Ransomware Insurance: What It Covers and How to Qualify

With ransomware now one of the leading causes of loss in cyber insurance claims, insurers are tightening their terms¹.

Not only are application processes becoming more stringent, insurers are also demanding greater proof of strict technical controls as a condition of coverage—meaning more hoops to jump through for organizations seeking coverage.

This guide explains what ransomware insurance is, what it covers, and how to qualify for it—as well as the role of immutable backup storage in both securing coverage and ensuring recovery when ransomware strikes.

Key Takeaways

• Ransomware insurance refers to the cyber extortion portion of a cyber insurance policy. It pays toward ransom demands, downtime and recovery, but only within that policy’s conditions, sublimits and exclusions.

• Insurers decide eligibility and price based on security controls; secure, tested backups are among the controls insurers scrutinize most closely.

• Immutable backups let organizations recover without paying a ransom, shorten downtime and support the claim, which makes them central to both cyber resilience and better terms.

What Is Ransomware Insurance?

Ransomware insurance is not a standalone product: it’s the part of a cyber insurance policy that covers the costs of a ransomware attack. Depending on the policy, it can cover costs including extortion demands, downtime, and the cost of restoring systems and data. Insurers may also call this section of the policy cyber extortion coverage.

Aside from ransomware, cyber insurance policies also commonly include coverage for data breaches, business email compromise and other cyber incidents. These risks share the policy’s overall limit, premium and conditions, and ransomware cover may also carry its own lower sublimit. Organizations must ensure the level of coverage they apply for is enough to cover all these potential risks.

There are two types of coverage:

• First-party coverage pays the organization’s own losses, such as incident response, data restoration and income lost while systems are down.

• Third-party coverage pays claims that other parties bring against the organization, such as customers whose data the attackers stole.

What Ransomware Insurance Covers and Excludes

Exactly what cyber insurance covers depends on the individual policy. In general, the more an organization wishes to insure against, the greater the premiums they must pay—and the more stringent the controls applied by the insurer.

With the average cost of recovering from a ransomware attack at $1.7m in 2026, excluding any ransom payment², many organizations are likely to seek the maximum level of coverage they can afford.

To reduce the risk they must shoulder, insurers have responded by significantly tightening requirements for technical controls, and limiting exposure contractually. They either limit the amount they will pay for one individual type of loss within an entire policy (a sublimit) or require a policyholder to pay a fixed share of any loss (coinsurance).

What Ransomware Insurance Covers

The following list covers the first-party and third-party coverage insurers commonly provide against ransomware attacks:

First-Party Cover

• Cyber extortion: the ransom payment, where the insurer approves it, plus the cost of negotiating with the attackers.

• Business interruption: income lost while systems are unavailable, once the policy’s waiting period has passed.

• Incident response and digital forensics: specialists who contain the attack and establish how the attackers got in.

• Data restoration: the cost of recovering data and rebuilding affected systems.

• Breach notification: the cost of notifying regulators and affected individuals when the attack has exposed personal data.

Third-Party Cover

• Legal defense and settlements: claims from customers, partners and others whose data was compromised in the attack.

• Regulatory proceedings: defense costs and, where the law of the relevant country allows them to be insured, fines.

What Ransomware Insurance Excludes

Common exclusions and limitations include:

• Known, unpatched vulnerabilities: some policies exclude or limit coverage for attacks that exploit a vulnerability the organization knew about and had not fixed.

• Poor security hygiene: an insurer can refuse a claim, or rescind the policy, when security controls declared on the application were not in place.

• Insider threats: deliberate acts by the organization’s own staff or management may fall outside cover, depending on how the policy defines them.

• State-backed attacks and cyberwar: since March 2023, Lloyd’s has required standalone cyber policies written in its market to exclude losses from state-backed cyberattacks that significantly impair a country’s ability to function or its security capabilities.³

• Social engineering: losses from fraud that tricks staff into transferring money are often covered only up to a lower sublimit.

• Caps and sublimits: the ransomware coverage itself may be capped below the policy’s overall limit.

• Prior known incidents: attacks that began before the policy started, or that the organization knew about but did not disclose, are typically excluded.

How to Qualify for Ransomware Insurance

A cyber insurance policy that offers ransomware protection is typically arranged in two main stages:

1. An organization applies for a cyber policy that includes extortion cover, commonly filling out an extensive questionnaire outlining its security architecture.
2. An underwriter uses this information to decide whether coverage will be granted or refused.

Whether an insurer provides coverage or not—and how extensive this coverage is—depends largely on how resilient the organization proves itself to be: in general, the more resilient, the lower the premium.

It’s important to note that answers to insurance questionnaires are binding. If an organization overstates a control and the insurer discovers the gap during a claim, the insurer can refuse the claim or seek to void the policy entirely.

Underwriters most commonly check for evidence of the following controls:

• Multi-factor authentication (MFA) on remote access, email and administrative accounts. Partial deployment is not enough, and insurers treat it as a gap: 97% of organizations hit through compromised credentials had MFA enabled in some capacity at the time of the attack⁴.

• Endpoint detection and response (EDR) on all endpoints, including servers.

• Encrypted, immutable backups that are isolated from the production network and regularly tested. Although not mandated, the 3-2-1-1-0 rule aligns closely with this requirement: three copies of data, on two different media, with one copy offsite, one copy immutable, and zero errors after recovery testing.: three copies of data, on two different media, with one copy offsite, one copy immutable, and zero errors after recovery testing.

• Prompt patching of known vulnerabilities, particularly on internet-facing systems.

• A written incident response plan that the organization has tested.

• Email filtering and security awareness training, including phishing simulations.

• Network segmentation that limits how far an attacker can move once inside.

For a full list of the steps organizations need to follow to secure cyber insurance, download our Cyber Insurance Checklist.

The Cost of Ransomware Insurance

Ransomware insurance has no separate premium: its cost sits within the broader cyber insurance policy premium.

As a rough benchmark, Insureon reports that smaller businesses pay a median of $129 a month for cyber insurance, with annual premiums ranging from around $400 to over $8,000⁵.

Will Ransomware Insurance Pay the Ransom?

Whether insurance providers will contribute to a ransom payment depends on whether ransom payments are specifically included in the policy terms.

If ransom payments are included in the policy—and the insurer finds no reason to decline the claim—actually paying a ransom still carries a number of risks:

• Strict claim conditions: failure to adhere to the correct steps set out by an insurer may result in coverage being rescinded. Organizations may need insurer consent before any payment, they may need to notify of an attack within strict deadlines, and they may be limited to using incident response firms approved by the insurer.

• Shared policy limits: as mentioned previously, ransomware is just one part of a cyber insurance policy that has many other limits, restrictions and conditions. A large payout to cover the costs of a ransomware attack may completely max out an organization’s total coverage limit.

• Legal risk of payment: it’s often difficult for organizations to determine exactly who they are paying a ransom to. Organizations that pay ransoms to sanctioned entities may breach sanctions law and face penalties, even if they do so unknowingly.

• No guarantee of data recovery: paying a ransom does not guarantee data will be recovered. Omdia found that only 39% of organizations hit by ransomware recovered 75% or more of their data after the attack⁶.

The best way to mitigate a ransomware attack is therefore to secure insurance coverage that can help with the costs of an actual ransomware attack, combined with technology that ensures data can always be recovered when an attack happens.

The Need for Immutable Backups

An organization that can restore clean data quickly is a cheaper claim for its insurer. It has less reason to pay a ransom, it spends less time offline, and its business interruption loss is smaller. Insurance against ransomware and recoverable backups therefore work toward the same outcome.

Attackers understand this, which is why backup systems have become a primary target for ransomware: Omdia found that 83% of organizations suffered a successful ransomware attack in the past two years, and that backups were targeted in four out of five attacks⁷. When attackers can encrypt or delete backups, the organization loses its route to recovery, and the ransom becomes the only option left.

The answer is immutable backup storage: a backup copy that cannot be modified, deleted, or encrypted for the duration of its retention window.

In the context of ransomware insurance, immutable backups offer a three-fold defense:

1. They support insurance applications, because robust backups are one of the controls underwriters look for
2. They enable organizations to recover data without paying a ransom, reducing the total cost of a ransomware attack
3. They protect the integrity of an insurance claim, because restore records and retention logs can prove that backups declared by the organization are in place and working at the time of an attack

The Importance of Absolute Immutability

Not all immutable backups are created equal, and there are important considerations when building a backup architecture to ensure it meets the criteria insurers look for.

According to the Veeam 2025 Ransomware Trends Report, insurers now assess specifically whether backups are isolated from the production network, immutable (protected against modification/deletion even by admins), regularly tested, encrypted, and MFA-protected at the management interface.⁸

Unfortunately, many systems that describe themselves as “immutable” contain hidden exceptions and loopholes that mean they don’t stand up to these requirements. Some require deep Linux and security expertise, and even then, immutability is often bolted on as an afterthought rather than as a core architectural design.

Not only does this leave data vulnerable to a ransomware attack, it could raise difficult questions and introduce delays in the event of a claim.

The only way for organizations to ensure backup storage is truly ransomware-proof is to use a backup storage appliance that features Absolute Immutability.

Absolute Immutability means Zero Access to destructive actions. No one—not even the most privileged admin or a fully compromised attacker—can modify or delete backup data. At its core, Absolute Immutability is built on an ‘assume breach’ mindset. Even if your credentials are stolen, your infrastructure is compromised, or an insider goes rogue, your backup data stays untouchable.

Achieving Absolute Immutability through Zero Access requires adherence to three core principles:

• S3 Object Storage: A fully documented, open standard with native immutability through S3 Object Lock, which enables independent penetration testing and verification.

• Zero Time to Immutability: Backup data must be immutable the moment it is written.

• Target Storage Appliance: A dedicated target storage appliance segments storage from backup software, and removes the risks associated with DIY self-managed backup storage during operations—particularly during setup, updates and maintenance. It requires no security expertise from a customer and shifts full responsibility to a vendor.

How Object First Facilitates Insurance Coverage

Object First helps organizations meet insurer expectations at every stage, from application to claim. Its backup storage appliance is immutable by design and independently tested and verified, which reduces reliance on self-attestation during underwriting. Immutability enforcement, audit logs and restore testing provide ongoing evidence that backup controls are operating as declared—and if an attack happens, a clean recovery path and tamper-proof records support a faster, less disputed claim.

When—not if—ransomware strikes, your future depends on cyber resilience.

Object First is your ultimate defense—backup storage with Absolute Immutability that’s purpose-built for Veeam.

Absolute Immutability goes beyond Zero Trust and typical “immutability” to ensure that your backup storage data cannot be deleted or modified by anyone—administrator or attacker.

Third-party tested and verified, Object First requires no security expertise and scales with your business. When backup storage is this secure, simple, and powerful, you and your organization are Simply Resilient.

Summary

Ransomware insurance is another term for cyber extortion coverage commonly contained within a broader cyber insurance policy; it pays out in line with the conditions and sublimits of this broader policy. If a ransomware claim is denied or falls short, organizations themselves must cover the cost of recovery and downtime. Backup storage with Absolute Immutability can help organizations secure more comprehensive ransomware coverage by offering proof of robust security controls; it also allows organizations to recover their data without paying a ransom.

FAQ

Does cyber insurance cover ransomware?

Cyber insurance covers ransomware when a specific policy includes a ransomware or cyber extortion module. Ransomware coverage pays only when the cyber policy’s conditions are met, such as prompt notification, insurer consent before any ransom payment, and accurate answers on the application.

Do small businesses need ransomware insurance?

Small and mid-sized businesses have good reason to carry ransomware insurance, because smaller organizations account for the large majority of cyber insurance claims. NetDiligence’s 2025 Cyber Claims Study found that 98% of claims came from organizations with less than $2bn in annual revenue, and ransomware was one of the two leading causes of loss⁹. A smaller business is also less able to absorb recovery costs.

Is there ransomware insurance for Managed Service Providers (MSPs)?

Ransomware insurance for MSPs needs to cover more than the provider’s own systems. An attack on a managed service provider can spread to every client the provider manages, and a standard cyber policy may cover only the MSP’s own losses. Claims from clients for their losses typically fall under third-party liability coverage or technology errors and omissions (tech E&O insurance), which insurers often bundle with cyber coverage for IT businesses. Read more about ransomware attacks on MSPs.

If I have immutable backups, do I still need ransomware insurance?

Yes. Immutable backups and ransomware insurance do different jobs, and having both puts you in the best position. Immutable backups enable organizations to recover data without paying a ransom, and also help qualify for insurance cover. Ransomware insurance, as part of a cyber policy, pays for costs that secure backup storage cannot prevent: incident response and forensics, legal and notification costs, business interruption, and claims from third parties whose data was stolen.

References

1. [1] NetDiligence. “Cyber Claims Study: 2025 Report.” 2025. https://netdiligence.com/cyber-claims-study-2025-report/
2. [2] Sophos. “The State of Ransomware 2026: Insights from 2,158 IT and Cybersecurity Leaders Across 17 Countries.” 2026. https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf
3. [3] Lloyd’s. “Market Bulletin Y5381: State Backed Cyber-Attack Exclusions.” 2022. https://assets.lloyds.com/media/e9a4058c-4c25-48d6-99d3-0c466987e099/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdf
4. [4] Sophos. “The State of Ransomware 2026: Insights from 2,158 IT and Cybersecurity Leaders Across 17 Countries.” 2026. https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf
5. [5] Insureon. “Cyber Insurance Cost.” 2026. https://www.insureon.com/small-business-insurance/cyber-liability/cost
6. [6] Object First. “Cyber Recovery Is Slipping—Here’s What the Latest Omdia Research Reveals.” 2026. https://objectfirst.com/blog/cyber-recovery-omdia-research/
7. [7] Object First. “Object First-Sponsored Omdia Research: 93% of Technology Leaders Say Absolutely Immutable Backup Storage Is Critical for Ransomware Protection, But Only 16% Have It.” 2026. https://objectfirst.com/newsroom/press-releases/object-first-sponsored-omdia-research-93-percent-of-technology-leaders-say-absolutely-immutable-backup-storage-is-critical-for-ransomware-protection-but-only-16-have-it/
8. [8] Object First. “What You Need to Know about the 2025 Veeam Ransomware Trends Report.” 2025. https://objectfirst.com/blog/summary-of-the-veeam-ransomware-trends-report-2025/
9. [9] NetDiligence. “Cyber Claims Study: 2025 Report.” 2025. https://netdiligence.com/cyber-claims-study-2025-report/