Skip to content
Calcrivo

Cyber Insurance Coverage Calculator

Test whether a cyber policy covers the modelled loss: limits, sub-limits, retention, waiting period and uninsured residual.

Inputs

currency
currency
currency
currency
currency
hours
hours
currency/hour
currency

MFA, EDR, offline backups and patching are commonly warranted

Uninsured Residual Loss

$2,000,000

Expected Recovery

$10,000,000

Loss Inside the Waiting Period

$540,000

Business Interruption Shortfall

$960,000

Coverage Ratio

83.3%

Premium as Share of Limit

3.80%

Adequacy Verdict

Partial — a material uninsured residual remains, usually from sub-limits

Step by step

  1. Values used

    Modelled worst-case loss = 12,000,000 currency; Aggregate policy limit = 10,000,000 currency; Retention or deductible = 250,000 currency; Business interruption sub-limit = 5,000,000 currency; Business interruption portion of the loss = 6,500,000 currency; Business interruption waiting period = 12 hours; Expected outage length = 72 hours; Loss per hour of outage = 45,000 currency/hour; Annual premium = 380,000 currency; Warranted controls fully in place = Yes

  2. Cyber Insurance Coverage

    recoverable = min(policyLimit, max(0, claimable − retention)), where claimable applies the business interruption sub-limit and removes the loss falling inside the waiting period.

  3. Uninsured Residual Loss

    = 2,000,000

  4. Expected Recovery

    = 10,000,000

  5. Loss Inside the Waiting Period

    = 540,000

  6. Business Interruption Shortfall

    = 960,000

  7. Coverage Ratio

    = 83.3

  8. Premium as Share of Limit

    = 3.80

How it works

The headline limit is rarely what determines recovery. Business interruption sub-limits, a waiting period that excludes the first several hours, and the retention all reduce the claimable amount before the limit is ever reached — which is how a ten-million policy responds to a twelve-million loss with far less than ten. Control warranties are modelled explicitly because failing one is the most common cause of a reduced or denied claim. The number that matters is the uninsured residual, because that is what the business actually absorbs — and it is usually much larger than the gap between the loss and the limit.

Formula

Cyber Insurance Coverage

recoverable = min(policyLimit, max(0, claimable − retention)), where claimable applies the business interruption sub-limit and removes the loss falling inside the waiting period.

claimable
Loss that falls within cover after sub-limits
retention
Deductible borne before the policy responds
waitingPeriod
Initial outage hours excluded from business interruption cover
warrantyFactor
Halves modelled recovery where warranted controls are not in place

Frequently Asked Questions

How is Cyber Insurance Coverage calculated?

recoverable = min(policyLimit, max(0, claimable − retention)), where claimable applies the business interruption sub-limit and removes the loss falling inside the waiting period. The headline limit is rarely what determines recovery. Business interruption sub-limits, a waiting period that excludes the first several hours, and the retention all reduce the claimable amount before the limit is ever reached — which is how a ten-million policy responds to a twelve-million loss with far less than ten. Control warranties are modelled explicitly because failing one is the most common cause of a reduced or denied claim.

Why does Cyber Insurance Coverage matter?

The number that matters is the uninsured residual, because that is what the business actually absorbs — and it is usually much larger than the gap between the loss and the limit.

What values do I need to enter?

This calculator takes 10 inputs: Modelled worst-case loss, Aggregate policy limit, Retention or deductible, Business interruption sub-limit, Business interruption portion of the loss, Business interruption waiting period, Expected outage length, Loss per hour of outage, Annual premium, Warranted controls fully in place. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does the waiting period matter so much?

Because it excludes the most expensive hours. A 12-hour waiting period against a 72-hour outage removes a sixth of the interruption loss from cover before any sub-limit applies, and it is one of the cheapest terms to negotiate down.

What happens if a warranted control is not in place?

It depends on the wording, but the insurer may reduce or decline the claim on the basis of a misrepresentation in the application. The model halves the expected recovery to keep that risk visible; in practice the range runs from a modest reduction to nothing at all.

You might also need