Mid-market companies buy cyber insurance the way they buy most insurance: by comparing the premium and the headline limit. The policies diverge exactly where the claims live — sublimits, conditions, and panel requirements buried in endorsements — and the divergence is discoverable in advance by anyone who knows which questions to ask. This is the evaluation checklist the brokers who place this coverage well actually run: the essential questions for a mid-market buyer, in the order a claim would ask them.
Start with the loss scenarios, not the limit
Price three mornings. Ransomware takes the file estate down for nine days during your busy season: what does the downtime cost, at your gross margin, plus response? A finance employee is socially engineered into a six-figure wire: is that loss inside this policy at all, and under what conditions? Your core platform vendor is breached and your data with it: do you have coverage for a loss that starts on someone else’s network (dependent or contingent business interruption), and whose incident triggers it? A policy evaluated against named scenarios produces numbers; a policy evaluated against a limit produces a purchase. Everything below hangs off those three answers.
The checklist
Limits and sublimits. What is the full limit — and then, what are the sublimits for ransomware/extortion, social engineering and funds-transfer fraud, dependent business interruption, and bricking/hardware replacement? Mid-market forms routinely carry the headline at $1M or more and the losses companies actually have at a fraction of it. The social engineering conditions. Funds-transfer fraud coverage is frequently conditioned on callback verification procedures — coverage that evaporates if your own documented process was not followed. Read the condition before you need it; it is effectively part of your finance procedure now. Business interruption mechanics. The waiting period (hours of downtime before coverage begins), the indemnity period, whether voluntary shutdown counts, and how dependent interruption is triggered and proved. The panel. Which breach coaches and forensic firms are pre-approved, whether you may use your own incident-response retainer, and what spend before notice is treated as covered. The retroactive date and continuity. Cyber is claims-made: an intrusion that began before the retro date but is discovered after is a fight you do not want; continuity across renewals and carrier switches is the quiet term that decides it. The exclusions with teeth. War and state-backed-attack language (actively litigated in recent years over NotPetya-era losses), infrastructure failure, and the failure-to-maintain condition — the form’s right to contest coverage if the controls you attested to at application were not actually running. That last one converts your application answers into warranties in effect; answer them as such.
The controls are part of the policy now
Underwriting gates have become coverage facts. Multi-factor authentication on remote access and email, endpoint detection and response, offline or immutable backups that are actually restore-tested, privileged-access management, patching cadence — the market’s standard control set is asked at application, priced at renewal, and examined at claim. The board-level framing of that control conversation lives in this hub’s work on what a cyber claim actually looks like from the other side: every control on this page is a scene in that walk-through, either present or conspicuously absent. A mid-market buyer who treats the application as an audit they are inviting — and fixes the two cheapest gaps before submitting — buys a different policy from the one who treats it as paperwork.
Frequently asked questions
How much cyber insurance does a mid-market company need?
Enough to cover the scenarios, not a round number: model ransomware downtime at your gross margin, a social-engineering wire at your largest plausible transfer, and a data-liability event at your record count — then check the sublimits against each, because the headline limit rarely governs the losses companies actually have.
What is the most commonly missed cyber coverage gap?
Two tie. Social-engineering/funds-transfer fraud is often sublimited and conditioned on verification procedures the buyer never read. And dependent business interruption — your loss when a vendor’s incident takes you down — is frequently absent or thin in mid-market forms while vendor concentration quietly rises.
What controls do cyber insurers require?
The standard gate set: MFA on email and remote access, endpoint detection and response, tested offline or immutable backups, privileged-access controls, and disciplined patching. They are asked at application, priced at renewal, and examined at claim time — attesting to a control that is not running endangers the coverage itself.
What is a failure-to-maintain exclusion?
A policy provision allowing the carrier to contest coverage when the insured did not maintain the security controls it attested to in the application. It makes application answers consequential: the questionnaire is part of the contract in effect, and should be completed — and kept true — accordingly.