Ransomware Sublimits: Why Your Cyber Policy May Pay Less Than You Think
Your declarations page says $3M. For a ransomware attack, your policy may pay a fraction of that. Here’s how to find a ransomware sublimit, what it changes, and how to get better terms.
A company with a $3 million cyber policy is hit by ransomware. Systems are down for nine days, and between forensics, restoration, lost income, and the extortion demand, the loss passes $2 million. Then the claims adjuster points to an endorsement the owner never read: ransomware losses are capped at $1 million, and the company pays half of every ransomware dollar along the way.
A ransomware sublimit is a smaller limit inside your cyber policy that caps what the insurer pays for ransomware events, often well below the policy’s headline limit. It usually applies to every cost from the attack, not just the extortion payment. Some policies add coinsurance, where you share a percentage of the loss. Check your declarations page and endorsements, and ask your broker whether stronger security controls can get you full limits.
What a ransomware sublimit is
A sublimit is a cap within your policy’s overall limit for a specific kind of loss. It isn’t extra coverage on top of the limit. It’s the most the insurer will pay for that kind of loss, and whatever it pays also reduces the policy’s overall limit.
Ransomware sublimits became common when ransomware claims surged, and insurers looked for ways to limit their exposure. Many have since loosened terms for businesses with strong controls, but sublimits, coinsurance, and related restrictions are still widely used, especially for businesses with weaker security or in industries that attackers target.
It usually caps more than the ransom
Many people assume a ransomware sublimit only limits the extortion payment. Depending on the wording, it can cap every cost that flows from the attack:
- The extortion payment and the cost of negotiating it
- Forensic investigation and incident response
- Restoring data and rebuilding systems
- Lost income while your systems are down
- Breach notification if data was stolen as well as encrypted
- Lawsuits and regulatory claims that follow
Business interruption is often the largest part of a ransomware loss, so a sublimit that covers it can matter far more than one limited to the extortion payment.
How to find a ransomware sublimit in your policy
Ransomware restrictions rarely sit in one obvious place. Look for these:
| What to look for | What it means | Where you’ll find it |
|---|---|---|
| Ransomware sublimit | A separate, lower limit for ransomware events. | Declarations page sublimit schedule, or a ransomware endorsement |
| Ransomware coinsurance | You pay a set percentage of each ransomware loss, such as 25% or 50%. | Ransomware or cyber extortion endorsement |
| Separate retention | A higher deductible that applies only to ransomware. | Declarations page or endorsement |
| Widespread event limits | Lower limits when one attack hits many businesses at once. | Widespread or systemic event endorsement |
| Unpatched vulnerability terms | Coverage shrinks if an attack uses a known flaw you didn’t patch in time. | Neglected software or patching endorsement |
| Waiting period | Hours of downtime before lost income is covered. | Business interruption section of the declarations |
What a ransomware sublimit costs you: an example
Here’s a hypothetical policy with a $3 million limit, a $1.5 million ransomware sublimit, and 50% ransomware coinsurance. A ransomware attack causes $2 million in covered loss.
- With no ransomware restrictions: the insurer pays the full $2 million, less your retention.
- With the sublimit only: the insurer pays up to $1.5 million. You pay the other $500,000.
- With the sublimit and 50% coinsurance: the insurer’s share is half the loss, $1 million. You pay the other $1 million, plus your retention.
The declarations page still says $3 million. Real policies vary in how the retention, coinsurance, and sublimit interact, so ask your broker to walk through a scenario using your own policy wording.
Why buying excess may not fix it
It seems logical to add an excess policy on top. But excess layers usually sit above the primary policy’s overall limit, not above a sublimit. A $1 million ransomware sublimit on a $3 million primary policy generally stays a $1 million sublimit, even with $5 million of excess above it. Some programs are built to address this, so if you’re adding excess, ask specifically how ransomware is treated at each layer. Our guide to excess cyber insurance explains how towers work.
How to get better ransomware terms
Insurers use ransomware restrictions to price uncertainty. The better they understand your controls, the more room they have to offer full limits. The controls underwriters ask about most:
- Multi-factor authentication on email, remote access, and administrator accounts
- Endpoint detection and response (EDR) on all devices and servers
- Backups that are offline or immutable, separated from your network, and tested
- Patching critical vulnerabilities quickly, especially on internet-facing systems
- Limits on administrator access and privileged accounts
- Email filtering and regular phishing training
- A written incident response plan that you’ve practiced
Document these on your application, and give the underwriter specifics rather than yes-or-no answers. Federal guidance from CISA’s StopRansomware program is a good checklist for your IT team. If a carrier still insists on a sublimit, a broker can compare it with other markets that may not.
A note on paying ransoms
Coverage for an extortion payment doesn’t mean a payment is always allowed. Paying a group subject to U.S. sanctions can violate federal law, and insurers won’t reimburse a payment they can’t legally make. Most cyber insurers provide incident response and negotiation firms who handle these checks. Call your insurer’s breach hotline before you pay anything.
Size your limit, then check your terms
Cyber Insurance Limit Calculator
Estimate what a breach, a ransomware attack, and downtime could cost your business, and see a recommended limit.
Estimate your limit →Coverage Gap Assessment
Answer six quick questions to spot common gaps in your cyber coverage, and get a one-page PDF.
Take the assessment →Frequently asked questions
What is a ransomware sublimit?
It’s a cap within your cyber policy’s overall limit that limits what the insurer pays for ransomware events. It often applies to every cost from the attack, including lost income and recovery, not just the ransom.
Does a ransomware sublimit reduce my overall limit?
Yes. What the insurer pays for a ransomware event counts against both the sublimit and the policy’s overall limit, leaving less for other claims in the same policy period.
Can I get a cyber policy without a ransomware sublimit?
Often, yes, especially with strong controls such as MFA, EDR, and tested offline backups. Terms vary by insurer, so a broker who works with several markets can compare them.
What is ransomware coinsurance?
Coinsurance means you share a percentage of each ransomware loss, such as 50%. It applies in addition to your retention and can apply even when the loss is below the sublimit.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Not sure what your policy pays for ransomware?
Send us your declarations page and endorsements. We’ll show you your ransomware sublimit, coinsurance, and waiting period, and quote options with better terms.
Request a Coverage Review Get QuotesThis article is general information, not legal advice or a statement of coverage. The example is hypothetical. Coverage depends on each policy’s terms, conditions, and endorsements.