Guides
Ransomware sublimits and coinsurance in cyber policies
How ransomware sublimits, retentions and coinsurance split a cyber loss, why the order of application matters, and what to negotiate at renewal.
A ransomware sublimit caps what a cyber policy pays for a ransomware event at an amount below the full policy limit. Ransomware coinsurance makes you pay a fixed percentage of the covered loss on top of the retention. Either one can leave you holding a large share of a ransomware loss even though the declarations page shows a generous limit, so read the ransomware endorsement before you read the limit.
The three mechanisms, and how they differ
Carriers started attaching these terms to ransomware in 2020 and 2021, when claims spiked. In an April 2022 article, Covington lawyers described Chubb's Ransomware Encounter endorsement as a combination of three things: sublimits that cap the insurer's liability below the aggregate policy limit, increased retentions, and coinsurance, a percentage of loss the insured pays even after the retention. Some carriers use one, some all three.
| Term | What it does | Where it shows up |
|---|---|---|
| Ransomware sublimit | Caps the insurer's payment for ransomware-related loss, usually inside the aggregate limit and not in addition to it | Endorsement or the limits schedule |
| Higher retention | Raises the dollars you pay first before the policy responds | Declarations page, sometimes a separate ransomware retention |
| Coinsurance | You pay a stated percentage (say 25% or 50%) of covered loss after the retention | Ransomware or extortion endorsement |
Cyber coinsurance is a loss-sharing percentage. It is not the insurance-to-value penalty that applies to property policies, which the coinsurance clause and how underinsurance is penalized explains.
A sublimit does not add coverage. A $5 million policy with a $1 million ransomware sublimit pays at most $1 million for that event, and the rest of the limit stays available for other covered events. It will not stretch to cover the gap.
Worked example: why the order of operations matters
Say a 60-employee distributor buys a cyber policy with a $3 million limit, a $50,000 retention, a $1 million ransomware sublimit and 25% ransomware coinsurance. A ransomware event costs $1.8 million in total: forensics, negotiation, restoration, lost income and legal costs. This is a hypothetical for illustration, not a market quote.
| Step | Wording A: insurer pays 75% of loss after retention, capped at the sublimit | Wording B: loss capped at the sublimit first, then retention and coinsurance |
|---|---|---|
| Covered loss before limits | $1,800,000 | $1,000,000 (sublimit applied first) |
| Less retention | $1,750,000 | $950,000 |
| Insurer share at 75% | $1,312,500 | $712,500 |
| Capped at the $1 million sublimit | $1,000,000 | $712,500 |
| You pay | $800,000 | $1,087,500 |
Same loss, same numbers on the declarations page, and a $287,500 swing depending on which sequence the endorsement describes. Ask your broker for a written illustration run against the actual wording, using a loss large enough to hit the sublimit.
What sits inside the ransomware sublimit
The word "ransomware" in a sublimit is only as useful as its definition. Check these points:
- Which cost heads count. Some endorsements limit only the extortion payment itself. Others sweep in every dollar of loss that "arises from" the ransomware event: forensics, restoration, cyber business interruption and dependent system failure, notification and defense costs. The second version is far more restrictive.
- Data-theft extortion. Attackers increasingly steal data and threaten to publish it without encrypting anything. IOA's 2026 midyear cyber outlook notes that criminals have shifted from encryption to theft and the threat of data sales, which makes backups less useful against extortion demands. Confirm that a threat to release data counts as the same cyber extortion event your policy addresses, and that you know whether it falls inside or outside the sublimit.
- Third-party claims from the same event. If customers sue after their data leaks, does that liability sit under the ransomware sublimit, or under the privacy liability coverage at its own limit?
- Related events. Many forms treat a ransomware attack and the follow-on data release as one event, so a single sublimit applies to both.
- Dependent systems. A ransomware attack on your cloud vendor or payroll provider may trigger cyber business interruption and dependent system failure for a dependent business. Check whether that is carved out of the sublimit or swept into it.
Where the market is in 2026
These terms moved with the cycle. In May 2020, Business Insurance quoted an Allianz executive saying sublimits were being discussed but had not been broadly adopted, and an Alliant executive noted that a carrier imposing one would likely lose business to rivals offering full limits. By May 2021 the same publication reported that AIG was applying a 50% coinsurance requirement to companies it judged to lack adequate security measures, and Crum & Forster's Nick Economidis said insurers were using coinsurance and sublimits rather than broad exclusions.
Pricing has since reversed. Marsh's Global Insurance Market Index for the second quarter of 2026 reported global cyber rates down 4%, following a 5% decrease in the first quarter, the twelfth consecutive quarterly decline, with U.S. cyber rates down 2%. IOA's 2026 midyear cyber report says many accounts are seeing lower retentions and that some sublimits are being eased, and that capacity is plentiful with no blanket limit restrictions, particularly for accounts with solid cyber hygiene.
That is a negotiating opening, not a guarantee. Relief is concentrated among insureds who can show controls. A soft market also does not repeal the exposure: ransomware losses depend on how long you are down, and the terms you accept today are the ones that apply when the market tightens. See what drives the cost of cyber insurance for the other drivers of premium.
Controls that move the terms
Underwriters set ransomware terms from what they see in the application, so this is where you have leverage. The items that matter most are multi-factor authentication on email, remote access and privileged accounts, endpoint detection and response, offline or immutable backups with restores that you have actually tested, patch management, and segmentation. MFA, EDR and backups: the controls cyber insurers now require covers each in detail, and the cyber insurance readiness checklist helps you prepare evidence.
Two cautions. First, treat the application as a legal document. IOA's report warns that inaccurate or incomplete answers found during a claim investigation can lead to coverage disputes, denial or rescission. If you say MFA covers all remote access and it does not, a ransomware claim is where that comes out. Second, some carriers tie the coinsurance to specific conditions. Chubb's neglected software exploit endorsement, described in the Covington article, reduces the insurer's limit and raises the insured's share the longer a known software vulnerability went unpatched before the incident. Ask whether your policy has a similar patching provision, and what the time windows are.
Negotiating checklist at renewal
- Ask for quotes with and without the ransomware sublimit and coinsurance, and compare the premium difference to the exposure you would retain.
- If a sublimit stays, push for the sublimit to equal your realistic worst-case ransomware loss, which is usually driven by days of downtime, not the ransom.
- Ask whether a stronger set of controls, such as MFA everywhere and tested immutable backups, qualifies you for full limits or a lower coinsurance percentage.
- Get the order of application in writing, with a sample calculation.
- Confirm that the ransom payment, negotiator and forensic costs are payable subject to law. Payment to a sanctioned party is a separate problem: paying a ransom: sanctions risk and reporting rules explains OFAC's strict-liability stance and why insurers want a sanctions check before they fund a payment.
- Compare the ransomware terms in a package-policy cyber endorsement carefully. IOA warns that endorsements usually have restrictive wording and lower limits than a stand-alone cyber policy.
A broker who places cyber regularly can request these terms from several markets. Compare the actual endorsements, not the carriers' marketing summaries. For the claim itself, see ransomware and cyber insurance: how claims work and the cyber insurance application: what underwriters ask and how to answer.
Key takeaways
- A ransomware sublimit caps the insurer's payment below the policy limit, and coinsurance makes you pay a percentage of covered loss on top of the retention.
- The sequence in which the retention, coinsurance and sublimit apply can change your out-of-pocket loss by hundreds of thousands of dollars on a seven-figure claim, so get a worked illustration in writing.
- Check how the endorsement defines a ransomware event and which cost heads, including business interruption and data-theft extortion, fall inside the sublimit.
- Cyber pricing has fallen for twelve straight quarters as of Q2 2026 and some carriers are easing sublimits, but better terms go mainly to buyers who document MFA, tested backups and patching.
- An inaccurate application can undo the coverage you negotiated, so answer the controls questions precisely.