How Much Cyber Insurance Do I Need?

There is no universal limit that fits every company. Build a loss estimate around the information you hold, how long critical operations could be unavailable, dependence on cloud and other vendors, contractual duties, and the costs of forensic response, legal advice, notification, restoration, and claims. The FTC’s first-party and third-party categories can help you organize those estimates, but they do not prescribe a limit.

Compare the overall aggregate with any lower sublimits for extortion, funds transfer fraud, business interruption, or response services. Model the retention and time waiting period against cash reserves, and ask whether defense expenses reduce the liability limit. Check event aggregation language, dependent-system coverage, and restoration-period definitions. The selected limit should reflect a documented risk estimate, not a generic revenue multiple.