A cyber claim does not begin with a form. It begins with a phone call you make before you touch anything. Ransomware on a Tuesday, a wire that went to the wrong account on a Friday, a vendor calling to say their systems — and your data — are down. What happens next follows a choreography that the policy has dictated all along, and companies that know the steps get measurably better outcomes than companies that improvise. This page is the walk-through: how a cyber insurance claim actually unfolds, from discovery to the renewal conversation nobody warns you about.
Hour one: notice, before forensics
The first call is to the number in the policy. Cyber policies carry incident hotlines and, in most serious programs, a condition: response vendors — the breach coach, the forensic firm, the ransom negotiator — must come from the carrier’s panel or be approved in advance. Companies that hire their own responders first and notify second sometimes learn that the spend before notice is contested territory. The hotline call opens the claim, starts the carrier’s clock, and connects the one professional who will run the next two weeks: the breach coach, a specialized attorney whose privilege umbrella covers the investigation and whose actual job is sequencing — what gets restored, what gets preserved as evidence, what gets said, to whom, in what order. Everything in hour one is about not making the incident worse while the people who handle incidents assemble.
Days one to ten: containment, forensics, and the two clocks
Forensics answers three questions: how they got in, what they reached, and whether they are still here. Until the third answer is trustworthy, restoration is theater — rebuilding onto a network the intruder still occupies restarts the incident. In parallel, the business runs on workarounds: manual processes, clean systems, the downtime ledger that will become the business interruption claim. Documentation discipline starts now, not at claim submission: every cost, every hour, every decision, contemporaneously, because memory is not evidence and the claim file is built in these days or reconstructed badly later.
Two clocks run against the work. The legal clock: breach notification laws in every relevant state, sector rules for regulated data, and contractual notice duties to customers — each with its own deadline and its own definition of when the clock started, some measured in hours for certain regulated sectors. The policy clock: notice conditions, consent requirements for settlements and ransom decisions, and the waiting period before business interruption coverage begins counting. The breach coach’s calendar holds the first; the broker’s phone call holds the second. Ransomware adds its own sub-choreography — sanctions screening before any payment is contemplated, because paying a sanctioned actor converts a crime against you into a violation by you.
The money: how the claim gets counted
First-party costs lead: forensics, legal, notification and call-center, credit monitoring, restoration, and ransom where paid — most subject to the retention and to the sublimits the placement conversation should have surfaced (the evaluation discipline in this hub’s mid-market evaluation checklist exists to find those numbers before this day). Business interruption is the contested heart: gross profit lost over the indemnity period, calculated from the downtime ledger and the financial records, argued over by forensic accountants on both sides — the single largest reason cyber claims take quarters, not weeks, to close. Third-party claims follow on their own calendar: regulatory proceedings, and claims from the customers and individuals whose data the incident involved, arriving months after the systems were restored. A cyber claim is therefore not an event but a portfolio of matters with different half-lives, and the file closes when the slowest one does.
After: recovery, subrogation, and the renewal
The carrier that paid becomes a plaintiff. Where a negligent vendor’s failure opened the door, the insurer’s subrogation unit pursues them — your cooperation duties follow the claim file, another reason the contemporaneous record matters. And then the renewal arrives, and the claim’s second life begins: underwriters will ask what changed — the control that failed, now remediated and evidenced; the architecture, now segmented; the backups, now tested against the scenario that just happened rather than the one imagined. Companies that can answer with artifacts keep their program; companies that answer with adjectives meet the market described elsewhere on this hub. The claim, handled well, becomes the cheapest education the organization ever buys. Handled by improvisation, it is merely expensive.
Frequently asked questions
What should you do first when you discover a cyber incident?
Call the incident hotline in the policy and open the claim before engaging responders. Cyber policies typically require carrier-panel vendors — breach coach, forensics — or advance approval; money spent on unapproved responders before notice can be contested. The breach coach then sequences containment, evidence preservation, and notifications.
How long does a cyber insurance claim take to close?
The response costs settle in weeks to months; the full claim rarely does. Business interruption requires an accounting that takes time to prove, and third-party claims — regulatory matters, claims from affected customers and individuals — can arrive and resolve over quarters or years. The file closes when its slowest matter does.
Does cyber insurance pay ransoms?
Where the policy includes extortion coverage, a ransom can be paid with carrier consent — after sanctions screening confirms the recipient is not a prohibited party, a legal requirement, not a formality. Payment is one branch of the decision; restoration from backups is the other, and the forensic timeline usually decides which is real.
What documentation does a cyber claim need?
A contemporaneous record built during the incident: the downtime ledger (systems down, hours, workarounds), response invoices, forensic findings, notification evidence, and the financial records that prove interruption loss. Claims are paid on evidence; reconstructing the record afterward is slower, weaker, and sometimes impossible.