Skip to content
CoverMatch
MATCH GUIDE

Matching cyber liability

QUICK ANSWER

Cyber liability pays for breach response (notification, forensics, legal), ransomware and extortion, income lost during an outage, social-engineering and funds-transfer fraud, and claims from customers whose data was exposed. Carriers now ask about your controls — multi-factor authentication, backups, email security — before they quote. CoverMatch compares the sublimits that matter, the waiting period for interruption, the retention, and which incidents each policy actually covers.

Add your policies Get matched
Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 11, 2026 Updated
Coverage scoreEvery policy in one wallet
Cyber LiabilityRenews in 47d
Workers' CompensationLive cert ✓
Business Owner's PolicyCan switch
CoverMatch Both quotes carry the same main limit. One caps funds-transfer fraud far lower than the other; that is where small businesses actually lose money.
01 / WHAT UNDERWRITERS ASK
  • Multi-factor authentication on email, remote access and admin accounts
  • Backups: how often, where, and whether they are tested and offline
  • Email security and phishing training
  • Endpoint protection and patching practice
  • Records held: customer, payment and health data counts
  • Revenue and reliance on online systems for sales
  • Prior incidents, including ones you did not claim
02 / WHAT MOVES THE PRICE
  • Security controlsMFA, offline backups and endpoint protection are often required to quote at all and set the rate when they are present.
  • Records and data typesPayment and health data raise breach-response costs.
  • Revenue and dependence on systemsA business that cannot sell during an outage has larger interruption exposure.
  • Limits and sublimitsRansomware and funds-transfer sublimits move the price more than the headline limit.
  • Retention and waiting periodA higher retention and a longer interruption waiting period lower the premium.
Direction only — the carriers' quotes carry the figures.
03 / HAVE READY
  • Answers to the security questions above, confirmed with whoever runs your IT
  • Approximate counts of customer, payment and health records
  • Revenue and the share that depends on online systems
  • Your current cyber declarations page or endorsement
  • Client contracts that require a cyber limit

Reading a cyber quote

The headline aggregate matters less than the sublimits beneath it: ransomware and extortion, funds-transfer and social-engineering fraud, dependent business interruption (your provider goes down), and regulatory fines and PCI assessments where insurable. Add the waiting period before interruption pays and the retention, and you have the real shape of the policy. CoverMatch lays those rows out per quote.

Why controls come first

Carriers price cyber on your security posture, and some will not quote without multi-factor authentication and tested backups. The application asks the same questions carriers do, so the answers go out once; where an answer would block quotes, the application says so before submission.

Incident response as part of the policy

Most cyber policies come with a response panel and a hotline. That service is the policy's most used feature, and the comparison lists it as included with each quote.

After you buy

The policy card shows sublimits and the hotline number, security changes can be reported from the policy page, and the renewal application restates your controls so the quote reflects improvements.

Questions people actually ask

Is cyber coverage included in my BOP?

Some BOPs add a small cyber endorsement with low limits and a narrow trigger. A stand-alone policy covers more incident types at higher limits; the comparison shows both when both are quoted.

What is funds-transfer fraud and why is it sublimited?

An employee is tricked into wiring money to a criminal. It is the most common small-business cyber loss and carriers cap it well below the main limit, so compare that sublimit directly.

Will the carrier decline me without MFA?

Many will, or will exclude ransomware. Turning on multi-factor authentication before applying improves both eligibility and price.

What does breach response actually pay for?

Forensic investigation, legal advice on notification law, notifying affected people, credit monitoring, call centre and public relations, usually through the carrier's own response panel.

MANAGE IT IN THE APP

Every policy, renewal and live certificate in one wallet.

Scan a dec page and the card appears. Share a live certificate link that updates itself. Get matched when a renewal comes around.

Add your policiesGet matched

Keep reading

MATCHMatching abuse and molestation coverage: how the comparison works MATCHMatching bailee coverage: how the comparison works MATCHMatching builders risk: how the comparison works MATCHMatching business income coverage: how the comparison works MATCHMatching a business owner's policy MATCHMatching commercial auto MATCHMatching commercial crime coverage MATCHMatching commercial earthquake coverage: how the comparison works