TL;DR
Ransomware attacks cost businesses an average of $1.85 million in 2025, yet many policies have significant gaps. This guide helps you verify your coverage, understand common exclusions, and ensure your policy adequately protects against ransomware-specific risks.
Why Ransomware Coverage Matters
Ransomware has evolved from a nuisance to an existential threat for businesses of all sizes. In 2025, 66% of organizations experienced a ransomware attack, with average ransom demands exceeding $250,000. Without proper insurance coverage, businesses face not only ransom payments but also extended downtime, data recovery costs, and potential regulatory penalties.
Standard cyber insurance policies may not fully cover ransomware incidents. Many policies have sub-limits, waiting periods, and exclusions that can leave you significantly underprotected when an attack occurs.
Key Coverage Components to Verify
Ransom Payment Coverage
What to check:
- Is there a specific sub-limit for ransom payments? (Often capped at 25-50% of total limit)
- Does the policy cover cryptocurrency payments?
- Are negotiation services included?
- Is there a maximum per-incident limit?
Red flags:
- “Discretionary” payment language allowing insurer to deny
- Exclusions for payments to sanctioned entities
- Requirements for law enforcement approval before payment
Data Recovery Costs
Essential coverage includes:
- Forensic investigation to determine attack scope
- Data restoration from backups
- System reconstruction and hardening
- Business interruption during recovery
Common gaps:
- Caps on forensic investigation hours
- Exclusions for data that wasn’t properly backed up
- No coverage for improved security measures post-incident
Business Interruption Coverage
Critical questions:
- What’s the waiting period before coverage kicks in? (Typically 8-24 hours)
- How is the interruption period calculated?
- Are partial interruptions covered?
- What happens if you choose not to pay ransom and rebuild instead?
Common Ransomware Exclusions
War and Nation-State Exclusions
Many policies exclude attacks attributed to nation-states or acts of cyber warfare. Given the difficulty of attribution, this creates significant uncertainty.
What to look for:
- Broad war exclusions that could apply to ransomware
- Definition of “nation-state” actor
- Whether attribution must be proven
Unpatched Vulnerabilities
If your systems have known, unpatched vulnerabilities, claims may be denied.
Protect yourself by:
- Maintaining patch management documentation
- Having a clear vulnerability remediation timeline
- Keeping records of why certain patches were delayed (if applicable)
Failure to Follow Security Practices
Policies increasingly require specific security measures:
- Multi-factor authentication on all remote access
- Offline backups tested within the last 90 days
- Email filtering and anti-phishing measures
- Endpoint detection and response (EDR) solutions
Coverage Verification Checklist
Before a Claim
- Review policy sub-limits for ransomware specifically
- Confirm coverage includes negotiation services
- Verify business interruption waiting period
- Check for regulatory defense coverage
- Understand the claims process timeline
- Document current security measures
- Verify backup procedures meet policy requirements
- Confirm incident response vendor pre-approval requirements
Policy Enhancement Options
Consider adding or increasing:
- Ransomware sub-limit increase - If capped at $250K, consider doubling
- Contingent business interruption - Coverage for supplier/partner attacks
- Reputation harm coverage - PR costs and customer notification
- Regulatory defense costs - Legal fees for compliance investigations
Real-World Coverage Gaps
Case Study: Manufacturing Company
A $15M manufacturer paid $180K ransom but discovered their policy:
- Capped ransom payments at $100K
- Excluded business interruption during the 2-week recovery
- Denied coverage for the forensics firm (not pre-approved)
Total uncovered loss: $890K
Case Study: Healthcare Practice
A medical practice hit by ransomware had their claim denied because:
- They lacked MFA on the compromised VPN
- Their backups hadn’t been tested within 90 days
- The attack exploited a 6-month-old known vulnerability
Total uncovered loss: $420K plus regulatory fines
Questions to Ask Your Broker
- What percentage of my total limit applies specifically to ransomware?
- Are there any pre-approval requirements for incident response vendors?
- How does the waiting period work for business interruption?
- What security requirements must I maintain for coverage to apply?
- Is cryptocurrency payment covered, and at what exchange rate?
- What happens if law enforcement advises against payment?
- Are there any territorial exclusions for attacks?
Next Steps
Use our cyber insurance calculator to estimate your coverage needs, then review your current policy against this checklist. Schedule a meeting with your broker to address any gaps before an incident occurs.