Cyber Insurance Risk Analysis: Does Your Policy Match Your Real Risk?

Most of the attention at renewal goes to the application: the questions about multi-factor authentication, backups and endpoint protection that decide whether you get a policy at all. We covered those in what your cyber insurance renewal is actually asking for. This post is about the other half of the deal, the part the insurer doesn’t do for you: working out what a bad incident would cost your business, and whether the policy you’re buying would cover it.

That’s a risk analysis. It doesn’t need special software. It needs a few honest numbers, a copy of your policy, and an hour with whoever knows your finances.

The insurer is already sizing you up

Your application is one input. Insurers can also scan what your business exposes to the internet, like remote access that anyone can reach or systems that are behind on updates. Those scans aren’t always right, so it’s worth knowing what your business looks like from the outside before an insurer tells you. If a quote points to a problem that isn’t yours, or one you’ve already fixed, push back with evidence.

Step one: name the incidents that would hurt

For most small businesses, three kinds of incident are worth planning around:

• Payment fraud through email. Someone gets into an email account, yours or a vendor’s, and redirects a payment with a fake invoice or a “new bank details” message. The FBI calls this business email compromise, and it’s one of the costliest crimes the FBI tracks.
• Ransomware and other outages. Your systems are locked or down, and the business stops until they’re back.
• A data breach. Customer, patient or employee information is stolen, and notification, legal and regulatory costs follow.

Step two: put a rough number on each

You don’t need precision, just numbers good enough to hold up against a policy limit.

Start with downtime, and work out what one day of not being able to operate costs you: revenue you can’t bill or collect, staff paid to wait, overtime to catch up later. Then be honest about how many days a full restore from backup would take. If nobody has ever timed one, that’s your first finding. Don’t borrow published ransomware figures for this. Even the FBI notes that its reported ransomware losses usually leave out lost business and recovery costs, which is exactly what you’re trying to estimate.

A breach brings its own bills: lawyers, forensic investigators, notifying customers, a call center, help with public relations. If you hold regulated data like patient records or tax returns, more rules apply on top of that.

For payment fraud, look at the largest payments your business sends or receives by wire or ACH. One redirected payment can be bigger than everything else here. And read your customer contracts while you’re at it. Some require you to carry a set amount of cyber coverage, and a breach of a customer’s data can turn into a claim against you.

Step three: hold the policy up against the numbers

Now read the policy itself, not the summary page. These are the questions that matter most:

• Is it a real cyber policy or an add-on? Cyber coverage is often added to another policy, like a business owner’s policy. That can be fine, but check its limits closely.
• What are the sublimits? The headline limit is the most the policy pays in total. Sublimits cap specific kinds of loss, like ransomware or business interruption, at a smaller amount.
• Could you pay the deductible in a bad week? Make sure it’s an amount you could cover in cash while the business is down.
• How does business interruption work? Ask how lost income is calculated, whether coverage starts right away or after a waiting period, and whether it covers an outage at a vendor you depend on.
• Is payment fraud covered? Ask directly: if an employee pays a fake invoice after a convincing email, which policy pays, if any, and how much?
• What’s excluded? Some policies exclude losses that come from failing to keep up adequate security. Read how yours defines that, since it can tie straight back to what you said on the application.
• Who runs the response? Find out whether you must use the insurer’s chosen vendors, and whether you need its OK before hiring anyone or paying anything. Getting that wrong in the first hours of an incident can put coverage at risk.

Step four: decide what to fix and what to insure

Insurance pays for part of the damage after it happens. Some gaps are cheaper to close than to insure, and payment fraud is the clearest example. The FBI’s advice is to confirm any change to payment details through a second channel. In practice, that means a phone call to a number you already have on file, not one in the email. A call-back rule costs nothing.

If money does go out the door, speed is everything. Call your bank right away to ask for a recall, and report it to the FBI at ic3.gov. The faster you report, the better the chance the money can be frozen.

Downtime works the same way. If a week offline would cost more than your policy pays, you have two levers: a bigger limit, or faster recovery. Price both before you decide.

When to do it

Once a year, 30 to 60 days before renewal, so the answers can shape what you buy instead of explaining what you already bought. Then take the numbers to your broker. A broker can only match coverage to your risk if someone has written the risk down.

If you’d like an outside view first, our Security Analysis includes your external perimeter, the part of your business an insurer’s scan can see. For the ongoing work, our virtual CISO service includes the security reporting that goes to an insurer or a board. Or tell us when your renewal is due and we’ll talk through where to start.

Sources

• FTC: Cyber Insurance (small business guide developed with the National Association of Insurance Commissioners)
• NAIC: Report on the Cyber Insurance Market (2024)
• FBI Internet Crime Complaint Center: business email compromise guidance and 2025 annual report
• Gallagher Re: Looking from the Outside-In, on how insurers use external scans

TTS Cyber is an IT and cybersecurity company, not an insurance agency or broker, and this article is not insurance advice. Coverage terms vary by carrier and by policy. Your policy and your broker are the authority on what you’re covered for.