How Underwriters Actually Calculate
Your Cyber Liability Insurance Cost:
The B2B and SaaS Founder’s Guide
Insurance underwriters don’t look at your pitch deck. They run a formula. Your premium is calculated using your record count, data sensitivity class, revenue tier, industry multiplier, and a 12-domain security control scorecard. One failing domain — say, no MFA on remote access — can double your premium or trigger a policy denial. Here is the exact model they use, and how to engineer your way to a lower rate.
1. The Underwriting Model: What Insurers Actually Measure
Most founders think cyber insurance is priced like general liability — you describe your business, an agent picks a rate from a bracket, and you sign. That model ended around 2019 when the ransomware loss ratio on cyber policies became catastrophically unprofitable for carriers. What replaced it is a structured underwriting assessment that looks, in many ways, more like a security audit than an insurance application. Today’s cyber underwriters are running systematic risk scoring models built on actuarial loss data from thousands of breach events — and the output is a risk-adjusted premium that directly reflects the specific attack surface characteristics of your business.
The underwriting model has five primary input layers: (1) exposure size, measured by record count and annual revenue; (2) data sensitivity classification, which determines the per-record liability multiplier; (3) industry vertical risk class, which sets the baseline loss probability; (4) security control maturity scores across 10 to 15 standardized domains; and (5) prior claims and loss history. Understanding how each layer affects your premium is the difference between paying $8,000 per year for $2 million in coverage and paying $32,000 for the same coverage — or being declined entirely.
2. Exposure Calculation: The Record Count Formula
The first and most concrete number in your cyber underwriting submission is your record count — the total number of individual data subjects whose information you store, process, or transmit. This is not your customer count. It includes every current and former customer, every employee and contractor, every contact in your CRM, and every user of any product you operate. For a B2B SaaS platform, this number is almost always larger than founders expect, because it includes the downstream data of your customers’ customers — the end users of businesses that use your API, your platform, or your data infrastructure.
That 14× gap between founder-estimated record count and underwriter-calculated exposure is not unusual. It reflects three systematic undercounts: CRM records that never converted to customers but contain PII (name, email, company, phone number) are PII under virtually all state breach notification laws; API-transmitted end-user records where the SaaS platform processes data on behalf of its B2B customers are covered under the controller-processor liability chain; and historical employee records retained beyond the deletion policy period that add exposure without adding any business value.
Calculate Your Actual Cyber Exposure in 3 Minutes
Our Cyber Liability Risk Calculator runs the full record-count exposure model, data sensitivity classification, and preliminary premium range estimate — the same inputs your underwriter will use.
3. The 12-Domain Security Control Scorecard
After calculating your exposure, the underwriter applies a security control modifier to the base rate. This modifier is derived from a scored questionnaire covering 10 to 15 security domains — the exact list varies by carrier, but the domains below represent the consensus across the major standalone cyber underwriters (Coalition, Corvus, At-Bay, Cowbell, Chubb, AXA XL). Each domain is weighted by its historical correlation to breach frequency and severity. A perfect score across all domains produces a discount modifier. Any single critical domain failure can produce a surcharge — or, in the case of MFA absence, a policy decline from many carriers since 2022.
4. The Third-Party Dependency Trap: How One Vendor Breaks Your Policy
Here is the scenario that keeps B2B SaaS founders up at night — and the one their insurance broker almost never explains before the breach happens. You run a tightly-managed platform. Your internal security controls score well. Your team uses MFA, your backups are tested, and your IRP is current. Then one afternoon your Slack lights up: a critical zero-day vulnerability has been discovered in a widely-used open-source logging library — or your CRM provider has suffered a breach — or your payment processor’s API has been compromised. Within 24 hours, your customers’ data is in the hands of a threat actor, and your legal team is being contacted about a class action. You didn’t write the vulnerable code. You didn’t get hacked. But you processed the data, you accepted the liability in your customer contracts, and you are now the defendant.
5. Anatomy of a Third-Party Breach Class-Action Lawsuit
The gap between “we didn’t cause the breach” and “we are still liable” is one that many B2B founders discover for the first time in a deposition. The legal mechanism is straightforward: when your customers signed up for your product, they gave you their data in reliance on your privacy policy’s representations about how it would be protected. When a breach occurs — regardless of whether the attack came from your systems or your vendor’s — those customers’ data was exposed while in your custody and control. That is the legal basis for direct claims against you, and it holds regardless of where the technical entry point was.
Full Financial Exposure Before Insurance Recovery
6. Building the Right Cyber Coverage Architecture for B2B and SaaS
The standard broker recommendation for a SaaS company — “$1M to $2M in cyber coverage, add it to your tech E&O endorsement” — was designed for a different threat environment than the one that exists in 2026. The average ransomware demand alone has surpassed $2.73M for enterprise targets. A class-action notification campaign for 200,000 records costs $3M to $7M in notification and credit monitoring before any legal fees. A SaaS company with any B2B customers storing end-user data needs to architect its coverage deliberately, not accept a default.
| ARR Tier | Recommended Limit | Est. Annual Premium | Must-Have Sublimits | Key Endorsements |
|---|---|---|---|---|
| Under $1M ARR Seed / Early Stage |
$1M – $2M | $3,500 – $8,000/yr | Ransomware $500K min; Notification costs $500K min | Social engineering coverage; Invoice fraud rider |
| $1M – $5M ARR Series A / Growth |
$3M – $5M | $12,000 – $28,000/yr | Ransomware $2M min; Notification $1.5M min; Reg defense $1M min | Third-party liability extension; Dependent systems BI coverage |
| $5M – $20M ARR Series B / Scale |
$5M – $10M | $28,000 – $75,000/yr | Ransomware $3M min; Full limit notification; Reg defense $2M+; BI $1M+ | Supply chain / dependent vendor coverage; Media liability; Crisis PR |
| $20M+ ARR Series C+ / Enterprise |
$10M – $25M+ | $75,000 – $220,000/yr | All sublimits at full policy limit; Separate BI limit $5M+; Extortion sublimit $5M+ | Manuscript policy with custom war exclusion carve-back; Captive consideration for self-insured retention above $1M |
First-Party vs. Third-Party Coverage — The Critical Distinction
Every cyber policy is divided into two sections that cover fundamentally different categories of loss. First-party coverage pays for losses to your own business — the cost to respond to the breach, restore your systems, pay a ransom, and keep operating during downtime. Third-party coverage pays for claims made against your business by others — customers, regulators, and affected individuals who suffered harm because your data or systems were compromised. Most of the catastrophic breach costs in the timeline above are third-party losses: notification expenses to other people’s customers, class-action defense, and regulatory fines triggered by harm to affected individuals.
7. Engineering Your Way to a Lower Premium: The 5-Control Strategy
The security control scorecard in Section 3 isn’t just a diagnostic — it is a premium reduction roadmap. Because the underwriter’s security modifier can range from 0.65× (excellent) to 2.20× (poor) on the same base rate, the ROI on improving your security score is directly calculable. For a $28,000 base rate policy, moving from a Below Average (1.45×) to a Good (0.85×) score represents $16,800 per year in premium reduction — recurring, every year, in addition to the direct risk reduction benefit. Here is the five-control implementation sequence that produces the maximum premium reduction per dollar of security spend.
MFA on all remote access, privileged accounts, and email is the single highest-weight control in the underwriting scorecard at 20%. Since 2022, the majority of standalone cyber underwriters (Coalition, Corvus, At-Bay) will decline to quote businesses without MFA enforced on email and remote access. This is not a “nice to have” — it is a binary policy eligibility requirement. Microsoft Entra ID and Google Workspace Conditional Access both support mandatory MFA enforcement at the tenant level. Implementation timeline: 1 to 2 weeks for full deployment, including rollout communications to staff. Cost: $0 for existing Microsoft 365 or Google Workspace subscriptions. Premium impact: eliminates decline risk and removes the most severe surcharge modifier, typically saving 20–40% of total premium annually.
The “immutable backup” question on cyber underwriting applications is specifically designed to assess your ransomware resilience. An immutable backup cannot be overwritten or deleted by ransomware that has compromised your production environment — it is either physically air-gapped (no network connection) or object-locked in cloud storage (AWS S3 Object Lock, Azure Immutable Blob Storage, Backblaze Cloud). The underwriter is also asking whether you have tested restoration from backup within the past 12 months. A documented, tested immutable backup reduces your ransomware business interruption exposure, which directly reduces the underwriter’s loss severity projection for your account. Implementation: AWS S3 Object Lock or equivalent costs $30 to $150 per month for most B2B SaaS platforms. Annual premium saving: typically $4,000 to $12,000 on mid-market policies.
A surprising number of growth-stage SaaS companies — particularly those that have focused on product development over compliance — haveno documented Incident Response Plan. This is an 8% weight domain on the underwriting scorecard, but its absence signals to underwriters something more damaging than the weight suggests: it indicates the company has never formally thought through how it would respond to a breach. That inference — combined with missing IRP — triggers a disproportionate perception of organizational unreadiness that affects how underwriters manually override the automated score. An IRP does not need to be a 200-page document. It needs five things: (1) named incident commander and backup, (2) internal escalation chain with contact numbers, (3) pre-signed retainer with a forensics firm (Coalition, Coveware, or Kroll offer pre-breach retainer agreements), (4) breach notification decision tree mapped to all applicable state laws, and (5) documented tabletop exercise in the past 12 months. Total build time with an outside counsel or vCISO assisting: 15 to 25 hours. Annual premium saving: $2,000 to $6,000 on mid-market policies.
Underwriters explicitly distinguish between legacy antivirus (signature-based detection of known malware) and EDR (behavioral detection of novel threats, active threat hunting, real-time response capability). CrowdStrike Falcon Go, SentinelOne Singularity Core, and Microsoft Defender for Business are all accepted by major underwriters as qualifying EDR platforms. The key requirement is 100% endpoint coverage — including remote work devices — and a centralized management console that an underwriter can verify on application. Cost for a 25-person company: $2,400 to $4,800/year in additional tooling if not already deployed. Annual premium saving: $3,500 to $9,000 on mid-market policies. ROI on tooling investment: typically realized within the first renewal cycle.
Since 2024, underwriters writing policies above $5M in limits have begun requiring an SBOM — a machine-readable inventory of every open-source and third-party software component in your production application. The Executive Order on Improving the Nation’s Cybersecurity (EO 14028, 2021) mandated SBOMs for federal contractors, and the requirement has migrated to the commercial insurance market as underwriters seek to quantify supply-chain exposure. Tools like Syft, CycloneDX, and OWASP Dependency-Track generate an SBOM from your codebase in under an hour. Providing a current SBOM in your underwriting submission demonstrates supply-chain transparency and typically qualifies your application for the Vendor Risk Management domain partial credit — reducing the surcharge on that domain from full penalty to partial. Annual premium impact: $1,500 to $4,000 saving at policies above $5M limit.
Before and After Implementing the 5-Control Strategy
8. Ransomware Coverage: Sublimits, War Exclusions, and OFAC Complications
Ransomware is simultaneously the most common cyber claim event and the most contractually complicated coverage to collect on. Before a ransomware event occurs, every B2B and SaaS policy holder needs to understand three specific policy mechanics that routinely reduce or eliminate ransomware coverage at the moment of claim: sublimit adequacy, the war exclusion clause, and OFAC sanctions compliance.
Following the NotPetya cyberattack in 2017 — which was attributed to the Russian state and caused $10 billion in global damage — insurers began inserting war exclusion clauses into cyber policies to carve out state-sponsored cyberattacks. In 2022, Lloyd’s of London mandated war exclusion language for all standalone cyber policies in the Lloyd’s market, and most admitted carriers followed. The practical problem is this: threat actors that deploy ransomware frequently have ambiguous attribution. When Merck sued its insurer over NotPetya losses, the New Jersey Superior Court ruled in Merck’s favor in 2023 — but the battle demonstrated that insurers will invoke the war exclusion when attribution is even partially unclear. Before purchasing any standalone cyber policy, confirm: (1) does the war exclusion include a carve-back for cyber operations that do not rise to the level of armed conflict, and (2) what is the attribution standard the insurer uses before invoking the exclusion? Poorly-drafted war exclusions have been used to deny otherwise valid ransomware claims.
| Coverage Element | What Adequate Looks Like | Red Flag Language | Risk if Inadequate |
|---|---|---|---|
| Ransom payment sublimit | Full policy limit, or minimum $2M standalone ransomware sublimit for $5M+ policies | “Ransomware payments subject to $500K sublimit” on a $3M policy | Uncovered gap if ransom exceeds sublimit |
| Business interruption during ransomware | BI coverage begins from Hour 1 of confirmed ransomware event, full policy limit | “BI coverage subject to 12-hour waiting period” or “BI capped at $250K” | Lost revenue during system recovery uncovered |
| Digital asset restoration | Covers cost to rebuild/restore encrypted data and systems from backup or from scratch | “Data restoration excluded where backup copies exist” — even if backup is incomplete | Partial restoration costs may be denied |
| Negotiation and response services | Access to insurer’s pre-vetted ransomware negotiation vendor (Coveware, Kroll) included | No panel vendor access — policyholder must self-source negotiator | Higher ransom payment without professional negotiation |
| OFAC compliance coverage | Policy explicitly addresses OFAC-sanctioned entity scenarios — covers legal costs even when payment is blocked | “Insurer will not reimburse any payment to OFAC-sanctioned entity” with no legal defense carve-back | No coverage if ransomware group is later sanctioned post-payment |
| War exclusion carve-back | Explicit carve-back for cyber operations not constituting acts of war; clear attribution standard defined in policy | Broad war exclusion with no cyber-specific carve-back or ambiguous attribution language | State-sponsored ransomware claim potentially denied |
9. Choosing the Right Cyber Insurance Broker for a B2B or SaaS Business
The difference between a retail general insurance broker who adds cyber as an endorsement to your BOP and a specialist standalone cyber broker is not a matter of cost — it is a matter of whether your coverage actually pays when you need it. General brokers place cyber coverage using standardized forms with off-the-shelf sublimits that were not designed for the specific exposure profile of a B2B SaaS platform processing third-party data. A specialist broker reviews the actual policy form, negotiates sublimit adequacy, understands the third-party liability chain specific to your product architecture, and knows which carriers are paying claims versus which are litigating them.
Calculate Your Cyber Liability Exposure and Premium Range Now
Our free Cyber Liability Risk Calculator runs the full record-count exposure model, applies your industry vertical multiplier, and generates a preliminary premium range estimate — the same inputs your underwriter uses to price your policy.
Open Cyber Risk Calculator →Frequently Asked Questions
How is cyber liability insurance cost calculated?
Cyber liability insurance premiums are calculated using a multi-factor underwriting model that weighs: (1) the number and sensitivity classification of records stored or processed, (2) annual revenue as a proxy for attack surface size and litigation exposure, (3) industry vertical risk multiplier, (4) security control maturity scores across 10 to 15 standard domains, and (5) prior claims history. The base rate is expressed as a premium per $1 million of coverage — ranging from $1,200 to $4,800 per million for small-to-mid-market businesses in 2025 — modified by the security control score to produce the final premium. A company with poor security controls can pay 3 to 5 times the base rate of an equivalent company with strong controls.
What is the average cost per record in a data breach?
According to IBM’s 2025 Cost of a Data Breach Report, the global average cost per compromised record was $173. For US-based businesses, the per-record cost was $239, reflecting the litigation environment and 50-state breach notification compliance costs. Healthcare records carry the highest per-record cost at $429, followed by financial services at $302. The per-record cost includes detection and escalation, notification and credit monitoring, post-breach response, and lost business and reputational damage — the last of which represents approximately 38% of total cost.
Does cyber liability insurance cover ransomware?
Most standalone cyber liability policies include ransomware coverage as a component of first-party cyber coverage, but scope and sublimits vary significantly between policies. Standard ransomware coverage typically includes: ransom payment reimbursement, digital asset restoration costs, business interruption losses during downtime, and cyber extortion response costs. Key exclusions include: payments to OFAC-sanctioned entities, state-sponsored attacks under war exclusion clauses, and older policies with inadequate sublimits given the escalation in average ransom demands to $2.73M in 2025. Sublimit adequacy is the critical review item — a $3M policy with a $500K ransomware sublimit provides only $500K in ransomware coverage.
What cyber security controls most reduce insurance premiums?
The five security controls that most significantly reduce cyber liability premiums are: (1) Multi-factor authentication enforced across all remote access, privileged accounts, and email — failure to implement MFA can result in policy non-renewal or 25–40% premium surcharge; (2) Endpoint Detection and Response deployed on all endpoints; (3) Immutable off-site backup with tested restoration capability; (4) Privileged Access Management limiting blast radius of compromised credentials; and (5) a documented Incident Response Plan with tabletop exercises in the past 12 months. Companies with all five controls typically qualify for premium discounts of 15–35% versus companies missing two or more.
Can I be held liable for a data breach caused by a third-party vendor?
Yes. Under US data protection law, the organization that collects or processes customer data bears primary legal responsibility for its protection, regardless of which vendor caused the breach. If your CRM, analytics platform, payment processor, or any third-party software in your stack suffers a breach that exposes your customers’ data, you face the notification obligations, regulatory fines, and class-action exposure. This is third-party or supply chain cyber liability. The 2020 SolarWinds breach, 2021 Kaseya ransomware attack, and 2023 MOVEit vulnerability all produced cascading liability for downstream companies whose only connection to the attack was a vendor relationship.
How is cyber liability insurance cost calculated?
Cyber liability insurance premiums are calculated using a multi-factor underwriting model that weighs: (1) the number and sensitivity classification of records stored or processed, (2) annual revenue as a proxy for attack surface size and litigation exposure, (3) industry vertical risk multiplier (healthcare and financial services carry the highest multipliers), (4) security control maturity scores across 10 to 15 standard domains (MFA enforcement, endpoint detection, patch management, backup architecture, incident response plan), and (5) prior claims history. The base rate is expressed as a premium per $1 million of coverage, which ranged from $1,200 to $4,800 per million for small-to-mid-market businesses in 2025, modified by the security control score to produce the final premium. A company with poor security controls can pay 3 to 5 times the base rate of an equivalent company with strong controls.
What is the average cost per record in a data breach?
According to IBM’s 2025 Cost of a Data Breach Report, the global average cost per compromised record was $173. For US-based businesses, the per-record cost was significantly higher at $239 per record, reflecting the US’s litigation environment, regulatory notification requirements across 50 state laws, and higher average breach remediation costs. Healthcare records carry the highest per-record cost at $429, followed by financial services at $302. The per-record cost includes four components: detection and escalation costs, notification and credit monitoring costs, post-breach response costs, and lost business and reputational damage costs — the last of which is the single largest component at approximately 38% of total.
Does cyber liability insurance cover ransomware?
Most standalone cyber liability policies include ransomware coverage as a component of the first-party cyber coverage section, but the scope and sublimits vary significantly between policies. Standard ransomware coverage typically includes: ransom payment reimbursement (up to policy limit, subject to sublimits), digital asset restoration costs, business interruption losses during system downtime, and cyber extortion response costs including negotiation services. However, several exclusions apply: most policies exclude ransomware payments to OFAC-sanctioned entities, some policies exclude state-sponsored attacks under a war exclusion clause, and older policies issued before 2021 may have inadequate sublimits for ransomware given the escalation in average ransom demands. The average ransomware payment in 2025 was $2.73 million for enterprise targets, up from $812,000 in 2022 — making sublimit adequacy a critical policy review item.
What cyber security controls most reduce insurance premiums?
The five security controls that most significantly reduce cyber liability premiums — and that underwriters weight most heavily in their questionnaires — are: (1) Multi-factor authentication (MFA) enforced across all remote access, privileged accounts, and email — failure to implement MFA can result in policy non-renewal or 25-40% premium surcharge; (2) Endpoint Detection and Response (EDR) deployed on all endpoints — demonstrates active threat monitoring rather than passive antivirus; (3) Immutable off-site backup with tested restoration capability — directly reduces ransomware business interruption exposure; (4) Privileged Access Management (PAM) — limits the blast radius of any single compromised credential; and (5) Documented Incident Response Plan with tabletop exercises in the past 12 months — demonstrates organizational readiness that reduces breach escalation cost. Companies with all five controls typically qualify for premium discounts of 15-35% versus companies missing two or more.
