Practical guide
Ransomware coverage, sublimits and coinsurance explained
Understand ransomware limits, your share of a loss and recovery conditions before comparing cyber insurance quotes. Includes a hypothetical claim calculation.
Updated October 2026. About a 8 minute read.
Key point
A ransomware endorsement can reduce protection far below the headline policy limit. Compare the extortion limit, recovery costs, interruption terms and your share of each covered loss, not just the annual premium.
Respond
Notify the insurer and contain the incident
Check terms
Identify covered costs and event sublimits
Share the loss
Apply the retention and any coinsurance
| Term | What it changes | Question to ask |
|---|---|---|
| Aggregate limit | Maximum available across covered claims | Do response costs erode this limit? |
| Ransomware sublimit | A smaller ceiling for specified losses | Does it cover extortion only or the whole event? |
| Coinsurance | Your percentage of covered loss | What costs share this percentage? |
| Retention | Your initial share under the contract | How does it interact with coinsurance? |
| Interruption waiting period | When eligible outage loss begins | When does the clock start? |
A ransom payment is only part of the problem
Ransomware can leave a small business unable to invoice customers, access records or run its equipment. It can also involve stolen data and threats to publish it. Paying for a decryption key does not remove the cost of investigation, restoring systems or assessing whether people need a breach notice. Travelers describes cyber insurance as covering several different expenses and liabilities. Do not treat the phrase ransomware coverage as a promise that every consequence is insured.
Start with an inventory of what a shutdown would interrupt. A retailer needs its ordering system and payment connections. An accounting firm needs client files and tax software. A software business may need to rebuild its production environment without reintroducing the attacker. These are different recovery problems. Ask the insurer to identify where each expense would sit in the proposed coverage, and whether separate restrictions apply to theft of data without encryption.
Read the endorsement before the headline limit
The aggregate limit on a declaration page is not necessarily the amount available for a ransomware event. An endorsement can apply a smaller limit to cyber extortion, data recovery or every loss arising from a defined ransomware incident. It might also group related attacks into a single event. Request the full endorsement, including its definition of ransomware, rather than accepting a summary in an email or a certificate of insurance.
Ask whether the sublimit is inside the aggregate limit or additional to it. Check whether investigation and legal expenses use up the same pot as an extortion payment. Where separate coverage sections apply, ask how the insurer allocates costs between them. A lower premium is not an equivalent offer when a broad event sublimit removes the recovery protection you expected. Record each answer beside the wording that supports it.
Coinsurance and retention are different costs
A retention generally describes the amount the business bears before insurance responds under the relevant coverage. Coinsurance requires the business to share a specified percentage of a covered loss. A contract can use both. Do not assume the insurer applies them in the order you expect. The wording may determine whether a percentage is calculated before or after a retention and how either amount affects the available limit.
Ask for a written calculation using the quotation being offered. Include response fees, restoration and interruption rather than ransom alone. Ask whether the retained percentage must be paid as costs arise or can be reconciled later. This is a cash planning question as much as a coverage question. Even a covered incident can require money that the business cannot comfortably release while revenue is paused.
Hypothetical worked example: a design agency
This is an invented teaching example, not a reported claim or market quote. Assume a design agency has $120,000 of eligible ransomware response and recovery costs, a $10,000 retention and 20% coinsurance on the remainder. Assume the endorsement applies the retention first and then coinsurance, with enough limit available. The remainder is $110,000. The business pays $22,000 of coinsurance plus the $10,000 retention, or $32,000. The insurer pays $88,000.
Now assume the same contract caps the insurer payment at $50,000 for the event. The business must fund the remaining $70,000 of these assumed eligible costs. Excluded costs would add to its burden. These figures are arithmetic inputs, not evidence of common policy terms. The lesson is to ask how the cap operates in your actual endorsement, especially whether the cap limits payment or the eligible loss before sharing it.
Consent, sanctions and the incident hotline
CISA and the FBI discourage paying ransom because payment does not guarantee recovery and can support further crime. An insurance policy is not permission to make a payment. Cyber extortion wording may require prior approval, an approved negotiator and a legality review. Sanctions restrictions can affect whether a payment is lawful. Get qualified legal advice through the incident response process rather than letting a demand deadline decide the answer.
Keep the insurer hotline somewhere staff can reach without the affected network. Notify the insurer promptly and ask which response providers are approved. Preserve relevant logs and follow the responders' containment instructions. Do not promise a customer reimbursement, hire an unapproved recovery provider or negotiate independently without checking the policy. Necessary emergency action still matters, but the reporting and consent clauses determine how expenses are considered for payment.
What drives the cost up or down
Insurers may view broad remote access, unsupported systems, unclear backup arrangements and a prior incident as reasons to restrict an offer or charge more. Greater interruption exposure can also change the terms. A business that cannot operate without a single server presents a different recovery problem from one with tested alternatives. These are underwriting considerations, not a published formula for a guaranteed premium increase.
CISA recommends strong authentication, useful endpoint monitoring and protected, tested backups. Evidence that these work can support a better underwriting discussion, but it does not establish a fixed discount. Compare premiums as ranges only when the source and coverage assumptions are stated. This guide does not publish a market premium range because a comparable public range for the exact ransomware terms discussed has not been established. Use the calculator as a planning estimate, not a sourced quotation.
A practical renewal review
Ask for competing terms on the same aggregate limit, ransomware limit, retention and coinsurance basis. Include the waiting period for interruption and the time allowed to restore operations. Find out whether supplier outages or an attack on a service provider are included. Ask whether a security control condition applies continuously and what happens if an isolated device lacks the promised protection at the time of an incident.
Keep your application, the evidence supporting it, the final policy and all endorsements together. Tell the insurer about material changes through the agreed process. Revisit your recovery plan when you add a location, change a cloud provider or acquire another business. The aim is not simply to buy the largest limit. It is to make sure the coverage you pay for matches the loss your business could actually face.
Plan your insurance budget
Use the cyber liability cost calculator for a planning range with visible assumptions. It is a model, not an insurer quotation or a guarantee of coverage.
Frequently asked questions
Does cyber insurance always pay a ransom?
No. Cyber extortion cover is subject to its own terms, consent requirements, available limits and legal restrictions. An insurer may fund response or restoration without funding a ransom. Read the endorsement and contact the incident hotline before making commitments.
Is a ransomware sublimit additional coverage?
Not necessarily. It can sit inside the aggregate limit and reduce what is available for specified losses. Ask whether it caps extortion alone, recovery expenses or all costs from the event, and whether defense expenses share it.
Does coinsurance replace the retention?
Not automatically. A policy can include both and define how they interact. Obtain a worked calculation based on the actual wording. The 20% share in this guide is hypothetical and is not a statement about typical market terms.
Are backups enough to remove a restriction?
No control guarantees broader cover. Tested, isolated backups can improve recovery and provide useful evidence to an underwriter. The final ransomware terms still depend on the insurer, your exposure and the other information in the application.
Should we pay to avoid an outage?
Do not decide solely from the demand. CISA and the FBI discourage payment. Notify the insurer, involve qualified responders and obtain legal advice about sanctions and payment legality. Recovery and data exposure still require investigation even if a key is supplied.
Related reading
Sources
These primary sources support the coverage distinctions and operating guidance discussed above. Security guidance is not an insurance contract. Published product descriptions illustrate possible cover, while your issued wording and applicable law control a claim.
- CISA and FBI: StopRansomware Guide. Security controls, incident response and recovery guidance. This is security guidance, not insurance wording.
- NAIC: Cybersecurity insurance. Consumer and regulatory context for cyber insurance and the distinction between business losses and liability.
- Travelers: How does cyber insurance work?. Published insurer explanation of cyber coverage. Your issued policy and endorsements control any claim.
All worked examples are clearly hypothetical. Their dollar amounts and percentages are assumed calculation inputs, not premium benchmarks, reported claims or statistics. No unverified market premium or control discount is presented.