What Cyber Insurance Actually Covers: Ransomware, BEC & the Exclusions That Surprise Businesses

Most buyers discover what their cyber policy really says during an incident — the most expensive possible time. Here is the map, and the three places small-business claims go sideways.

The two halves of a cyber policy

The three fine-print traps

1. Social engineering and funds-transfer fraud sublimits

The most common and most expensive small-business cyber loss is not ransomware — it is a convincing email that moves money. The FBI's IC3 logged $3.0 billion in reported business email compromise losses in 2025, the costliest enterprise attack category (IC3 2025 Annual Report). Yet many policies cover it only by endorsement, or cap it at $100K–$250K under a $1M policy. If your business wires money or pays vendor invoices, this sublimit is the first number to check on any quote.

2. The "failure to maintain" problem

Policies increasingly tie coverage to the security controls you attested to on the application — MFA, EDR, backups. Let a control lapse (or attest to one you never had) and the carrier has grounds to reduce or deny. Treat the application checklist as an ongoing obligation, not a one-time form.

3. War, nation-state, and infrastructure exclusions

Cyber policies exclude "war," and carriers have modernized that language for state-linked attacks; policies also commonly exclude failures of core infrastructure (power, internet backbone). For most small businesses this is a low-probability edge — but it is why two policies with the same limit are not the same product.

Ransomware, specifically

Ransomware complaints to the FBI keep climbing — 3,611 reported in 2025, up from 3,156 in 2024 — and reported dollar figures dramatically understate true costs, since downtime and rebuild usually dwarf any ransom. A good policy responds on three fronts: the extortion itself, the restoration, and the business interruption. The quality of the carrier's incident-response panel — who picks up the phone at 2 a.m. — matters as much as the limit. Pricing for all of this is covered in our 2026 cost guide.

How to buy this well

• Match the social-engineering sublimit to how much money your business actually moves in a week.
• Ask which named EDR/backup vendors earn carrier credits — sometimes the security upgrade is cheaper than the premium difference.
• Read the business-interruption waiting period (hours matter) and the retention.
• Confirm the incident-response panel and hotline before you need them.