What a cyber insurance calculator actually does with the numbers you enter

This page does not calculate anything. There is no form to fill in and no figure at the bottom, and that is deliberate.

It opens up the machine: what a premium calculator on any website does with what you type into it, and why the result is not a quote and cannot become one.

If you have used one and are wondering how seriously to take the result, the answer is below. If you are about to build a budget line from one, read this first.

What to take away

What you type in

A typical cyber calculator asks for a handful of things: annual revenue, industry from a dropdown, the number of records you hold, sometimes the number of employees, and a few yes-or-no questions about controls such as multi-factor authentication and backups. Some ask for the limit you want. That is usually the whole form.

Each of those is a stand-in for something the tool cannot measure directly. Revenue stands in for the income that stops during an outage. Records stand in for notification and liability exposure.

Industry stands in for what attackers want and what regulators require, which is a real effect and a coarse one, described at length in the industry guide. The control questions stand in for likelihood. They are reasonable proxies, and a real underwriter starts with the same ones.

What happens to the inputs

Inside the tool is a table: a base rate per unit of exposure for each industry, a multiplier for the record count, an adjustment for each control, and a factor for the chosen limit. The tool multiplies your inputs through that table and rounds.

That is the whole calculation. It holds no judgment, no reading of your answers against each other, and no memory of what the market did last quarter.

Three things about that table are worth knowing. You cannot see it, so you cannot tell how old it is or whose experience it reflects. It is one table, whereas a real placement involves several insurers with different appetites for your class. And it treats every "yes" to a control question as true, which an underwriter does not.

What comes out, and what it is not

The output is a number, and a number is persuasive in a way a paragraph is not. But consider what the tool never saw.

Your actual application. A real submission runs to pages of control questions, and the answers interact. A calculator with five checkboxes has not underwritten you.

The wording. Two policies at the same price can differ in the waiting period on interruption cover, in the sub-limit for funds transfer fraud, in the retroactive date, in whether a control that lapses mid-term voids the claim. The calculator priced none of that. It priced a headline limit and assumed a policy exists behind it. The mechanics that decide a cyber claim are set out in the overview of the line.

Appetite. Whether any insurer wants your class this year is the largest single variable in a real quote. A calculator will price a business no market would write.

Your history. Prior incidents, prior claims, and prior knowledge of circumstances are asked about on every real application and are absent from nearly every calculator.

The date. Pricing in this line can move within a single year. A table built on one period's experience says nothing about the next.

A quote is an offer from a named insurer, on a specific form, for a specific period, made after reading a specific application, and capable of being accepted. A calculator result is none of those. It is a sketch of what a business shaped like yours might have paid, according to someone, at some point.

The one honest use

Change one input at a time and watch what moves. If doubling the record count changes the result more than doubling revenue does, you have learned something true about how this line is priced, and it will hold when you talk to a broker.

If switching a control from "no" to "yes" changes the result a great deal, that is the tool telling you which controls the market cares about. Those are rarely exotic: the free cyber hygiene services CISA offers cover much of the same ground the checkbox does.

That is a sensitivity test, and it is useful. It tells you which questions to prepare for. It does not tell you the answer to any of them.

What to do instead

Assemble what a real underwriter asks for, honestly: revenue, a data inventory by type and count, a written account of controls, loss history, and contracts that require cover.

With no structure for that account, the Cybersecurity Framework from NIST gives you one an underwriter will recognize. How your answers move a price is set out in how a cyber premium is built.

Each of those is an input a real underwriter weighs against the others, which is the step no table performs. Then take the package to a licensed broker and ask for more than one market. What comes back is a quote, and the way to read one against another is in the renewal reading guide.

Your state insurance department licenses the insurers and intermediaries involved, and can confirm whether a company offering you a figure online is licensed to write the business where you are. A tool that produces a number and a "buy now" button is worth checking against that register before anything else.

Common questions

Why publish a calculator page that does not calculate?

Because a number here would be invented, and an invented number about insurance is worse than none. The mechanism is the useful part, and it is the part calculators leave out.

A calculator and my broker gave very different figures. Which is wrong?

The broker's figure is a quote from a market that read your application. The calculator's is a table's estimate about a stranger. They are not measuring the same thing, so neither is "wrong" about the other.

Can I use a calculator result in a budget?

As a placeholder that you have labeled as one, with the real figure to follow from a broker. Not as a commitment.

The calculator asked for my email before showing the result. Is that normal?

It is common, and it tells you the tool's job is to generate a sales lead rather than to inform you. Treat the figure accordingly.