Excess Cyber Insurance Explained: How to Build Higher Limits
When one policy isn’t enough, excess layers stack more limit on top. Here’s how a cyber insurance tower works, what to check in the excess wording, and how to avoid gaps between layers.
A client contract asks for $10 million in cyber coverage. Your board wants more protection after a competitor’s breach. Or your current insurer simply won’t offer more than $3 million on its own. In each case, the answer is usually the same: excess cyber insurance.
Excess cyber insurance adds limit above your primary cyber policy. When a claim uses up the primary limit, the first excess layer pays next, then the layer above it, and so on. Together, these layers are called a tower. Excess policies usually “follow form,” meaning they follow the primary policy’s terms, but not always completely. The most common gaps come from sublimits, differing exclusions, and layers that don’t line up on dates or wording.
How a cyber insurance tower works
Here’s an example of a $10 million tower. Each layer is a separate policy, often from a different insurer.
| Layer | Limit | Pays when |
|---|---|---|
| Second excess | $5,000,000 excess of $5,000,000 | Losses go above $5 million |
| First excess | $2,000,000 excess of $3,000,000 | Losses go above $3 million |
| Primary | $3,000,000 | After your retention (deductible) |
In this example, a $4 million covered loss would use the full $3 million primary limit and $1 million of the first excess layer. The second excess layer wouldn’t be touched. Higher layers are less likely to pay, so they usually cost less per million than the layers below them.
Why businesses buy excess cyber coverage
- Contract requirements: clients and partners increasingly require $5 million, $10 million, or more. See what a $5M contract requirement really means.
- Insurer capacity: many insurers limit how much they’ll offer on a single policy, so higher limits come from several insurers working together.
- Larger exposures: more records, more revenue at risk from downtime, or more clients relying on your services can mean a loss larger than a primary limit.
- Board and investor expectations: leadership and investors often want limits that match the size of the business.
What to check in excess cyber policies
Does it truly follow form?
“Follow form” means the excess policy uses the primary policy’s terms. Many excess policies follow form but add their own exclusions or conditions. Each difference is a place where the primary pays and the excess doesn’t. Compare the excess wording against the primary, line by line.
Sublimits usually don’t get more limit
If your primary policy has a $250,000 sublimit for social engineering fraud, excess layers typically don’t add to it. The same often applies to ransomware, regulatory fines, or other sublimited coverages. If a sublimited risk matters to you, raise it in the primary policy or look for an excess policy that specifically sits over it.
Exhaustion: how the layer below must be used up
Some excess policies only pay once the layer below has been paid in full by the insurer below. If you settle a dispute with a lower insurer for less than its full limit, a strict exhaustion clause could leave a gap. Wording that allows the underlying limit to be exhausted by payments from you or others is more flexible.
Matching dates, notice, and the insurers’ agreement
Every layer should share the same policy period and retroactive date, and claims should be reported to every insurer in the tower. Excess insurers may also have a say in settlements that affect their layer. Mismatched dates or late notice to an excess insurer are avoidable gaps.
What happens if a lower insurer can’t pay
If an underlying insurer becomes insolvent, most excess policies won’t “drop down” to fill its place. Choosing financially strong insurers for each layer matters, especially for the primary.
Excess over a combined cyber and Tech E&O policy
Technology companies often have cyber and Technology E&O on one primary policy with a shared limit. When building excess on top of it, confirm whether the excess sits over both coverages or only one, and whether a large Tech E&O claim could use up limit you were counting on for a cyber event. Contracts that require specific limits for each coverage may need separate towers.
Building a tower that holds together
- Start with the primary. The primary policy’s terms flow up the tower, so its wording and sublimits matter most.
- Decide the total limit. Base it on contract requirements, your exposures, and what a serious incident could realistically cost.
- Choose the layer sizes. Insurer appetite and pricing often decide whether you need two layers or five.
- Compare every excess form to the primary. Look for added exclusions, sublimit treatment, and exhaustion wording.
- Align dates and reporting. Same policy period, same retroactive date, and one claim notice process for every insurer.
Our high-limit and excess cyber insurance page explains how we structure towers for growing companies.
Planning your limits
Coverage Gap Assessment
Check your current policy for sublimits, exclusions, and other weak spots before you build on top of it. About 2 minutes.
Take the assessment →Cyber Insurance Application
Request excess coverage over your current program. The application asks for your underlying limits and insurers.
Start your application →Frequently asked questions
What is excess cyber insurance?
It’s a policy that provides additional limit above another cyber policy. It pays only after the underlying limit is used up, and it usually follows the underlying policy’s terms.
Is excess cyber insurance the same as umbrella insurance?
No. A commercial umbrella usually sits over general liability, auto, and employer’s liability, and generally excludes cyber and data breach losses. Cyber limits are increased with excess cyber policies.
Can I buy excess coverage from a different insurer than my primary?
Yes, and it’s common. Excess insurers will review the primary policy and your application before agreeing to sit above it.
Do excess layers cover everything my primary policy covers?
Not always. Sublimited coverages often aren’t increased, and some excess policies add their own exclusions. Reviewing each layer against the primary is the only way to know.
How do I prove higher limits to a client?
A certificate of insurance can show each layer in your tower and the total limit. If the contract requires specific wording, such as additional insured status or primary and noncontributory terms, check that every layer meets it.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Need more limit than one policy can provide?
Send us your current policy and any contract requirements. We’ll design a tower that fits together and meets them.
Request a Coverage Review Get QuotesThis article is general information, not a coverage determination or legal advice. Excess policy terms vary by insurer, and coverage depends on the specific wording of each policy in your program. Coverage availability, terms, and pricing are subject to insurer underwriting and approval.