High-Limit & Excess Cyber Insurance When one policy isn’t enough.
Larger exposures, demanding client contracts, and limited primary capacity often mean the limit you need can’t come from a single insurer. We structure layered cyber and Technology E&O programs, with primary and excess layers built to fit together.
What is an excess cyber insurance tower?
An excess cyber tower stacks several policies to reach a higher total limit. A primary policy responds first. Once its limit is used up, the first excess layer responds, then the next, each from a different insurer or group of insurers.
Layering spreads a large exposure across multiple insurers, which is often the only way to reach the limit a business needs.
How to read the notation: $5M xs $5M means a $5 million layer that sits in excess of (above) the first $5 million of coverage.
The point where a layer starts paying is its attachment point.
Sets most of the terms
More limit only helps if the layers fit together
A tower is only as strong as the way its layers connect. These are the provisions we review most closely when building or reviewing a high-limit program.
Follow-form wording
Most excess policies “follow form” to the primary, adopting its terms. Excess-specific exclusions or conditions can still narrow what the upper layers cover.
Sublimits in the primary
Excess layers often don’t sit above sublimited coverage. A ransomware or business interruption sublimit can cap that exposure no matter how tall the tower is.
Exhaustion language
Some excess policies only respond once the layer below is exhausted by actual payment of covered loss, which can matter when lower layers settle a claim.
Consistent terms across layers
Policy periods, retroactive dates, and key definitions should line up throughout the tower so a claim doesn’t fall between layers.
Drop-down provisions
Whether an excess layer drops down when an underlying aggregate limit is used up by earlier claims varies by policy.
Claims and consent
Each layer may have its own notice and consent requirements. Large claims go more smoothly when every insurer’s expectations are clear in advance.
Ways to structure a high-limit cyber program
The right structure depends on the limit you need, available market capacity, and how much consistency you want across insurers.
| Structure | How it works | When it fits |
|---|---|---|
| Single primary policy | One insurer provides the full limit | Moderate limits within one insurer’s appetite |
| Primary + excess tower | Layers from different insurers stack vertically | Higher limits than any one insurer will provide |
| Quota share layer | Several insurers each take a percentage of the same layer | A layer too large for one insurer to take alone |
| Combined cyber + Tech E&O tower | Excess layers sit above a combined primary | Technology companies with significant contract requirements |
How much cyber limit do you need?
There’s no single formula, but the right limit usually reflects a realistic worst case, not an average incident. We work through the factors that drive it with you.
Factors we consider
- Revenue and how much of it depends on systems staying up
- Data volume and the type of personal, health, or payment data you hold
- Client contract requirements, especially the highest one you’ve signed
- Technology E&O exposure if clients rely on your products or services
- Regulatory environment in your industry and locations
- Available market capacity and the cost of each additional layer
How we build high-limit programs
- Step 01
Understand
Your exposure, contract requirements, and the limit you actually need.
- Step 02
Design
Choose a structure, layer sizes, and attachment points that the market can support.
- Step 03
Approach Markets
Secure a strong primary first, then build excess layers with insurers suited to each attachment.
- Step 04
Align
Review every layer for consistent terms, sublimits, and exhaustion wording before binding.
Need higher limits to meet a contract?
Tell us the requirement and your current program. We’ll help you understand the options.
High-limit cyber questions, answered.
Have a question that isn’t here? Ask our team.
What is excess cyber insurance?
Excess cyber insurance provides additional limit above a primary cyber policy. It responds only after the primary policy’s limit has been used up, and usually follows the primary policy’s terms. Businesses use excess layers to reach a higher total limit than a single insurer will provide.
What does “xs” mean in a cyber insurance program?
“xs” stands for “in excess of.” For example, “$5M xs $5M” describes a $5 million layer that begins paying after the first $5 million of coverage has been used. The point where a layer starts paying is called its attachment point.
What is a follow-form excess policy?
A follow-form excess policy adopts the terms, conditions, and exclusions of the underlying primary policy, so coverage is consistent through the tower. Many excess policies still add their own exclusions or conditions, so each layer’s wording should be reviewed.
Does excess cyber insurance sit above sublimits?
Often it does not. If the primary policy sublimits a coverage, such as ransomware or business interruption, excess layers frequently provide no additional limit for that coverage. That’s why primary sublimits matter so much in a high-limit program.
What is a quota share in cyber insurance?
A quota share splits a single layer among several insurers, each taking a percentage. For example, three insurers might share a $10 million layer. Quota shares are used when a layer is too large for one insurer to take alone.
Build a cyber tower that holds together.
Whether you need more limit for a contract or a program that has outgrown its structure, we can help you evaluate your options.
Program structures, limits, and coverage descriptions on this page are illustrative and educational. Actual coverage depends on policy language, endorsements, exclusions, limits, and conditions. ComplexCyber.com is operated by Cyber Data Risk Managers LLC, an independent insurance brokerage. Insurance availability, eligibility, terms, limits, and pricing are subject to insurer underwriting and approval. No coverage is bound through this website. Privacy Policy