Practical guide
Cyber insurance retentions and deductibles: how to choose one
Choose a cyber retention your business can fund. Compare loss sharing, waiting periods and cash flow using a clearly hypothetical worked example.
Updated October 2026. About a 8 minute read.
Key point
The right retention is an amount your business can fund during an outage, not simply the option with the lowest premium. Check whether response costs, different coverage sections and repeated claims require separate contributions.
Identify exposure
List response costs and lost operations
Check available cash
Exclude money needed for essential bills
Compare terms
Match the retention to an affordable loss
| Feature | Why it matters | What to request |
|---|---|---|
| Retention or deductible | May change payment and defense arrangements | Exact definition and payment process |
| Separate coverage retentions | An incident can involve multiple sections | How one event is allocated |
| Waiting period | Outage losses may start later | Trigger and duration in the wording |
| Coinsurance | Adds a percentage share of eligible loss | An example of the order of calculation |
| Defense costs | Can affect both cash and available limit | Whether expenses count toward the retention |
Start with what you can afford during an incident
A retention is a share of risk the business agrees to keep. It is not just a pricing lever. During a cyber incident, cash may be needed for staff, rent, alternative systems and specialist advice while sales slow down. A business can have money on its balance sheet that is already committed to essential bills. Choosing a retention from that total can leave the company short when it needs funds most.
Build a practical cash view before comparing quotations. Identify unrestricted funds and expenses that cannot wait. Consider whether your bank facility remains available during an outage and who can authorize payment if email is unavailable. Do not assume insurance reimburses every emergency invoice immediately. Ask about the response and payment process. A cheaper annual premium is not good value if the corresponding loss contribution threatens the business’s ability to recover.
Retention and deductible are not always interchangeable
The terms are sometimes used loosely in discussions, but the policy definition matters. Depending on the contract, a deductible can operate through an insurer paying and recovering your share, while a retention may require the insured to bear costs before the insurer’s obligation attaches. Defense arrangements can differ. Do not assume that either label always determines who appoints counsel or pays the first invoice.
Read the definitions, coverage conditions and schedule together. Ask whether defense and incident response costs count toward your contribution. Check whether the insurer provides access to responders even when the eventual loss stays below the retention. If an adviser describes the terms as equivalent, ask for a written explanation based on the offered wording. NAIC's insurance material supports reviewing actual coverage rather than relying on a broad product name.
One incident can touch several coverage sections
A stolen credential may lead to investigation costs, an interruption loss and a customer claim. A policy can use different retentions for different sections, or a clause may consolidate them when costs arise from the same event. Related claim wording can also connect incidents discovered at different times. Ask how these provisions apply before assuming there is only a single contribution for everything that happened.
Waiting periods create a different kind of exposure. Business interruption may begin only after an eligible outage lasts beyond the specified period. That is not necessarily replaced by paying the monetary retention. Coinsurance can add a further percentage contribution. Request a calculation combining response expenses, interruption and liability, including the sequence of deductions. The answer should reference your policy, not a general example from an unrelated insurer.
Hypothetical worked example: an online retailer
This invented example compares 2 assumed policy options, not published market rates. Both are assumed to cover the same eligible $40,000 incident loss without coinsurance or other restrictions. Option A has a $5,000 retention. Option B has a $15,000 retention and costs $600 less annually. If an eligible loss occurs, the retailer's assumed contribution rises by $10,000 under option B. The insurer payment would be $35,000 under A and $25,000 under B.
The $600 saving does not establish that B is sensible or that this price difference is common. The owner must decide whether another $10,000 could be funded while sales are interrupted. Dividing $10,000 by $600 gives about 16.7 years of assumed premium savings, but this is not a predicted time between claims or an expected value calculation. Real offers, claim probabilities and coverage terms have not been supplied. Use the arithmetic to clarify cash exposure, not to forecast losses.
What drives the cost up or down
All else equal, keeping more risk may reduce the insurer’s expected contribution, but a higher retention does not guarantee a specific reduction. The insurer’s appetite, minimum premium and view of the business can limit the saving. Requested limits, sensitive records, service dependencies and past incidents can also change the quotation. A small price difference may be irrelevant if the more expensive offer provides materially broader response or interruption coverage.
Good security evidence and accurate exposure information can improve the quality of offers you receive. An incomplete application or unresolved control gaps can complicate comparison. This guide does not publish a typical premium range or saving because no like for like public dataset establishes one for these retention choices. Request actual quotations as ranges where appropriate and keep assumptions visible. Do not treat the calculator's planning model as an insurer’s commitment to cover your company.
Choose a contribution you can actually release
Write down an affordable loss contribution using cash that would remain available after essential bills. Then add likely uninsured costs, waiting period exposure and any percentage sharing to the planning exercise. Avoid treating your retention as the maximum possible outlay. Exclusions, limits and unapproved expenses can make the actual contribution much larger. The budget should reflect that a covered event can still hurt liquidity.
Review the choice with whoever manages business cash and the person responsible for recovery. Ask whether a lower retention supports faster decisions or simply changes eventual reimbursement. If the insurer has a panel of approved providers, find out how access works when an incident may fall below the retention. A clear process is valuable regardless of the size of the contribution. Store the decision and its assumptions so renewal discussions have a useful starting point.
Revisit the decision when operations change
A retention that worked for a solo consultancy may be unsuitable after hiring staff or taking on a regulated customer. Conversely, a more established business may be able to bear a larger contribution without disrupting recovery. Recheck cash capacity when payroll, borrowing or major customer concentration changes. There is no universal correct percentage of revenue to retain, and this guide does not invent one.
When switching insurers, compare definitions and not only numbers. Check notification conditions, related claim provisions, approved providers and prior acts terms alongside the retention. Maintain continuous cover where the policy requires it and obtain advice on any reporting gap. Request a final written illustration before binding. The goal is an informed decision about retained risk, not simply choosing the cheapest annual invoice in a comparison table.
Plan your insurance budget
Use the cyber liability cost calculator for a planning range with visible assumptions. It is a model, not an insurer quotation or a guarantee of coverage.
Frequently asked questions
Is the retention my maximum possible loss?
No. It is only the contribution defined by the coverage. Excluded expenses, exhausted limits, waiting periods and coinsurance can increase what you pay. Assess the whole policy and your recovery costs before treating any single number as a worst case.
Will a higher retention always save money?
Not necessarily. Insurer minimum premiums, underwriting appetite and other terms affect the offer. Compare actual quotations on the same basis. No universal saving is verified here, and the $600 difference in the example is an assumed teaching input.
Do legal fees count toward my retention?
The contract decides. Ask whether defense, breach counsel and other response expenses count, who selects providers and when the insurer pays. Different sections can have different arrangements even when they appear in one cyber policy.
Can several retentions apply to one event?
They can, depending on the coverage sections and event aggregation wording. Ask for a calculation that includes response, interruption and liability from the same incident. Do not assume a single claim report automatically means a single retained amount.
Should a startup choose the lowest retention?
Not automatically. Balance the actual premium difference against available cash and policy quality. Early businesses may have limited funds during an outage, but buying a lower retention does not solve exclusions or inadequate limits. Use a business specific cash review.
Related reading
Sources
These primary sources support the coverage distinctions and operating guidance discussed above. Security guidance is not an insurance contract. Published product descriptions illustrate possible cover, while your issued wording and applicable law control a claim.
- NAIC: Cybersecurity insurance. Consumer and regulatory context for cyber insurance and the distinction between business losses and liability.
- Travelers: How does cyber insurance work?. Published insurer explanation of cyber coverage. Your issued policy and endorsements control any claim.
- CISA and FBI: StopRansomware Guide. Security controls, incident response and recovery guidance. This is security guidance, not insurance wording.
All worked examples are clearly hypothetical. Their dollar amounts and percentages are assumed calculation inputs, not premium benchmarks, reported claims or statistics. No unverified market premium or control discount is presented.