Cyber insurance is a policy that pays part of what a cyber incident costs: forensic investigation, system recovery, the time operations were down, notification of affected individuals, and claims from those who were harmed. It does not prevent the attack. It splits the bill.
That is the most common confusion. A firewall reduces the likelihood that something happens. A policy reduces what it costs you when it does. They are two different layers and neither replaces the other, although when you buy a policy you will find that the insurer looks closely at the first before selling you the second.
The numbers explain why the product got serious. According to Coalition's 2026 claims report, the initial ransom demand rose 47% last year and ransomware is still the costliest claim, with an average loss of $269,000. There is a third figure almost nobody mentions that is worth keeping handy: 64% of claims closed in 2025 were resolved without the policyholder paying out of pocket.
In Mexico, the starting point is different. According to data from the Asociación Mexicana de Instituciones de Seguros (Mexican Association of Insurance Institutions), only 17% of SMBs have any type of insurance. The conversation about cyber insurance is therefore arriving in a market that is still debating whether to insure the warehouse.
What does cyber insurance cover?
Almost every policy is split into two halves, and it is worth knowing which of the two you are buying.
The first is first-party damage, what the incident costs you:
- Incident response: forensic investigation, containment, legal counsel, and crisis communications.
- Data and system recovery, including rebuilding whatever was encrypted or deleted.
- Business interruption, meaning what you stopped earning while operations were down.
- Cyber extortion: negotiation with the attacker and, in some policies and always with prior authorization, payment of the ransom.
- Notifying data subjects and subsequently monitoring their identities.
- Administrative fines, where the country's legislation allows them to be insured.
The second half is third-party liability, what the incident costs others and what they claim from you: lawsuits from customers or partners whose data was leaked, legal defense costs, liability for digital content, and card brand penalties if you process payments.
Many small policies cover the first half well and very little of the second. If your business holds customer data, the second half is precisely the one that can bankrupt you.
What does it not cover?
Exclusions are the part of the contract nobody reads and the only part argued over on the day of the claim. These are the ones that almost always appear.
| What is usually left out | What it means in practice |
|---|---|
| Acts of war and state operations | If the attack is attributed to a state actor, the insurer can invoke this clause. It has been the most debated exclusion in the industry since NotPetya. |
| Unsupported systems | Servers or applications the vendor no longer updates. If the incident came in through there, a dispute is guaranteed. |
| Known, unpatched vulnerabilities | The flaw was public, the patch existed, and nobody applied it within a reasonable timeframe. |
| System upgrades | The policy pays to return to the previous state, not to leave the infrastructure better than it was. |
| Funds transfer fraud | It is usually covered, but with a sublimit far below the policy limit. That is the number worth looking at, not the one on the cover page. |
| Reputational damage and lost customers | The sales you lose the following year because the news got out are not compensated. |
| Incidents prior to the policy | If the attacker was already inside when you signed, it is a prior act and is not covered. |
That last point is more common than it seems. When an attacker's dwell time is measured in weeks or months, the actual date of the incident and the date you found out do not match, and the forensic investigation decides which one counts. That is why detection time is also an insurance matter.
What will they ask for before issuing it?
Until a few years ago, cyber insurance was sold with almost no questions. Then came the years of high loss ratios, insurers lost money, and the questionnaire became a technical exam. Today, if you cannot check most of these boxes, either you do not get a quote or you get one with a price and exclusions that make the policy of little use.
And there is a fundamental shift worth understanding before you sign. The question is no longer whether you have the control but whether you can prove it was working on the day of the incident. A screenshot of the console, the applied policy, the date of the last restore test. The companies that get better terms are not the ones that say yes to everything: they are the ones that show the evidence without having to prepare it.
Why can payment be denied?
Cyber insurance pays, and it pays more often than hallway conversation suggests. But when it does not pay, it is almost always for one of these four reasons.
Because what was declared does not match reality. Someone answered the questionnaire with the best of intentions, stated that every remote access point had two-factor authentication, and it turned out three servers did not. That questionnaire is part of the contract: if the information is false, the insurer can reduce the payout or void the policy. There is almost never bad faith, just a company that answered from memory.
Because the control existed, but not where the attack happened. This is the subtle variant of the previous one and the most frequent. The control was on 90% of the fleet and the attacker got in through the remaining 10%, which is usually the old server nobody wanted to touch.
Because an exclusion applies. Those in the table above, especially unsupported systems and known unpatched vulnerabilities.
Because you did not follow the procedure. This is the one people notice least. Most policies require notice within a short window, sometimes 24 or 72 hours, and require you to use the forensic experts and lawyers on the insurer's panel. Hiring a forensic firm on your own on a Saturday night, with the best of intentions, can leave that invoice outside coverage and complicate the rest. The insurer's phone number should be on the first page of the response plan, not in an administration drawer.
What does the price depend on?
Five things, roughly in this order: revenue, industry, the volume of personal data you hold, incident history, and the maturity level of your security. You cannot change the first four before renewal. You can change the fifth, and it is the one that moves the most.
There are also two numbers that matter as much as the premium and get less attention: the retention, which is the portion you pay before the insurer steps in, and the waiting period for business interruption coverage, which is usually eight to twelve hours. If your operations recover in six, that coverage never kicks in. Comparing two policies on annual price alone, without looking at those two lines, is comparing two different things.
Does cyber insurance replace investing in security?
No, and the market itself made that clear when it started requiring controls. An insurer only insures risks that someone is already managing, just as no one insures a house without doors. The policy transfers the residual cost, the cost that remains after the work has been done.
Seen the other way around, the relationship is more useful than it seems: an insurer's questionnaire is, for free, one of the best security checklists you will find. Even if you decide not to buy the policy, it is worth answering it honestly and seeing where the gaps are.
Frequently asked questions
Does cyber insurance pay a ransomware ransom?
Is it useful for a small company, or only for large corporations?
What if the attack came in through a vendor?
How long does it take for a claim to be paid?
Does having a policy release me from my legal data protection obligations?
The policy is earned before you need it
Cyber insurance is not a backup plan for disaster day. It is the result of what you decided months earlier, when someone on your team answered a questionnaire and signed off that the controls were in place. That day defines almost everything: whether you get a quote, at what price, and whether the claim gets paid.
Most of those requirements point to the same place: that someone is watching and can prove it. Our managed 24/7 SOC covers exactly the lines that weigh most on the questionnaire, from endpoint detection to the logs that the forensic investigation later requests. If you want to know how many boxes you could check today, the free security assessment is the quick way to find out. The other terms in this article are explained in the cybersecurity glossary.
The insurer is not going to ask whether you care about security. It is going to ask you to prove it.
