If Your Business Gets Hacked Tomorrow, What Will Cyber Insurance Actually Pay For?
It is 8:12 a.m. on Monday.
You run a company with 50 employees.
One employee messages you. Then another.
Nobody can log in. Files will not open. Orders are not being processed.
Your IT team starts investigating.
Then comes the message you did not want to hear:
“It looks like ransomware.”
A few hours later, the situation gets worse.
Some company data may have been taken. Customer information could be involved. The attacker is demanding money.
Fortunately, your company has a $2 million cyber insurance policy.
You look at that number and think:
We should be fine.
But what does that $2 million actually mean?
Does the insurer pay the forensic firm?
The lawyers?
Five days of lost business?
Data recovery?
Customer notifications?
A lawsuit six months later?
And who should you call first?
That is where cyber insurance becomes much more complicated than the number printed on the policy.
The company, policy limit and dollar amounts below are an illustrative simulation. They are not market averages and do not represent any particular insurance policy.
8:30 A.M. — Who Do You Call First?
Your instinct might be to search for a cybersecurity company.
But if you have cyber insurance, one of your first calls may need to be to your insurer, broker or the breach hotline listed in your policy.
Cyber insurance can involve much more than reimbursing bills after an incident.
Some insurers maintain networks of approved specialists that policyholders can engage after reporting a claim.
Coalition's U.S. enterprise panel, for example, includes law firms such as DLA Piper, Arnold & Porter and Norton Rose Fulbright, alongside digital forensics and incident-response firms including CrowdStrike, Mandiant and Booz Allen.
Suddenly, one hacked company can activate an entire network:
Insurer
↓
Breach lawyer
↓
Digital forensics
↓
Data recovery
↓
Customer notification
↓
Crisis management
↓
potentially, litigation
What began as an IT problem is becoming a legal, insurance and professional-services problem too.
10:00 A.M. — The Bills Start Arriving
Let's give our fictional incident some numbers.
ILLUSTRATIVE SIMULATION
Forensic investigation: $80,000
Legal counsel: $50,000
Data recovery: $120,000
Five days of business interruption: $300,000
Customer notification and support: $40,000
Crisis management and PR: $25,000
A later customer lawsuit: $500,000
Total: $1,115,000
These figures are fictional. They are used only to show how different costs can accumulate after a cyber incident.
Your policy limit is $2 million.
Problem solved?
Not necessarily.
The more useful question is not:
How big is my policy?
It is:
Which of these losses does my policy actually cover, under what conditions, and up to what limits?
The Forensic Team Sends an $80,000 Bill
Someone has to determine what happened.
How did the attacker get in?
What systems were affected?
Was data stolen?
Is the attacker still inside the network?
This is where digital forensics and incident response, often shortened to DFIR, enters the picture.
The U.S. Federal Trade Commission says first-party cyber coverage typically can include forensic services used to investigate a breach.
That introduces the first insurance term we need:
First-party coverage.
Think of it simply as coverage for losses your own company suffers directly because of the incident.
The forensic bill is one example.
Then the Lawyers Arrive
Restoring the servers may not solve the problem.
If customer information was exposed, someone has to determine what the company is legally required to do.
Do customers need to be notified?
Does a regulator need to be contacted?
What information can the company disclose?
The FTC lists legal counsel used to determine notification and regulatory obligations among the costs typically included in first-party cyber coverage.
This explains why lawyers can appear surprisingly early in a cyber incident.
The company is not only trying to fix its computers.
It is trying to understand its legal obligations while the facts are still being discovered.
What If the Business Is Down for Five Days?
Now the numbers can get much larger.
Employees cannot work normally.
Orders are delayed.
Customers cannot access services.
Revenue disappears while many expenses continue.
In our simulation, the company estimates that the five-day shutdown caused $300,000 in lost business.
Cyber policies can include business interruption coverage for lost income caused by a covered incident.
But this is where the headline policy limit can become misleading.
A $300,000 business loss does not automatically produce a $300,000 insurance payment.
Actual policies can contain a waiting period before business-interruption coverage begins.
The payment may also depend on the policy wording, limits, retention or deductible, and the way the covered loss is calculated.
So:
$2 million policy ≠ every $2 million loss is automatically covered.
The number on the front page is only the beginning.
What If Your Company Wasn't Hacked?
Now change the scenario.
Your own network is fine.
But the cloud provider, payment processor or SaaS company your business depends on gets attacked.
Your business stops anyway.
Does your cyber insurance pay?
Maybe.
The FTC specifically recommends checking whether a policy covers cyber incidents involving data held by vendors and other third parties.
Some cyber policies address related losses through forms of dependent or contingent business interruption coverage.
The distinction matters in a world where companies depend on cloud infrastructure, payment systems and outside software to operate.
You do not necessarily have to be hacked yourself to lose money from a cyberattack.
Six Months Later, a Customer Sues You
The servers have been restored.
Employees are working again.
Then a lawsuit arrives.
A group of customers says the company failed to protect their information and demands compensation.
Now the loss is different.
It is no longer only your company's own recovery cost.
Someone else is demanding money from your company.
This is where third-party coverage becomes important.
The FTC says third-party cyber coverage generally protects against liability when another party brings a claim. Depending on the policy, that can include litigation costs, settlements, regulatory matters, damages and payments to people affected by a breach.
The difference is simple:
Your company directly loses money → First party
Someone else makes a claim against your company → Third party
You do not need to start with insurance terminology.
Follow the incident, and the terminology starts to explain itself.
Cyber Insurance Is Not Just Ransom Insurance
Ransomware gets the headlines.
An attacker locks a company's systems.
A ransom demand appears.
It is easy to imagine cyber insurance mainly as insurance that pays hackers.
Real claims data shows a broader picture.
Coalition analyzed claims across more than 100,000 global policyholders during 2025.
Business email compromise, or BEC, and funds transfer fraud accounted for 58% of all claims.
Ransomware was still expensive.
Coalition reported that initial ransom demands increased 47% in 2025 to an average of more than $1 million.
Yet 86% of businesses hit by ransomware did not pay the demand.
Ransomware was also the most costly claim type Coalition observed that year, with an average loss of $269,000.
The point is not that ransomware has become unimportant.
It is that the economics of a cyber incident extend far beyond the ransom itself.
One Cyberattack Can Activate an Entire Industry
Return to Monday morning.
At 8:12 a.m., you thought you had a technology problem.
Follow the money and the picture becomes larger.
One hacked company
↓
Cyber insurer
↓
Insurance broker
↓
Breach counsel
↓
DFIR firm
↓
Data recovery
↓
Notification services
↓
Crisis management
↓
Litigation
A cyberattack can create demand for insurance, legal services, cybersecurity, forensic investigation and other specialized services at the same time.
Cyber insurance therefore sits inside something much larger than an insurance market.
It can become an entry point into an entire incident-response ecosystem.
Now Look at Your Own Policy
Our fictional company started with one reassuring number:
$2 million.
But by the end of the incident, that number is no longer enough to understand the protection it bought.
A business owner may need to ask:
Does it cover business interruption, and is there a waiting period?
What happens if a vendor or cloud provider is attacked?
Does it cover both first-party losses and third-party claims?
Who must we contact first after an incident?
Are we required to use specific or approved response firms?
The FTC recommends businesses examine many of these issues when evaluating cyber coverage, including vendor incidents, lawsuit and regulatory defense, breach hotlines and the scope of first- and third-party protection.
The largest number printed on the policy may be the easiest number to understand.
It may not be the most important one.
Back to 8:12 A.M.
Your company has been hacked.
At first, it looks like a technology problem.
Then the invoices begin.
Forensics.
Lawyers.
Recovery.
Lost business.
Customer notification.
Possibly litigation.
And suddenly the important question is no longer:
Do we have cyber insurance?
It is:
What exactly did we buy?
A $2 million policy is a headline number.
What matters during an actual incident sits underneath it: the wording, the conditions, the response network and the individual coverages that determine which bills remain your company's problem and which may become the insurer's.
BEYOND THE OBVIOUS.
Sources
Federal Trade Commission — Cyber Insurance
First-party and third-party coverage, forensic services, legal costs, business interruption, vendor incidents and questions businesses should consider when buying cyber insurance.
Coalition — 2026 Cyber Claims Report2025 claims data covering more than 100,000 global policyholders, including ransomware, business email compromise and funds-transfer fraud.
Coalition — 2026 Cyber Claims Report AnnouncementAdditional claims statistics, including ransomware severity and loss data.
Coalition — Enterprise Panel ProvidersExamples of breach counsel, digital forensics and incident-response providers available to enterprise policyholders.