just the headline limit. Premium ranges below are illustrative budgets.
Use this guide to prepare questions, not to establish coverage. Any unsourced costs, limits or timing ranges are illustrative planning examples, not quotes, verified market averages or carrier commitments.
What cyber insurance covers
| Coverage part | Pays for |
|---|---|
| Breach response | Forensics, legal counsel, notification, credit monitoring |
| Cyber extortion | Ransomware response and, where legal, payments |
| Business interruption | Your lost income after a waiting period |
| Data restoration | Rebuilding systems and data |
| Network security and privacy liability | Claims from customers and individuals after a breach |
| Regulatory defense | Investigations, and fines where insurable |
The first four are first-party coverages, your own costs. The last two are third-party coverages, claims against you.
Common cyber exclusions
- Incidents known before the policy started
- War and attacks on critical infrastructure, per the policy’s wording
- Upgrades beyond restoring what you had
- Failure to keep required controls, such as MFA, on some policies
- Wire fraud losses, unless social engineering coverage is added; see fiduciary and crime coverage
What underwriters require before quoting cyber
Multi-factor authentication on email, remote access and admin accounts is the baseline. Expect questions about endpoint detection, offline backups, patching and phishing training. Missing MFA is the most common reason for a decline or a ransomware exclusion. StartupInsurance.ai helps you present your controls so underwriters quote full terms.
Limits, sublimits and how fast you can get it
Companies with little sensitive data often start at $1M; enterprise contracts and large PII volumes push limits to $3M to $5M. Check sublimits for ransomware and social engineering before you certify a limit to a customer. Timelines and sublimits are in how to build a $5M Tech E&O and cyber program. Platforms hosting user content should also see media liability for user content and ads, and the E&O side is in Tech E&O coverage for startups. Terms are in the startup insurance glossary.
Get a contract check
Send us your security controls summary or a customer’s cyber requirement. We provide an initial written review within one business day after receiving the necessary information, with questions and next steps. Carrier quotes, coverage decisions and policy changes may take longer. Get a free contract check.
A few more answers
Frequently asked questions
Does cyber insurance pay ransoms?
Many policies can, where payment is legal. Payments to sanctioned parties are prohibited, and carriers require their approval and panel vendors first. Many startups never pay; restoring from backups is cheaper.
What is a cyber insurance sublimit?
A smaller cap inside the policy limit for one type of loss, such as ransomware or social engineering. A $1M policy with a $250,000 ransomware sublimit pays at most $250,000 for ransomware.
Does cyber insurance cover a breach at our cloud provider?
Partly. Your notification duties and lost income may be covered, often under dependent business interruption with a sublimit. Claims against the provider itself are its own matter.
Is social engineering fraud covered by cyber or crime insurance?
Either can cover it, by endorsement, and usually with a sublimit. Make sure one policy does, and that the two don't leave a gap for fake invoice and wire instructions.
Does cyber insurance cover regulatory fines?
Where the law allows them to be insured. Many policies cover regulatory defense and insurable fines, and some cover payment card industry assessments. Insurability varies by state and country.
General information, not a coverage determination or legal advice. Unless a specific source is identified, prices and timing ranges are illustrative planning examples—not measured market averages, quotes or guarantees. Policy wording, carrier, state and your company’s operations determine what applies.