Many cyber insurance conversations focus on what could happen, what a policy might cover, and how much an incident could cost.
But what does it look like when a business files a claim?
Below is a composite example based on real-world cyber incidents and claims data. While details have been simplified, this scenario reflects how many attacks unfold and how cyber insurance coverage applies in practice.
The Business
A midsize professional services firm with about 40 employees.
- Relies heavily on email and cloud-based systems
- Stores sensitive client data
- Has a cyber insurance policy in place
Like many businesses, the firm believed it had adequate safeguards in place.
The Timeline of the Cyber Attack
Day 1: The Phishing Email
An employee receives what appears to be a legitimate email from a known vendor. The employee clicks a link and enters login credentials into a fake portal.
The attackers now have access.
Days 2–5: Silent Access
The attackers monitor activity and move laterally through the company’s systems.
- The attackers capture additional credentials
- They access sensitive files
- They identify backups
No alarms are triggered.
Day 6: The Lockout
Employees arrive at work and can’t access critical systems. Files are encrypted, systems are locked, and a ransom note appears.
Demand: $85,000 in cryptocurrency
Days 6–10: Response and Shutdown
The business takes immediate action by taking its systems offline, engaging a cybersecurity firm, and contacting legal counsel. Altogether, the company effectively pauses its operations.
The Financial Impact
By the time the situation is resolved, the business’s estimated costs include:
- Ransom payment: $85,000
- Forensic investigation and IT response: $60,000
- Legal and compliance costs: $25,000
- Customer notification and support: $15,000
- Downtime (lost revenue): $140,000
Total Impact: $325,000
This total also doesn’t fully capture longer-term effects, such as reputational damage or lost future business.
What the Cyber Insurance Policy Covered
The business did have cyber insurance, and it made a significant difference.
In this example, the cyber insurance policy covered:
- Incident response and forensics
- Legal and notification costs
- Ransom payment
The policy also helped partially cover the business’s downtime, but not all of it:
- Coverage was subject to limits and waiting periods.
- The total payout did not fully match the actual revenue loss.
Total Insurance Payout: Approximately $220,000
What The Cyber Insurance Policy Did Not Cover
Even with a solid policy, there were gaps.
Uncovered Downtime Losses: A portion of the company’s lost revenue fell outside the policy’s coverage limits and waiting period requirements.
Security Improvements Post-Incident: Upgrading systems and improving cybersecurity after the attack was necessary but not covered by the company’s policy.
Indirect Business Impact: Losses related to client trust, project delays, and future revenue were not covered in this example.
What This Means in Real Terms
- Total cost: $325,000
- Insurance covered: $220,000
- Out-of-pocket cost: $105,000
Even with insurance, the business still absorbed a significant financial hit. Without coverage, the full impact would have fallen on the business.
Key Cyber Insurance Lessons for Business Owners
- Human Error Is a Common Risk
This entire incident started with one phishing email. Even strong systems can be compromised through everyday actions.
- Coverage Has Limits
Cyber insurance can offset major costs, but it doesn’t eliminate all financial impact and comes with strict limits and conditions.
- Business Interruption Is Often Underestimated
Downtime was the single largest cost, and not all of it was covered. Understanding how your policy handles lost income is critical to being prepared for what you might face if your business is targeted by a cyber attack.
- Not All Costs Are Insurable
Reputational damage and long-term business losses may fall outside cyber coverage.
- Policy Structure Matters
What was covered came down to policy limits, specific terms, and built-in exclusions. Two similar businesses could experience very different outcomes depending on how their coverage is structured.
See How Your Coverage Would Respond
This example demonstrates how quickly costs can add up and how important it is to understand what your policy would actually do in a real situation.
Talk to an advisor to review your cyber coverage, identify potential gaps, and make sure you’re prepared for the financial reality of a cyber event.
Have questions? Contact:
Jason Ehlert
Commercial Insurance Advisor
Call: (253) 328-7740Book an Appointment»
...
Read Jason's full bio