Part 3 of 3.
How much coverage do you actually need, how do you know you are not overpaying, and what is genuinely provable about whether fixing your controls lowers your premium.
Every business owner buying cyber insurance has the same two questions, and most never get a straight answer to either.
How much coverage do I actually need? And how do I know I'm not overpaying?
The honest reason they go unanswered is that answering them well requires knowing things about the business that nobody has bothered to find out. Most SMBs never get that far — among businesses in the $10 million to $100 million revenue range, only an estimated 10% to 20% carry cyber insurance at all, against 60% to 70% of corporations above $1 billion (American Academy of Actuaries, February 2026).
So let's take the two questions in order — and then talk about who does what.
Cyber insurance is really two products stapled together, and most owners only think about one of them.
First-party coverage pays your own costs: forensic investigation, legal review of what you must disclose and by when, customer notification, credit monitoring, ransom negotiation and payment if it comes to that, rebuilding systems, and lost revenue while you're down.
Third-party coverage responds to other people's claims against you — legal defense, settlements, and regulatory proceedings.
Most owners think of cyber insurance as the first list, then discover the second is where the large numbers live. Both matter — one reinsurer's book splits claims roughly 62% first-party and 38% third-party (Munich Re, 2026) — and a policy strong in one can be thin in the other.
One mechanic worth understanding before you need it: business interruption coverage typically has a waiting period before it pays and a capped period of restoration after which it stops. Both are negotiable, both are routinely misread, and if your operations can't tolerate the waiting period in your current policy, that's better learned on a quiet afternoon than on day two of an outage.
This is where an advisor reading the actual form earns their fee.
Failure to maintain the controls you represented. The companion piece on insurance applications covers what happens when an application misstates a control's scope — a policy rescinded from inception after a ransomware claim, leaving the business with nothing. That was a rescission for misrepresentation at the time of application. Separately and by a different mechanism, some policies carry ongoing "failure to maintain standards" conditions, expecting the controls you described at binding to still be in place at claim time. The wording varies enormously between carriers and some forms contain nothing of the kind, so this is a question to ask rather than an assumption to make: which, if either, does my form contain?
Known prior incidents that weren't disclosed.
Unpatched known vulnerabilities, where a fix was available and wasn't applied. This one is worth taking seriously, because the industry is bad at it: only 26% of vulnerabilities on CISA's known-exploited list were fully remediated by the organizations studied, with median patching time rising to 43 days from 32 (Verizon Data Breach Investigations Report 2026).
State-backed cyber attacks. These exclusions are not one carrier's quirk. Lloyd's Market Bulletin Y5381, issued 16 August 2022, requires all standalone cyber policies in the relevant risk codes to carry a suitable exclusion for losses arising from state-backed cyber attacks, effective at inception or renewal from 31 March 2023 (Lloyd's Y5381). The practical question isn't whether your policy has one — it almost certainly does — but how it defines attribution, and who decides.
You cannot size a limit sensibly without knowing what you hold.
The question that unlocks this is not "how many clients do you have." It's: when does a record leave your systems? In most small businesses, the honest answer is that it doesn't. Records come in and they accumulate. Patients seen once in 2014. Customers who bought once and never returned. Prior-year files nobody purged because nobody was asked to.
That question tends to change the conversation, because it reframes retained data as something you're paying to insure.
For magnitude, the useful public benchmark is the 2026 IBM Cost of a Data Breach Report: a global average breach cost of $4.99 million — a 12% increase and a record high — with the US average at $11.5 million. Healthcare remains the most expensive sector for the thirteenth consecutive year at $6.64 million, though notably that figure fell 10.5% year over year (IBM; summary via HIPAA Journal). Those are enterprise-weighted averages and a small business shouldn't buy against them directly — but they establish order of magnitude, and why a limit chosen by instinct is usually wrong in one direction or the other.
A word about per-record cost figures, because you will encounter them. Insurance conversations often price exposure at a fixed dollar amount per record, and the figures in circulation vary wildly — I've heard credible people in the same market quote numbers differing by a factor of eight. IBM, the most-cited source in this field, no longer publishes a per-record figure at all. Treat any per-record rule of thumb as a conversation starter, not a calculation.
What actually helps: data minimization is a coverage strategy. Every record you no longer hold is exposure you no longer need to insure. Retention schedules, secure disposal, and an accurate inventory of where data lives show up in your limits, your premium, and your regulatory posture simultaneously.
Here I want to depart from how this topic is usually written about.
You have probably read that fixing your security controls will reduce your cyber premium by some specific percentage. Twenty percent. Thirty-five percent. The figure varies by article.
I went looking for the study behind that claim, and I couldn't find one. Every version I traced led back to marketing content from companies selling security services — no named research, no methodology, no dataset. I'm not going to repeat a number I can't source, and I'd be cautious about anyone who does.
What can be defended is a chain of three linked findings, each independently sourced:
One: security posture is a mechanical input into pricing. A peer-reviewed analysis of filed insurance rate schedules found that 39 of 69 schedules examined (56%) incorporated security-related rating factors, containing modifiers that allow an underwriter to debit or credit premium based on an insured's specific attributes (Romanosky, Ablon, Kuehn & Jones, Journal of Cybersecurity, 2019). Controls aren't just a gate — they're a dial.
Two: controls measurably reduce loss likelihood. The Marsh McLennan analysis linking controls to actual claims found real, quantified relationships between named controls and breach probability — EDR deployment coverage, phishing-resistant MFA, incident response tabletops.
Three: in a soft market, capacity competes for well-controlled risks. Cyber rates have fallen for twelve consecutive quarters, with abundant capacity. But Aon's caveat is the operative one: where minimum security standards are not met, capacity is limited.
Put together: controls determine your eligibility and your access to competitive capacity, and they were an explicit rating input in a majority of the filed rate schedules that study examined. In a market where carriers are competing, a business that closes its gaps and goes back out to market is competing for insurers actively looking for well-controlled risk. That is a strong argument. It's just not a percentage.
And in fairness, I should tell you where that 2019 paper cuts against me. Its central finding was that carriers at the time lacked robust data to price cyber risk, often relying on rough judgment or competitor rates rather than security metrics — which limits how much differentiation controls can really produce. The paper is seven years old, and underwriting has plainly matured since; the claims datasets cited throughout this series didn't exist when it was written. But it's the strongest counter-argument available and you deserve to hear it from me rather than find it later.
Beyond limits and price, these are the questions I'd want answered:
There's a clean division of labor here, and most of the friction I see comes from blurring it.
Your broker works the market — which carriers are currently sympathetic to your sector, what terms are achievable, how to present a submission. Specialized work, and a generalist agent who writes your general liability may not have it.
Your MSP or IT provider implements: deploys the controls, runs the systems, fixes what's broken.
An independent advisor establishes what's actually true, translates it into the language underwriters use, and sequences the remediation to land before your renewal — independent, specifically, of the people who built the systems being assessed.
Three roles, no overlap, and each is weaker when it absorbs another's job.
On timing: start six to nine months before your renewal. A training cycle with real completion records, a backup restore someone actually performed, an incident response plan that's been exercised — none of that can be manufactured under deadline, and an experienced underwriter can tell the difference between a program and a scramble.
Market appetite also varies by sector, and in my experience healthcare has drawn some of the closest underwriting scrutiny of any sector following the ransomware losses of recent years. Which means carrier selection can matter as much as control improvement — a good reason to have a broker who specializes rather than one who dabbles.
The businesses that come out of a renewal well are not the lucky ones, and they're not always the ones spending the most on security. They're the ones who knew what their answers were going to be before the application arrived.
If you're heading into a renewal, have been declined, or are simply looking at a policy you're not sure serves you, that's the work I do — with you, and alongside your broker.
Also in this series: why a renewal increase in a falling market is a message about your business, and why your MSP shouldn't fill out your insurance application.
Further reading: for a plain-language walkthrough of cyber coverage structure from the broker side, UKON's small business cyber insurance guide is a useful overview. UKON is a cyber insurance services provider working with independent agencies, so read it as industry guidance rather than independent research.
Melissa Thornton is the founder of Cybersecurity Advisory Group, providing virtual CISO and fractional cybersecurity leadership to healthcare organizations, startups, and SMBs. Based in White Plains, NY. sales@cyberadvisor.tech · +1 914-517-0022
This article is provided for general informational purposes and does not constitute legal, insurance, or coverage advice. Policy terms vary by carrier; read your own form.
Connect with Melissa Thornton on LinkedIn
