4 MIN READ
Picture the cyber insurance pitch from two years ago. Carrier sells a $5M policy, the CISO signs it, and the assumption is that a major incident is fully covered. That assumption is breaking. Carriers are now paying out on a minority of claims, and the typical payout lands somewhere between 30 and 50 percent of the requested amount.
The losses that broke the math. The 2024 Change Healthcare breach cost the carrier side about $1.5B in claims paid, by industry estimates. The 2025 Snowflake credential theft cost the carriers around $400M. The 2026 Okta support account compromise cost the carriers another $200M. Three different attacks, the same response across the market: higher premiums, higher deductibles, longer exclusions lists. A carrier that was happy to write a $5M policy at a $250K deductible in 2021 will write the same coverage in 2026 at a $1M deductible, with a 50 percent ransomware sublimit, and a war exclusion that almost any nation state attribution will trigger.
What the policy actually covers
The breach response category pays for the work that has to happen in the first 72 hours of a confirmed incident: the incident response firm (Mandiant, Unit 42, or a regional equivalent), the forensic scope work, the outside legal counsel, the customer notification, and the credit monitoring. A serious incident lands $1M to $5M in this category. The business interruption category pays for the lost revenue and lost margin while systems sit down, typically $2M to $10M depending on the size of the operation. The third party liability category pays for the customers who sue, the partners who claim damages, and the regulators who bring actions. That one runs $5M to $50M on a bad day, and tends to hit the policy limit fastest.
What the policy does not cover
The security program itself sits outside the coverage. The carrier will not pay for the EDR that should have been deployed, the SOC that should have been staffed, or the training that should have been run. Reputational damage is also out, which means the customer churn after a public breach, the stock price drop for public companies, and the executive departures that follow. Regulatory action forms the third gap, and the most painful one. Many policies specifically exclude regulatory fines, and the consent decree and compliance work that follows a serious breach will eat budget faster than the incident itself. The three gaps routinely cost more than the policy pays out, which is the part of the sales pitch nobody mentions.
How to actually use the policy
Read the exclusions before you sign. The acts of war exclusion, the nation state exclusion, the ransomware payment exclusion, all of them read like they will not apply, and all of them read very differently when the claim lands on the desk of a claims handler who has just been told to find a reason to deny it.
Maintain the controls the policy requires. The carrier expects multi factor authentication on every privileged account, working endpoint detection, tested backups, and documented security awareness training. The renewal questionnaire is the trap: it gives the carrier the chance to retroactively decide whether the coverage was valid at the time of the incident.
Treat the policy as a financial backstop, not a substitute for the security program. The contract hedges the worst case; it does not replace the work. The CISO who reads the policy, maintains the controls, and treats the coverage as the backstop is the one who actually collects.
The bottom line
A cyber insurance policy is a financial hedge, not a security program. Read the exclusions, maintain the controls the policy requires, and run the renewal questionnaire like the audit it is. The CISO who treats the policy that way is the one who will actually collect, and not the one explaining a denied claim to the board.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
