Ransomware Coverage in Practice: Extortion Payments, Waiting Periods, and Dependent Business Interruption

Does cyber insurance pay a ransomware demand?

Yes, most cyber policies include cyber extortion coverage that can reimburse a ransom payment, subject to carrier consent, sanctions compliance, and often a sublimit below the policy's full limit. The practical conditions matter more than the coverage grant. You generally must obtain the carrier's approval before paying, and you must use their approved incident response and negotiation vendors, or you risk the payment not being covered at all. Sanctions screening is mandatory, since paying a sanctioned entity is unlawful regardless of your policy. Median ransom payments have moved around considerably year to year, but demands against mid-market companies routinely arrive in the hundreds of thousands to low millions, while actual negotiated payments are typically a fraction of the opening demand.

• Carrier consent is nearly always required before any payment is made.
• Approved forensic, legal, and negotiation vendors must generally be used.
• Extortion coverage is frequently sublimited, commonly at 25 to 50 percent of the policy limit.
• Sanctions screening of the threat actor is a condition, not a formality.
• Coverage typically includes the cost of negotiation and cryptocurrency procurement, not just the payment.

What is the waiting period and why does it decide your recovery?

The waiting period is the number of hours a network outage must continue before business interruption coverage begins, and it functions as a time-based deductible. Standard waiting periods run from 6 to 12 hours, with 8 hours common in the mid-market and 24 hours or more appearing on lower-priced policies. Here is why it matters so much. If your policy has a 12 hour waiting period and your systems are restored in 10 hours, you recover nothing for the interruption even though you lost a full business day of revenue. Worse, some forms apply the waiting period and then measure loss only from the end of it, rather than retroactively covering the full outage once the threshold is met. That single difference in wording can change a recovery by hundreds of thousands of dollars on a multi-day event.

• Typical waiting periods: 6, 8, 12, or 24 hours.
• Ask whether loss is measured retroactively from hour zero once the waiting period is satisfied.
• Confirm whether the waiting period applies per event or per system.
• Negotiating from 12 hours to 8 hours is often inexpensive and materially improves recovery.

What is dependent business interruption and do you have it?

Dependent business interruption, sometimes called contingent business interruption, pays your income loss when someone else's systems go down. This is the fastest-growing category of cyber loss because so much of the mid-market runs on shared platforms. If your practice management system, your payroll provider, your e-commerce platform, or your cloud host is taken offline by an attack, your revenue stops even though your own network was never touched. Many cyber policies either exclude this entirely, sublimit it severely, or cover only named dependent providers you scheduled in advance. Some distinguish between a security failure at the provider, which is covered, and a simple system failure or outage, which is not.

• Confirm dependent business interruption is included, not just direct business interruption.
• Check whether coverage is blanket or limited to scheduled providers you must name.
• Check whether it covers only a security failure at the provider or also an unintentional outage.
• Look for a separate and often longer waiting period applying to dependent events.
• Inventory your critical vendors and match the list against the policy.

Which sublimits quietly cap a ransomware claim?

The headline limit is rarely the operative number. Cyber policies are built as a menu of insuring agreements, many with their own sublimits, and a ransomware event touches several at once. A 1,000,000 dollar policy can easily pay out 400,000 dollars on a loss that cost you 900,000 dollars, purely through sublimits. The ones to check before binding are listed below, and every one of them is negotiable in a competitive market.

• Cyber extortion and ransom payment sublimit.
• Business interruption and extra expense sublimit, plus the period of restoration cap.
• Dependent business interruption sublimit, usually the smallest of the group.
• Data restoration and system recreation costs, often capped well below the main limit.
• Bricking coverage for hardware rendered unusable, which is frequently absent.
• Reputational or post-event loss of revenue, rarely included and usually narrow.

What controls do underwriters now require?

Cyber underwriting has become prescriptive. Carriers no longer ask whether you take security seriously, they ask for specific controls and decline or surcharge accounts that lack them. The baseline expectations for the mid-market are well established, and failing them can mean either no quote or a coinsurance provision on ransomware losses that leaves you paying 25 to 50 percent of the claim yourself. Getting these in place before renewal is usually the highest-return insurance work a mid-market company can do.

• Multifactor authentication on email, remote access, and all privileged and administrative accounts.
• Offline or immutable backups, tested by actual restoration rather than by policy.
• Endpoint detection and response deployed across the environment, not just on servers.
• Email filtering and a documented patching cadence for critical vulnerabilities.
• Privileged access management and removal of local administrator rights.
• A written and rehearsed incident response plan with current contact information.

What does the full cost of a mid-market ransomware event look like?

Build the number from the components rather than from the ransom. A mid-market company with 40,000,000 dollars of revenue that loses systems for five business days is losing roughly 770,000 dollars of revenue before any expense is counted, though the recoverable business interruption loss is measured on lost net income plus continuing expenses rather than gross revenue. Add forensic investigation, commonly 50,000 to 250,000 dollars. Add breach counsel and legal work, frequently 75,000 to 300,000 dollars where data was exfiltrated. Add notification and credit monitoring if personal information was taken, which scales with record count. Add overtime, temporary manual processes, and expedited hardware. Then add the ransom, if paid. Against that, a 1,000,000 dollar policy with meaningful sublimits and an 8 hour waiting period is adequate. The same limit with a 24 hour waiting period and a 250,000 dollar business interruption sublimit is not.

Ready to review your cyber policy line by line?

If you have not read your waiting period, your business interruption sublimit, and your dependent vendor terms, you do not yet know what your cyber policy would pay. Grandbay Financial Services reviews cyber programs line by line. Book a review at calendly.com/grandbayfinancial.