Ransomware and cyber insurance: what cover to look for and what insurers expect

When ransomware hits, the first few hours decide how much of the loss your insurer will pay. Most of the rules for those hours sit in your policy wording, agreed long before any attack.

Ransomware cyber insurance can pay for experts, lost income, data recovery and, in some cases, the ransom itself. It also comes with conditions. Miss one, and a covered loss can turn into a dispute. This guide explains the cover to look for, the conditions that matter most, and what insurers expect to see before they offer terms.

What ransomware cyber insurance usually pays for

Ransomware is one event that causes many kinds of loss. Most policies split them into separate covers. Common ones include:

• Incident response. Forensic investigators, lawyers and crisis communications advisors.
• Data and system restoration. The cost to rebuild systems and recover data.
• Business interruption. Income you lose while systems are down, after a waiting period.
• Cyber extortion. Help with negotiation and, where the law allows and the insurer agrees, the payment.
• Privacy and liability. Notifying affected people, dealing with regulators, and claims from customers.

For example, a food manufacturer with 120 staff finds its production planning system locked on a Monday morning. Lines stop. Response costs, restoration and lost income could all sit under different parts of the same policy, each with its own limit and excess. Ask your broker to walk you through how each part of your cyber insurance coverage would respond to that kind of day.

The conditions attached to ransomware cyber insurance

The cover works best when you follow the policy's rules during the attack. Four conditions come up again and again.

The insurer's prior written consent

Extortion cover often needs the insurer's prior written consent before any payment. If a business pays first and asks later, many policies allow the insurer to refuse to repay it.

For example, the owner of a small travel agency panics and pays the criminals from the company account at midnight. Even if the policy includes extortion cover, that payment may fall outside it. Call the insurer first.

Sanctions law

Sanctions laws in many countries forbid payments to certain people, groups and places. If a ransomware group links to a sanctioned party, the law can forbid payment, and no policy can make that payment lawful. Insurers and their advisors run checks before they approve anything.

For example, a retailer agrees in principle to pay and expects funds within hours. The checks take longer, and the answer may be no. Plan your recovery as if payment will never happen.

The insurer's response panel

Many policies ask you to use firms from the insurer's panel: forensic investigators, breach lawyers and negotiators. Some allow your own firms with prior agreement.

For example, a property management company already has an IT provider it trusts. If that provider leads the investigation without the insurer's approval, some policies may limit what they pay for that work. Agree your preferred firms with the insurer at renewal, before you need them.

Early notification

Policies set time limits for telling the insurer, and they vary. Some policies offer special terms for the first 48 or 72 hours of response costs when you call the insurer's hotline straight away. Your wording sets the exact window.

For example, a marketing agency that calls the hotline within the first hour gets panel experts working while evidence is still fresh. Our ransomware first 72 hours checklist and incident notification checklist set out the steps in order.

Ransomware sublimits and coinsurance

With ransomware cyber insurance, the headline limit on your schedule may cover less of a ransomware loss than you expect. Many policies use two tools to manage ransomware risk.

• A sublimit caps ransomware losses at a lower figure inside the main limit.
• Coinsurance means you pay a share of each ransomware loss yourself, and the insurer pays the rest.

For example, a logistics firm sees a large overall limit on its quote and assumes ransomware sits under it in full. The wording then shows a separate, smaller ransomware cap and a coinsurance share. The real cover for its biggest risk turns out much lower than it thought. The size of sublimits and coinsurance varies by insurer and by how strong your controls look, so ask about both before you compare quotes.

What insurers expect before they offer ransomware cover

Underwriters ask detailed questions about ransomware because it drives so many claims. Two areas carry the most weight in most applications.

1. Backups. Insurers want backups that sit apart from the main network, ideally offline or unchangeable, plus a recent restore test that worked. Many ask how long a full restore would take.
2. Multi-factor authentication. Most insurers expect MFA on email, remote access and administrator accounts. Gaps here can lead to higher prices, narrower cover or a decline.

Many applications also ask about endpoint detection, patching speed and who holds administrator rights.

For example, an accounting practice says on its application that it tests restores. The underwriter asks for proof. The practice has none, because nobody wrote the last test down. A short restore test with a dated record would have answered the question. Our backup and restore checklist shows what to record.

PrismX keeps this evidence in one place and tracks when it expires. A restore test counts for six months, so you get a reminder before the proof goes stale.

How to prepare before ransomware hits

Do this work before you compare quotes for ransomware cyber insurance. Most of it takes a week.

1. Read the ransomware parts of your wording: extortion, consent, panel firms, notification and sublimits. Use our policy wording review checklist.
2. Print the insurer's hotline number and your policy number, and keep a copy away from your systems.
3. Name one person to call the insurer and one person to make decisions.
4. Test a restore of a key system and record the date and result.
5. Check MFA on every email account, remote access tool and administrator account.
6. Run a one-hour practice session with your managers, using a simple ransomware story.

Also read about the exclusions that catch businesses out, since unpatched software and dropped controls can affect a ransomware claim too.

Ransomware cyber insurance pays best when you know its conditions and can prove your controls before the attack. If you want your controls and evidence ready for an insurer to review, book a pilot conversation with the PrismX team.