Ransomware, payment fraud, cloud outages, privacy laws, client contracts with insurance requirements: nearly every business now faces cyber risk that would have seemed complicated a few years ago. Cyber insurance policies have kept pace, with longer applications, security questions, and wording that varies from insurer to insurer. The good news is that the buying process itself can stay simple, whatever the size of your business.
How to buy cyber insurance comes down to five steps: check what your current coverage does and doesn’t cover, decide how much limit you need, check any contract requirements, complete one application, and compare quotes with a broker before you bind. The application is the only time-consuming part. A specialist broker handles the rest: matching you with suitable insurers, explaining the differences between quotes, and keeping your coverage current at renewal.
Why cyber insurance feels complicated
- The jargon. Retentions, sublimits, waiting periods, and retroactive dates aren’t everyday words. The glossary below covers the ones that matter.
- The application. Insurers ask detailed questions about your security controls, because those controls decide whether an attack becomes a claim.
- Policies that look alike but aren’t. Two quotes with the same limit can respond very differently to the same ransomware attack.
- More than one policy. Technology companies often need Technology E&O as well as cyber, and the two have to fit together.
None of this means learning how to buy cyber insurance has to be hard. It means it helps to follow a clear order, and to work with someone who reads policy wording for a living.
How to buy cyber insurance in five steps
Check what you have and what you need
If you already have a policy, start with its weak spots. If you don’t, start with what your business does, since each service creates different exposures. Our two-minute Coverage Gap Assessment reviews an existing policy, and the Coverage Mapper maps your services to the coverage they call for.
Decide how much limit you need
Your limit should cover a serious event from start to finish: breach response, lost income while systems are down, ransomware, and claims. The Cyber Insurance Limit Calculator estimates each cost from your revenue, data, and downtime, and recommends a limit.
Check your contracts
If clients require specific coverage, their contracts set your minimum. Paste the insurance section into the Cyber Insurance Contract Checker to see what you need before you apply. For more, see our guides to $5M contract requirements and liability caps in software license agreements.
Apply once
One complete application lets a broker approach several insurers without asking you the same questions again. Our cyber insurance application adapts to what your business does, saves your progress, and carries over answers from the tools above.
Compare quotes, then bind
Compare more than price: limits, sublimits, retentions, exclusions, and how each policy treats ransomware and outages. Your broker should walk you through the differences. Coverage starts once you accept a quote, the insurer binds it, and any conditions it sets are met. Our guide on getting a cyber insurance quote covers this step in detail.
What to have ready
You don’t need every answer before you start, but these make the application faster:
- Annual revenue and number of employees
- A short description of what your business does, including any technology services you provide
- Roughly how many personal records you hold, and what kinds, such as health, payment, or employee data
- Your security controls: multi-factor authentication, endpoint detection and response (EDR), backups, patching, and training
- Your current policy’s declarations page, if you have one
- Any past incidents, claims, or declined applications
- Client contracts that require insurance
The FTC’s cyber insurance guide is a useful checklist of coverage questions to ask before you buy.
How long it takes
- The tools: a few minutes each.
- The application: usually under an hour, longer if you provide several technology services or need high limits.
- Quotes: at least one day after we receive a complete application, and longer for complex, high-limit, or hard-to-place risks.
A short inquiry with a few basic details isn’t enough for insurers to price coverage. They need the full application, so completing it is the fastest route to real numbers. If you’re working against a contract deadline, tell your broker up front.
Eight terms explained simply
| Term | What it means |
|---|---|
| Limit | The most the policy pays. An aggregate limit is the total for all claims in the policy period. |
| Retention | The amount you pay before the insurer pays, like a deductible. |
| Sublimit | A smaller cap inside the limit for one type of loss. Ransomware is a common one; see ransomware sublimits. |
| Waiting period | How many hours your systems must be down before lost income is covered. |
| Claims-made | The policy responds to claims made while it’s active, which is why keeping coverage continuous matters. |
| Retroactive date | Incidents before this date may not be covered. Keep it when you change insurers. |
| Excess layer | A second policy above your first one that adds more limit. See excess cyber insurance. |
| Technology E&O | Covers claims that your technology or services caused a client’s financial loss. See cyber vs. Tech E&O. |
Mistakes to avoid
- Buying on price alone. A cheaper policy with a low ransomware sublimit or a long waiting period can cost far more after an attack.
- Overstating your controls. If you answer “yes” to MFA everywhere and it’s only on email, a claim could be disputed. “Partially” is a better answer than an inaccurate “yes.”
- Letting coverage lapse. A gap can reset your retroactive date and leave past incidents uncovered.
- Signing contracts first. Check insurance requirements before you sign, not after.
- Forgetting to update your insurer. New services, such as adding AI features or hosting client data, should be disclosed.
If you’ve been declined before, the process still works. See why cyber applications are declined and what to do next.
At renewal
Start about 60 to 90 days before your policy expires. Update your application with anything that’s changed, review your limit against your current revenue and contracts, and compare your renewal terms with what other insurers offer. Renewal is also the right time to fix any gaps you’ve found during the year.
Start with the right tool
Not sure where to begin?
Map your services to the coverage they call for and see possible gaps in about five minutes.
Map your coverage →Ready for quotes?
Complete one application for cyber and Technology E&O, tailored to what your business does.
Start the application →Frequently asked questions
How do I buy cyber insurance?
Decide what coverage and limit you need, complete one application, and compare quotes from insurers suited to your business. A broker who specializes in cyber can approach several insurers for you and explain the differences between quotes.
How long does it take to get cyber insurance?
Quotes take at least a day once a complete application is received, and longer for complex or high-limit risks. Coverage starts when you accept a quote and the insurer binds it.
Do I need a broker to buy cyber insurance?
Not always, but cyber policies vary widely in their wording. A specialist broker compares coverage, not just price, and can approach insurers suited to your industry and size.
Why does the application ask so many security questions?
Insurers price cyber risk largely on security controls such as MFA, EDR, and backups, because those controls decide how likely and how costly an attack is. Accurate answers help you get the right terms.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Let’s keep it simple.
Tell us about your business, and we’ll handle the complex part: finding the right insurers, comparing the wording, and explaining your options.
Get Quotes Talk to a BrokerThis article is general information, not legal advice or a statement of coverage. Coverage depends on each policy’s terms, conditions, and endorsements. Insurance availability, terms, and pricing are subject to insurer underwriting and approval.