When ransomware hits your business, the first call is usually to your IT provider. The second call should be to your insurance broker. But far too many business owners make a critical mistake: they approve a ransom payment without checking what their cyber liability policy actually covers. That mistake can cost them the entire claim. Ransomware is not a technical problem with a financial solution. It is a coverage problem, and your policy language, not your IT vendor, determines what happens next.

Most cyber liability policies today include coverage for ransomware payments. That sounds straightforward. But the reality is that coverage is buried under conditions, exclusions, and requirements that can void your claim if you act too quickly. The biggest trap is the ransom payment itself. Many policies will reimburse you for the ransom you pay, but only if you get prior written approval from the insurer. If you pay first and ask later, the carrier can deny the claim entirely. That is standard policy language, not a weird loophole. Insurance companies want control over negotiation strategy because they are the ones footing the bill. They have specialists who know whether paying a particular hacker group is actually the best move and whether the decryption key will even work. When you pay without their approval, you are acting as your own insurer, and you lose the right to recover that money.

Another trap is the distinction between a ransom payment and the costs of responding to the breach. Your policy may cover the ransom itself but not the overtime for your IT staff, the forensic investigation, or the credit monitoring for customers. If you want those costs covered, you need to understand the difference between first-party coverage and third-party liability. First-party coverage pays for your own losses, like the ransom, lost business income, and public relations. Third-party coverage pays for lawsuits from customers or partners whose data was exposed. A ransomware attack often triggers both, but policies have separate limits and separate deductibles for each. If you have a single policy limit that is shared between them, one large lawsuit can eat up the entire amount before you even get reimbursed for the ransom.

Here is the part that confuses almost everyone: paying a ransom can actually create a new liability claim. When you pay hackers, you are potentially funding criminal organizations and you are also acknowledging that the data is now in someone else’s hands. If the hackers stole customer data and you pay to get the encryption key, you still have to notify those customers if their personal information was exfiltrated. The notification and credit monitoring costs are not covered under the ransom payment. They come out of your policy’s breach response coverage, which is often a separate sub-limit. So you can pay a fifty thousand dollar ransom and then face a two hundred thousand dollar notification bill. The ransom payment was only the beginning.

Many policies also require you to maintain specific security controls. If you failed to have multi-factor authentication on your email system or you did not patch known vulnerabilities, the insurer can deny coverage based on a breach of warranty clause. This is called a representation in the application, and it is not just a formality. When you bought the policy, you made promises about your security. If those promises are false, the policy is void. A common example is a company that states it uses encrypted backups but does not test them. When ransomware hits, the backups are useless, and the insurer walks away. You cannot negotiate your way out of a misrepresentation. It is a hard denial.

So what do you do when ransomware hits? First, do not sign anything or pay anyone. Second, contact your insurance carrier immediately, even before your IT team starts wiping drives. Your policy likely requires prompt notice, and delaying notice is another way to lose coverage. Third, ask for the insurer’s approved vendor list. Most policies require you to use specific response vendors, or they will lower what they pay. If you hire your own forensic firm, you may be stuck with the bill. Fourth, read your policy for the definition of “computer system” or “funds transfer fraud.“ Some ransomware attacks do not encrypt everything. They only steal data and threaten to leak it. That may be covered as extortion, but the definition of extortion varies wildly between policies. You need to know exactly what your policy calls a covered event.

Finally, do not assume that paying the ransom will get your data back. Studies show that a significant percentage of victims who pay never receive working decryption keys. Your insurance company’s negotiators know this. They may advise you to not pay at all. But that decision is not yours alone. If you have a mortgage, a lease, or a contract that requires you to protect customer data, refusing to pay might breach those agreements. Your insurance company does not care about your lease. They care about the policy language. So you have to balance your contractual obligations against your coverage limits. It is an ugly position to be in, but it is the position that any business faces when it treats cyber insurance as a checkbox instead of a contract.

The bottom line is that ransomware coverage is not a blank check. It is a partnership with strict rules. If you do not understand those rules before the attack, you will not understand them during the attack, and that is when it matters. Get your policy out today. Read the conditions. Find the exclusions. Call your broker and ask specifically how ransom payments are approved and what happens if you act without permission. Do that now, while your systems are running and your data is safe. Because when the ransomware hits, it is too late to read the fine print.