Cyber insurance insurers: a shortlist, not a ranking

In most lines you buy a promise to pay. Cyber adds a phone number, a panel of specialists, and the questions the insurer asked before it sold you anything.

Those three things separate carriers more than price does. If you're searching for the best cyber insurance insurers, this is a shortlist, not a ranking: here are the carriers brokers actually place this cover with, what each is known for, and how to read the quote that follows.

What to take away

The carriers worth shortlisting

Chubb. A global admitted carrier writing cyber for middle-market and large accounts, often as part of a broader management liability package. Its panel and incident response process are among the most established in the market. Suits buyers who want one carrier across several lines.

AIG. Writes large and complex cyber programs, including for financial institutions and healthcare. Known for capacity and for underwriting detail on controls. Suits buyers with a dedicated security function that can answer a long application.

Beazley. A specialist Lloyd's and admitted market underwriter that has written cyber longer than most. Strong on breach response and on professional services firms. Suits buyers who want a carrier whose book is concentrated in this line.

Coalition. A managing general agent backed by admitted and surplus lines carriers, combining the policy with continuous security monitoring. Suits small and mid-sized businesses without a security team, since the scanning is part of the product.

Travelers. A large admitted carrier offering cyber to small and middle-market businesses, frequently bundled with its commercial package. Suits buyers who value an established brand and a simple application.

This is a shortlist, not a ranking. The right carrier depends on your revenue, your sector and your controls, and the industry guide sets out how those differ by trade.

The four things worth judging

The panel. Most cyber policies route incident response through approved vendors: forensic firms, specialist counsel, notification services and negotiators. On the night it matters, those firms are the product.

CISA's #StopRansomware Guide sets out the same response sequence a panel works through, which makes it a fair yardstick.

Ask who is on the panel, whether you may add your own vendors with approval, and how fast the hotline answers.

The wording. There is no widely used standard form for this line the way there is for property or general liability. Each insurer writes its own, and the insuring agreements, definitions and exclusions differ in substance. "Is this a good insurer" cannot be separated from "is this a good wording."

The questions an insurer asks show how it underwrites. A carrier that asks in detail about backups, access and payment verification is pricing the things that reduce loss. A carrier that asks almost nothing is pricing on averages.

The safeguards these applications circle are addressed in NIST's Cybersecurity for Small Business guidance.

How those answers reach a price is set out in what a cyber premium is built from.

The claims history. Ask the broker how the carrier has handled incidents on accounts like yours: how fast it assigned counsel, how often it disputed a control condition, whether it paid panel costs incurred before approval. Nobody volunteers this.

Reading the quote, in order

Take the document and work through it in this sequence, ignoring the price until the end.

1. The schedule of insuring agreements. Which heads of cover are included: incident response, business interruption, data restoration, extortion, funds transfer fraud, privacy liability, network security liability, regulatory costs, media liability. A quote missing a head you need is a different product, not a cheaper one.

The two halves of a cyber policy and why the sub-limits matter are explained in the overview of the line. The general discipline of reading structure before price is in the renewal reading guide.

Admitted or not

A good deal of cyber business is written by insurers not licensed in the buyer's state, through the surplus lines market. That is not a warning sign in itself; it is how unusual or fast-moving risks get placed.

It does mean the wording is not filed with your state, and it generally means state guaranty fund protection does not apply if the insurer fails. Your broker should say plainly which kind of market each quote comes from. Your state insurance department can explain what the difference means where you are.

Financial strength is assessed by independent rating agencies such as AM Best. Your broker can show you the current assessment for any carrier proposed. Ask for it rather than inferring it from familiarity.

Questions to put to the broker, once per quote

Compare the answers, not the names. A licensed broker who can see your application, your data and your contracts is the person who decides which offer fits a real business, and the reasons should be written down.

Common questions

Is the biggest cyber insurer the safest?

Size relates to capacity to pay, which is one input. It says nothing about the panel, the wording, or how a claim is handled. Ask about those directly.

A quote is much cheaper than the others. Why?

Usually because the sub-limit table, the waiting period, or a control condition is doing work the headline does not show. Lay the insuring agreements side by side and the gap normally explains itself.

Should I stay with the same insurer to keep the retroactive date?

Continuity of the retroactive date is worth a great deal on a claims-made policy. If you switch, ask the new insurer to match the expiring date and get that in writing before binding.

Can I check an insurer's complaint record?

Your state insurance department handles complaints about insurer conduct and in many states publishes information about them. Ask what your department makes available and how to read it.