Ransomware sublimits: the number underwriters hope you skip

Cyber policies are sold on a headline limit, and the headline is the number most buyers remember. A policy with a $5 million aggregate feels like a $5 million answer to a ransomware attack. Often it is not. Somewhere in the declarations, usually on a schedule of sublimits and coinsurance, sits a smaller figure that applies specifically to ransomware or extortion events.

I place cyber cover for technology companies, and this is the first page I turn to when I review a quote. It tells you more about how a carrier sees your risk than the headline limit does.

What a sublimit is

A sublimit caps what the policy pays for a particular kind of loss, even when the overall limit is higher. It sits inside the aggregate, not on top of it. If you have a $5 million cyber limit with a $1 million ransomware sublimit, the most the policy will pay for a ransomware event is $1 million, whatever the total cost turns out to be.

Carriers added ransomware sublimits when losses rose, as a way to control how much capacity they commit to one type of event. Depending on the carrier and the quality of your controls, you may see a sublimit, a coinsurance requirement, both or neither.

Where the costs land

A ransomware event produces several kinds of cost, and a sublimit may capture some or all of them. Read the policy to see which.

• Incident response, including forensic investigators and legal counsel.
• Data restoration and system rebuild.
• Business interruption, meaning lost income and extra expense while systems are down.
• The extortion payment itself, where law and policy permit coverage.
• Notification and credit monitoring if personal data was taken.

A common shape is a sublimit that applies to the whole event, in which case every item above draws from the same smaller pool. Another is a sublimit on extortion payments only, with the other costs covered under the main limit. The difference can amount to millions in a serious event.

Coinsurance: the second half of the number

Some policies require you to share a percentage of every ransomware loss above the retention. A 50 percent coinsurance on a $1 million sublimit means the policy pays half of each covered dollar until the sublimit is reached. Your practical protection can be well below the figure printed on the page.

Why the sublimit moves

Underwriters set the ransomware terms based on how they judge your controls. Companies with multifactor authentication on all remote access, tested offline backups, endpoint detection and a written incident plan often see better terms. Gaps in any of those can push the sublimit down or the coinsurance up. This is why the application matters and why we review it with clients before it is signed. An inaccurate answer can also create problems at claim time.

What to do about a low sublimit

• Improve the underlying controls and re-market. A better story can produce better terms at renewal or even mid-term.
• Compare quotes on the ransomware terms, not just the price. A cheaper policy with half the sublimit may cost more in the end.
• Consider a higher aggregate with a separate ransomware structure across layers, where the market allows it.
• Set aside internal funds for the gap. If the sublimit is $1 million and your realistic loss is higher, the difference is a business decision, not an insurance one.

The conversation to have at renewal

Bring your finance lead and your IT lead into the same room. Ask IT how long it would take to restore the critical systems from backup, then ask finance what a day of downtime costs. Multiply the two and compare the result with the sublimit. If the numbers are far apart, you have found the real conversation.

That exercise rarely produces a comfortable answer. But it is much better to have it at the table in March than in the middle of an incident in July.

If you would like us to lay your current cyber sublimits and coinsurance out on a single page, send us the policy and we will do it within a few days.