Executives often assume cyber insurance will pay for most of the damage from an incident. A 2019 FM Global survey of CFOs, as reported on Wikipedia, found 71 percent expected insurers to cover most or all of their losses. Policies often leave gaps, so check what yours excludes, caps and requires.
The expectation gap
According to the Wikipedia entry on cyber insurance, the FM Global survey of CFOs at large companies found 71 percent believed insurers would cover most or all of their losses. Many also expected uncovered damages, including brand devaluation (50 percent) and revenue decline (over 30 percent).
The numbers come from a secondary summary of a 2019 survey, so read the original survey before you quote it. The point stands without it: leaders and policies do not always agree about what is covered.
Where gaps tend to appear
Policies differ, so verify each of these against your own wording.
- Exclusions. Policies typically include a war exclusion. See the NotPetya example.
- Limits and sublimits. An overall limit may be split into smaller caps for ransom, notification or business interruption.
- Retention. The amount you pay first before cover starts.
- Waiting periods. Business interruption cover may start only after a set delay.
- Conditions. Cover may depend on controls you said you had. If an application statement was wrong, claims can be disputed. See how a CISO should prepare a cyber insurance application.
- Reputation and future revenue. The survey summary suggests these are the losses leaders expect to lose without cover, so test whether any part is insured.
A short checklist
- Ask your broker for a one page summary of limits, sublimits, retention and waiting periods.
- List the five incidents you most fear and walk each through the policy.
- Compare the application answers with what is true today.
- Check exclusions for state backed events, infrastructure outages and supplier failures.
- Confirm what the insurer needs from you after an incident and in what time.
- Check whether the insurer's approved responders are the ones you plan to call.
- Write down what stays uninsured and decide whether to accept it.
Using it in a risk decision
Insurance is one of the four classic treatments, along with reduce, avoid and accept. See four risk treatment options. It changes who pays, not whether the incident happens. The residual risk goes into your register.
This is educational material, not legal or insurance advice.
Quick check
Does cyber insurance pay for lost reputation?
Not necessarily. Many policies cover specific costs, and brand damage and lost future revenue are often hard to insure. Check your own wording.
What is the quickest way to find gaps?
Walk your five most feared incidents through the policy and see which costs are excluded, capped or conditional.
Sources
Last reviewed: 19 October 2026.
