A mid-market company buys a $2 million cyber liability policy and assumes it has $2 million in coverage for any event. Then a ransomware attack hits, and the claims adjuster points to a $100,000 sublimit on extortion payments, a $50,000 retention the company must pay first, and a 20% coinsurance clause that splits the remaining loss. That $2 million policy suddenly looks very different on paper than it does in practice.

Understanding the mechanics of sublimits, retentions, and coinsurance in a cyber policy is not optional: it is the difference between a policy that responds meaningfully and one that leaves your balance sheet exposed. These three cost-sharing provisions determine how much of a covered loss the carrier actually pays and how much falls on you. Misreading even one of them can turn an insured loss into a financial crisis.

This consolidated guide to cyber insurance sublimits, retentions, and coinsurance breaks down each provision, explains how they interact, and shows you what to look for before you bind a policy. Whether you are a CFO reviewing renewal terms or an IT lead evaluating your company's risk transfer strategy, the goal here is the same: know exactly what triggers your policy and where the coverage grant stops.

Every cyber liability policy distributes financial responsibility between the policyholder and the carrier. The three primary mechanisms for this distribution are sublimits, retentions, and coinsurance. Each one operates differently, but they share a common purpose: controlling the insurer's exposure while defining what the insured must absorb.

Sublimits cap the amount payable for specific categories of loss. Retentions establish the dollar amount or time period the insured must satisfy before the policy begins to pay. Coinsurance requires the insured to share a percentage of covered losses above the retention. These provisions are not interchangeable, and they frequently stack on top of each other within a single claim.

A company with 150 employees in healthcare, for example, might carry a $1 million aggregate policy with a $250,000 sublimit on regulatory defense, a $25,000 retention, and 10% coinsurance on business interruption. If a breach triggers all three, the actual payout from the carrier could be substantially less than the headline limit suggests. Reading the policy form at the insuring-agreement level, not just the declarations page, is where the real picture emerges. Bloc Cyber's placement process includes a form-level review of these provisions before binding precisely because the declarations page alone does not tell the full story.

A retention is the amount of loss the insured must bear before the carrier's obligation to pay begins. It functions as your minimum out-of-pocket cost on any covered claim. Retentions in cyber policies typically range from $2,500 for small accounts to $100,000 or more for mid-market and larger risks.

The retention amount directly affects your premium. A higher retention lowers the premium because you are absorbing more of the initial loss. But choosing a retention that exceeds your available cash flow creates a different problem: you cannot afford to trigger the policy when you need it most. Stress-testing your retention against a realistic breach scenario, including forensic investigation, legal counsel, notification costs, and business interruption, is essential before you agree to the number.

Deductibles vs. Retentions in Cyber Policies

The terms "deductible" and "retention" are often used interchangeably, but they carry different legal implications in some policy forms. A deductible is typically subtracted from the loss payment the carrier makes. A self-insured retention, by contrast, requires the insured to pay the retention amount directly before the carrier has any payment obligation at all.

The practical difference shows up during a claim. With a deductible, the carrier may begin managing the claim and then subtract the deductible from the payout. With a self-insured retention, the carrier may not engage until you demonstrate that you have satisfied the retention. For a company with limited cash reserves, this distinction can delay incident response at the worst possible time. Your policy form will specify which structure applies, and you should confirm this with your broker before binding.

Waiting Periods as Time-Based Retentions

Business interruption coverage in cyber policies typically includes a waiting period, often 8 to 12 hours, before the carrier begins calculating covered lost income. This waiting period functions as a time-based retention: you absorb all business interruption losses that occur during that window.

For a company generating $50,000 per day in revenue, an 8-hour waiting period represents roughly $16,600 in unrecoverable loss. Some policies apply the waiting period retroactively once it is satisfied, meaning losses during the waiting period are then covered. Others do not. The difference between these two structures can represent tens of thousands of dollars on a single claim. Read the business interruption insuring agreement carefully, paying particular attention to whether the waiting period is a true deductible or a retroactive trigger.

Coinsurance requires the insured to pay a fixed percentage of covered losses above the retention. A 10% coinsurance clause means that after you satisfy your retention, you pay 10% of every additional dollar of covered loss and the carrier pays 90%.

This provision is most common in the business interruption section of cyber policies, though it can appear in other insuring agreements. On a $500,000 business interruption loss with a $25,000 retention and 10% coinsurance, the math works out as follows: you pay the $25,000 retention, then 10% of the remaining $475,000 ($47,500), for a total out-of-pocket cost of $72,500. The carrier pays $427,500.

Coinsurance clauses are sometimes negotiable, particularly on accounts with strong security controls and low claims history. If your policy includes coinsurance, ask your broker whether it can be reduced or eliminated at renewal. Over 40% of cyber insurance claims are denied, with 82% of those denials tied to the absence of multi-factor authentication, so demonstrating strong controls can give you negotiating power on coinsurance terms as well.

The critical point is that all three can apply to the same claim simultaneously. A ransomware event could hit a sublimit on extortion payments, require satisfaction of a retention before any payout, and then apply coinsurance to the business interruption component. Understanding each provision in isolation is necessary but not sufficient: you need to model how they interact on a realistic claim.

Does my sublimit reduce my overall policy limit? Yes. Sublimit payments count against your aggregate policy limit. A $100,000 ransomware sublimit payment reduces your remaining aggregate by $100,000.

Can I buy back a sublimit to get full policy limits? Some carriers offer endorsements that raise or eliminate specific sublimits for an additional premium. Ask your broker whether this option exists on your policy form.

Is my retention the same as my deductible? Not always. A self-insured retention requires you to pay out of pocket before the carrier engages, while a deductible is subtracted from the carrier's payment. Check your policy form for the specific structure.

Do waiting periods apply to data breaches or just business interruption? Waiting periods are primarily a business interruption provision. Breach response costs, such as forensics and notification, typically trigger after the dollar-based retention is met, not a time-based waiting period.

What happens if my claim exceeds the sublimit? You absorb the difference. If forensic costs reach $400,000 and your sublimit is $250,000, you pay the remaining $150,000 out of pocket, even if your aggregate limit has capacity.

Can coinsurance apply to breach response costs? It can, though it is more common in business interruption sections. Review each insuring agreement separately, as coinsurance may apply to some coverages and not others.