Cyber liability coverage is usually compared on one number, and that number is the least informative part of the schedule. A cyber policy spends its limit across several sections with their own caps, and the aggregate wording means an incident early in the year can leave very little for anything after it. The useful comparison is the structure underneath the headline.
Aggregate against each and every
Most cyber policies are written in the aggregate: the limit is the most the insurer will pay in total across the policy year, not per claim. One serious incident can therefore exhaust the cover, leaving the business uninsured for the remainder of the period unless the limit is reinstated. Some wordings offer a reinstatement, sometimes once and sometimes at additional premium. Ask which structure applies before comparing two figures.
Sub limits are where the real cover lives
Underneath the aggregate sit smaller caps on specific sections: ransom, funds transfer fraud, business interruption, regulatory defence, and sometimes notification costs. Those sub limits are frequently a fraction of the headline, and they are the ones your actual claim will run against. A policy with a large aggregate and a small crime sub limit is telling you which loss the insurer expects to pay and which it does not.
Defence costs inside or outside the limit
If defence costs sit inside the limit, every pound spent defending a claim is a pound less available to settle it. If they sit outside, the limit is preserved for the loss itself. On liability sections this single distinction can matter more than the size of the limit, particularly where a regulatory investigation is expected to be long and the eventual liability small.
Excess, waiting periods and how the first bill is shared
There is usually an excess per section, and business interruption carries a waiting period expressed in hours rather than money: losses in the first stretch of downtime are yours regardless of the excess. A longer waiting period buys a cheaper premium and is a reasonable trade for a business that can absorb a day, and a bad one for a business that trades entirely online.
Questions people ask about cyber liability coverage
How much cyber liability cover do I need?
Work from what could happen rather than a round number: the number of people you would have to notify, the largest diverted payment, and the revenue lost over a realistic outage. Then check the sub limits against those three figures.
What is a sub limit?
A cap inside the overall limit that applies to a named section. It cannot be exceeded even if the main limit is untouched, which is why comparing only headline limits is misleading.
Can the limit be reinstated after a claim?
Some wordings allow one reinstatement, occasionally automatically and more often for additional premium. If the aggregate structure worries you, this is the clause to negotiate.
Does the excess apply to each section separately?
Usually yes, and the amounts differ. A single incident touching three sections can attract more than one excess, which is worth knowing before the claim rather than during it.