Cyber insurance coverage comparison: one limit row, three meanings

A cyber insurance coverage comparison lines up what several cyber policies or quotes would pay, insuring agreement by insuring agreement: liability for privacy and network security claims, regulatory defense and fines, breach response, cyber extortion, business interruption and funds-transfer fraud, each with its limit, its basis and its retention. It is harder than most lines for three reasons: the same headline limit can be per claim, a sublimit or one aggregate shared with everything; retentions can apply per insuring agreement; and key terms arrive in endorsements listed only by number. Botminds' Insurance Quote Comparison reads every cyber quote and form, records each row's value with its basis and page, and flags the cells that read the same but are not. The grid below shows five quotes for one renewal and the five rows where they differed.

The quotes are the solution's sample case: a fictional brokerage renewing the cyber and privacy cover of a fictional health billing company, Meridale Health Billing Services, with five fictional carriers, for cover from 1 November 2026. The client's requirements come from its customer contracts and its board.

How do you compare cyber insurance policies?

Compare them by insuring agreement, with three facts in every cell: the amount, the basis, and the page that says so. Start with the client's requirements, which in cyber usually come from customer contracts, regulators' expectations and the board's appetite for ransomware risk. Then read each quote's declarations and schedule of insuring agreements, then every form on the forms list, because cyber endorsements change limits, add coinsurance and add exclusions without changing the schedule.

The sample brokerage compares 25 cyber rows in five sections: cost and paper, limits, retentions and claim expenses, cover terms and exclusions, and conditions. The grid above shows the seven that decided this renewal. Every one of the five quotes said $5,000,000 for privacy liability; four meant each claim, one meant a single pot for the whole policy.

Why do cyber insurance quotes differ so much?

Because cyber wording is not standardized, and because carriers manage their exposure through the wording rather than the headline limit. The GAO's review found that “terms commonly used in cyber policies are not consistently defined”, recorded NAIC staff's view that inconsistent policy language might present challenges for the industry, and noted that this ambiguity “can result in misunderstandings and litigation between insurers and policyholders” (GAO-21-477). The same review found insurers had responded to rising ransomware losses by reducing limits for riskier sectors, health care among them, and adding specific limits on ransomware cover.

The last figure matters for comparisons. If nearly two-thirds of cyber policies in force are endorsements on other commercial policies, many clients' existing cyber cover is a few pages inside a package policy, and comparing it with a standalone cyber quote means comparing a short endorsement with a long form, row by row. The rows still apply; many of the answers will be “not stated”.

What is the difference between first party and third party cyber coverage?

First-party cyber cover pays the insured's own losses: breach response, cyber extortion, business interruption, data restoration, funds-transfer fraud. Third-party cover pays claims made against the insured: privacy and network security liability, regulatory defense and penalties, media liability. The distinction matters most where the two share a limit. In the sample case, one carrier's wording keeps them apart, and another's puts them in one pot.

A health billing company's customers do not care how much ransomware cover it has; they care that a privacy claim against it will be paid up to the contract's limit. A shared aggregate cannot promise that, because a first-party loss earlier in the year can use it up. That is why the like-for-like checker in the solution treats separate against shared aggregates as a difference to decide, not a detail.

The not-like-for-like cell, decided: the ranking moves

What are sublimits in cyber insurance?

A sublimit is a smaller limit for one insuring agreement inside the policy limit, and in cyber they are where carriers cap the covers they fear most. In the sample case, three of five quotes sublimited regulatory defense and penalties, at $2,000,000 or $2,500,000 against a $5,000,000 policy; one capped ransomware at half the policy limit, in these words: “Cyber Extortion Loss: USD 2,500,000 sublimit, part of and not in addition to the Policy Limit.” The incumbent's policy carried a $250,000 sublimit for social engineering fraud.

Sublimits are not wrong; they are a price. The comparison's job is to show each one against what the client asked for. The regulatory sublimits met this client's $2,000,000 requirement, which came from a physicians group's business associate agreement; the ransomware sublimit did not meet the board's requirement for full-limit extortion cover.

What is a waiting period in cyber business interruption?

The waiting period is the number of hours an outage must last before business interruption cover starts paying; losses in those first hours stay with the insured. In the sample renewal, the incumbent's quote lengthened it from 8 hours to 10, one of six changes in 22 terms compared with the expiring policy. Two extra hours sounds small. For a business whose systems take payments around the clock, it is two more hours of every outage uninsured, on top of the retention.

The other question is when the clock starts. Some wordings count hours from the start of the outage, others from its discovery, which can be later; the sample brokerage's standard has a setting for exactly this difference, switched off for now. Dependent business interruption, for outages at a provider the insured relies on, is the related row: the same renewal doubled it from $1,000,000 to $2,000,000, the one term that became broader.

Renewal against expiring: 22 terms compared, 6 changed

What is social engineering coverage?

Social engineering cover pays for funds the insured transfers because someone deceived an employee, typically with a false invoice or a spoofed instruction to change bank details. It is often written as a small limit inside a cyber policy, and similar cover can sit in a crime policy, so a comparison should record both where the client buys both. In the sample case the incumbent's $250,000 social engineering limit was unchanged at renewal, inside a $5,000,000 policy. What a comparison should add is any condition attached to the cover, such as verifying a change of payment instructions, because a condition the client did not know about can defeat a claim the limit would otherwise pay.

What controls do cyber insurers require?

The controls carriers ask about map closely onto what regulators expect them to assess, and they arrive as application questions and subjectivities. In the sample quotes they included multi-factor authentication, endpoint detection and response on every endpoint, offline backups tested within six months, and an external vulnerability scan with no critical findings. New York's regulator, in its cyber insurance framework, also expects insurers to help educate producers, who “should have a better understanding of potential cyber exposures, types and scope of cyber coverage offered, and monetary limits in cyber insurance policies” (NY DFS, Insurance Circular Letter No. 2 (2021)).

For the comparison, the point is that controls change which quotes are real. One sample quote required endpoint detection on 100% of endpoints, confirmed in writing before binding, when the client was at 402 of 414 and its quote lapsed on 23 October. How those conditions are tracked, and what happens if one is missed after binding, is covered in insurance quote subjectivities.

Cyber exclusions that move between carriers and years

Exclusions are where cyber quotes diverge most quietly, because they are added by form. Three were material in the sample case: a new exclusion for tracking technologies such as pixels and analytics tags in the incumbent's renewal; an unencrypted device exclusion in one carrier's forms; and the war and state-backed cyber operations exclusion, which has a row of its own in the sample brokerage's standard. War exclusions are the reason this row needs the wording and not a yes or no. In its 2021 review the GAO described the 2017 NotPetya attack: “Some of the insurers paid out the NotPetya claims and others denied the claims by invoking a “war exclusion,” which is common in some policies but had not been applied to cyber incidents” (GAO-21-477).

The practical rule for a comparison: record each exclusion with its form number and page, and compare each carrier's definition, not its title. Two quotes that both “exclude war” can mean different things, and a definition that reaches state-backed operations below the level of war is a different promise from one that does not.

What should a cyber policy comparison include?

Every insuring agreement with its limit and basis, every retention with its basis, the waiting periods, the retroactive date, the exclusions that matter to this client with their forms, the conditions to bind and their dates, and total cost including taxes. The checks below are the ones that most often change the answer.

The same method works for any cyber account, standalone or endorsement, admitted or surplus lines. The general version, without the cyber specifics, is in the insurance quote comparison spreadsheet guide, and the agents that do the reading are described in AI insurance quote comparison. To see the sample cyber renewal end to end, start from Insurance Quote Comparison.

Questions people ask

Why is cyber insurance so hard to compare?

Because its key terms are not consistently defined across carriers, as the GAO found in 2021, and because limits, retentions and exclusions are often changed by endorsements rather than on the schedule. In the sample case four forms changed a term the schedules did not show.

Is a standalone cyber policy better than a cyber endorsement?

Not by definition, but the GAO noted that standalone policies give policyholders “a greater potential for higher cyber-specific limits”, while an endorsement may share the package policy's limits. With nearly two-thirds of cyber policies in force now endorsements, according to the NAIC, the comparison is common and has to be done row by row.

What is a cyber retroactive date?

The date before which events are not covered under a claims-made policy. Keeping the same retroactive date at each renewal preserves prior acts cover; a new carrier offering a retroactive date at inception, as one sample quote did, leaves earlier incidents uncovered.

Does cyber insurance cover ransomware payments?

Many cyber policies include a cyber extortion insuring agreement, but its limit, any coinsurance and the conditions attached vary by carrier. In the sample case the same row ranged from full limit with no coinsurance to a sublimit of half the policy limit, and one carrier added 20% coinsurance above $1,000,000 by endorsement.

How do surplus lines cyber quotes compare with admitted ones?

On wording, the same way; on cost, they add surplus lines tax set by the insured's home state, which the sample brokerage applies at 5%. In Florida, for example, a surplus lines policy must state that its rates and forms are not approved by any Florida regulatory agency, so reading the form matters even more.