Frequently Asked Questions & Actuarial Methodology

Cyber insurance carriers have significantly tightened underwriting standards due to astronomical loss ratios from ransomware and social engineering wire fraud. If your premium surged, underwriters likely identified missing baseline controls or reassessed your industry tier.

• Missing MFA: Lacking phishing-resistant MFA across all remote access, email, and admin logins adds a 30%–50% surcharge.
• No Immutable Backups: If backups are connected to the primary domain without air-gapping, ransomware surcharges apply.
• Increased Revenue/Records: Growth in stored sensitive customer records automatically raises your max probable loss bracket.

Yes, this is one of the most common causes of claim disputes and policy rescissions. In major legal rulings (such as Travelers Property Casualty Co. v. International Control Services), the court ruled that if a policyholder represented on their application that MFA was active across all systems when an un-MFA'd portal caused the breach, the carrier has grounds to rescind the policy and deny the entire payout.

Always perform an automated audit before signing annual underwriting warranty declarations.

While often bundled together for software and IT companies, they protect against completely different perils:

• Tech E&O (Errors & Omissions): Covers you when your product or service fails. Example: A bug in your SaaS platform causes a client's e-commerce store to go down on Black Friday, resulting in lost sales lawsuits.
• Cyber Liability: Covers you when you suffer an external malicious attack or data leak. Example: A hacker breaches your database and leaks 100,000 credit cards, requiring forensics, crisis PR, and regulatory defense.

Setting aside a $50,000 "emergency cyber reserve" is severely insufficient. The initial 72 hours of a cyber breach alone typically costs:

• Digital Forensics Investigation Retainer: $25,000 – $60,000 ($450/hr minimum)
• Privacy Breach Legal Counsel: $15,000 – $35,000
• Mandatory Consumer Notification & Call Centers: $10 – $30 per affected user

According to the National Cyber Security Alliance, over 60% of small organizations go bankrupt within 6 months of an uninsured major cyber incident. Cyber insurance provides an enterprise incident response panel on retainer for a small annual premium ($1,500 – $4,000/yr).

Yes, but under strict legal and regulatory parameters. Carriers maintain contracted specialized crisis negotiation firms that engage threat actors on encrypted communication channels. However:

• OFAC Sanctions Check: US and European law prohibits making ransomware payments to entities on the US Treasury OFAC Specially Designated Nationals list. Carriers must verify the threat actor group before any payment is authorized.
• Sub-Limits and Co-Insurance: Many policies carry a 50% co-pay or sub-limit on ransomware extortion if immutable backups were not maintained.

The "Non-Negotiable Four" required by major admitted carriers (Chubb, Coalition, Travelers, Beazley) include:

• 1. Phishing-Resistant MFA: Enforced on all email, remote desktop, VPN, cloud dashboards, and privileged admin consoles.
• 2. Immutable / Air-Gapped Backups: Offline or WORM-compliant (Write Once, Read Many) backups tested quarterly.
• 3. Endpoint Detection & Response (EDR/MDR): 24/7 endpoint monitoring with centralized SOC telemetry.
• 4. Privileged Access Management (PAM): Removal of local admin rights and just-in-time credential access.

Unlike standard property insurance which uses a flat dollar deductible, cyber business interruption claims use a Time-Based Waiting Period (typically 8, 12, or 24 hours). The policy begins covering lost net revenue and continuing expenses only after the outage exceeds this waiting threshold.

Maintaining a rapid Recovery Time Objective (RTO under 4–6 hours) minimizes out-of-pocket downtime losses before insurance kicks in.

The European Union's NIS2 Directive and DORA (Digital Operational Resilience Act) introduce strict 24-to-72 hour mandatory incident reporting rules and executive personal liability for cybersecurity governance. While policies generally cover legal defense fees for regulatory investigations, deliberate regulatory non-compliance fines may be excluded by law in certain jurisdictions.

For small businesses with under 50 employees and $1M to $5M in annual gross revenue, small business cyber insurance cost averages between $120 and $265 per month ($1,450 to $3,200 annually) for a standard $1,000,000 policy limit and a $10,000 deductible. Early-stage startups and micro-businesses can secure baseline coverage for as low as $95 to $175 per month when verified security controls (such as FIDO2 MFA) are active.

Underwriters use an actuarial rating formula: Annual Premium = [ (Gross ARR × Base Rate Factor) × Industry Multiplier × Record Exposure ] × (1 - Security Control Credits) ± Retention Deductible. You can run an instant, zero-knowledge calculation using our free Cyber Insurance Cost Calculator, which models admitted carrier rate tables in real time.

Over 80% of ransomware intrusions and Business Email Compromise (BEC) wire fraud incidents originate from compromised user credentials. Insurers now apply a mandatory 30% to 50% premium surcharge or outright non-renewal to organizations lacking phishing-resistant Multi-Factor Authentication (MFA) across email, remote access, and administrator consoles.

Purchasing standalone Tech Errors & Omissions (Tech E&O) and Cyber Liability from separate insurance carriers leads to dual-deductible liabilities and coverage disputes during cloud outages. Bundling both policies under a single admitted insurer provides seamless legal defense counsel and yields an immediate 15% to 25% bundled discount on total annual premium costs.