Comparing Cyber Insurance Quotes
Cyber quotes often show the same limit and very different coverage. These are the lines that usually make the difference.
What to Compare.
General meanings only. Terms vary by carrier, and the quote letter and policy wording control.
Ransomware payment terms
Pay on behalf means the insurer pays covered costs directly. Reimbursement means your firm pays first and is paid back for covered amounts.
Compare: Which one each quote uses, and whether ransom payments need the insurer’s consent.
Definition →Breach response inside or outside the limit
Breach response pays for things like forensics, legal advice and notifying affected people. Some policies pay it outside the main limit, so it does not use up the limit you need for other losses.
Compare: Whether breach response is outside the limit, and how large that separate limit is.
Definition →Business interruption and waiting period
Covers income lost when a cyber event takes your systems down. Coverage starts only after the waiting period passes.
Compare: The waiting period in hours, and whether system failures not caused by an attack are included.
Definition →Dependent business interruption
Covers income lost when a vendor you rely on has an outage, such as a cloud or software provider. Some policies also include non-IT vendors.
Compare: Whether IT vendors, non-IT vendors or both are included.
Social engineering and cyber crime
Covers money stolen through fake payment instructions or hacked accounts. These are usually sublimits, often much smaller than the main limit.
Compare: The sublimit for each, the deductible, and any rule to verify payment changes before sending money.
Definition →Client funds and invoice manipulation
Some policies extend crime coverage to client money in your care, or to fake invoices sent to your clients in your name.
Compare: Whether each is included, and at what sublimit.
Definition →Bricking
Covers replacing computer equipment that a cyber event leaves unusable.
Compare: Whether it is included and the limit.
Bodily injury and property damage
Most cyber policies exclude physical injury and damage. A few add a small amount of coverage when a cyber event causes it.
Compare: Whether it is included at all. Many quotes leave it out.
Admitted status and carrier rating
Admitted carriers are licensed in your state and backed by its guaranty fund, within limits. Non-admitted carriers are not, and carry a surplus lines tax.
Compare: Admitted or not, the AM Best rating, and the total with taxes and fees.
Definition →Services that come with the policy
Many carriers include security scans, alerts or advice to help prevent a claim.
Compare: What is included, who provides it, and whether you get reports or a portal.
Before You Choose a Cyber Policy.
Two quotes both say $1M. Aren’t they the same?
Not usually. The headline limit is the most the policy pays in total. What sits inside it, such as sublimits, waiting periods and whether breach response uses up the limit, decides how much you actually get for a given event.
Doesn’t my professional liability cover a hack?
Usually only in narrow ways, if at all. Most professional liability policies are written for errors in your design or advice, not for breaches, ransomware or stolen funds.
Is social engineering covered by cyber or crime insurance?
It depends on the wording. Some losses fall under a cyber policy, some under a crime policy, and some under neither. It is worth reading both together.
Is the cheapest cyber quote the right one?
Sometimes. But a lower price often comes with reimbursement instead of pay on behalf, smaller sublimits or a longer waiting period. Compare those first.
General education only. Not an interpretation of any quote or policy, and not legal advice. Coverage depends on the carrier’s policy wording.
We Shop Several Cyber Carriers and Line Them Up for You.
You see price, limits and the terms above side by side, then choose.
Tell Us About Your Firm. We’ll Tell You What We See.
Starting out or renewing, with a policy in hand or not. If something is worth discussing, we’ll call. If not, we’ll say so.