Cyber Insurance vs Self-Insurance: How to Decide What Cyber Risk to Transfer

Boards increasingly ask whether a cyber policy is worth its premium, or whether the organisation would be better off retaining the risk and setting money aside. The honest answer is rarely all or nothing: most organisations retain the frequent, smaller losses and transfer the rare, severe ones, and the question is where to draw the line. This guide compares buying cyber insurance with self-insuring (funded reserves, high retentions and captives) on loss modelling, exclusions such as war and unpatched vulnerabilities, premiums against reserves, access to incident response panels and the controls insurers demand. It is for CISOs, risk managers and finance leads preparing a risk-financing recommendation.

Key takeaways

• Frequency and severity decide the split: retain losses you can absorb from operating budgets and reserves, transfer the tail losses that would threaten liquidity or solvency.
• Exclusions shrink what you actually transfer: state-backed attack exclusions, required in Lloyd's standalone cyber policies since 31 March 2023, and known-vulnerability conditions mean part of the tail stays with you even when insured.
• Insurance buys services as well as money: pre-agreed breach counsel, forensics and negotiators are a large part of a policy's value, and a self-insurer has to contract for them separately.
• Self-insurance only works if it is funded and governed: an unfunded "we will absorb it" is risk acceptance, not self-insurance, and needs a board-approved risk appetite behind it.
• The controls are the same either way: MFA, EDR, tested backups and fast patching lower premiums and lower retained losses, so they pay back under both strategies.

The short answer

Buy cyber insurance if a severe incident (a week of ransomware downtime, a large notification exercise, third-party claims) would exceed what you could pay from cash and reserves without harming the business, if contracts require it, or if you lack an in-house incident response capability. Self-insure the layer below the deductible you can comfortably carry, and consider a larger self-insured retention or a captive when you are big enough to model your own losses, the commercial market is pricing you poorly, or exclusions leave so much uninsured that the premium buys little. Many mid-sized organisations land on a blend: a meaningful retention, a commercial policy above it, and a funded reserve for what the policy excludes.

The options, in architecture terms

A captive is a real insurer: US domiciles such as Vermont, which describes itself as the world's largest captive domicile, regulate captives with business plan approval, audited financial statements, actuarial filings and periodic examinations. That overhead is why captives are rarely formed for cyber alone, but an existing captive is a natural home for a cyber retention layer.

Loss modelling: deciding where to draw the line

The decision rests on a loss distribution, not a single "average breach" figure. Model at least three scenarios, each with a frequency and a range of impacts:

• High frequency, low severity: business email compromise attempts, a lost laptop, a contained malware infection. UK government survey data show these smaller events dominate counts: the Cyber Security Breaches Survey 2025 (published April 2025) put the self-reported average cost of the most disruptive breach for businesses at £1,600 (£3,550 excluding zero-cost responses), while noting such figures likely underestimate full impact.
• Moderate: a personal data breach needing forensic investigation, legal advice and notification, with a few days of partial disruption.
• Severe tail: enterprise-wide ransomware with a week or more of outage, data exfiltration, regulatory investigation and third-party claims, or a supplier outage that halts operations.

Quantify each with a method such as FAIR (loss event frequency multiplied by loss magnitude, run as a Monte Carlo simulation) and read off annualised loss expectancy and the 1-in-20 and 1-in-100 year losses. See the Cyber Risk Quantification Guide and the FAIR Model and Open FAIR Standard Guide.

The retained column is a list every self-insurer carries in full and every insured organisation carries anyway. Size the reserve for it regardless of which strategy you choose.

Exclusions that move risk back to you

War and state-backed attacks

Lloyd's Market Bulletin Y5381 (16 August 2022) required managing agents to include a state-backed cyber-attack exclusion in standalone cyber policies from 31 March 2023, at inception or renewal. The clause must at minimum exclude war (if there is no separate war exclusion), exclude state-backed attacks that significantly impair a state's ability to function or its security capabilities, state whether systems outside an affected state are covered, set out a robust basis for attribution, and define its key terms. For a self-insurer this changes nothing; for an insured organisation it means a large-scale, state-attributed event may fall into the retained layer. Read the attribution mechanism in your wording closely, because it decides who has to prove what.

Known and unpatched vulnerabilities

Many market wordings limit cover where a loss arises from software or hardware that was end-of-life, or from a vulnerability published in the CVE list with a fix available that was not applied within a set period, commonly 30 days. Mechanisms include full exclusion, sublimits, and sliding scales where the insured's share rises the longer the fix was delayed, with cover in extended cases falling to 5 to 10 percent of the limit, according to analysis by law firm Allens. These conditions can apply whether or not the insured knew of the vulnerability. That makes patch latency a financial control: see the Vulnerability Management Guide.

Other conditions

• Misrepresentation: NCSC guidance warns that if statements about your security measures are inaccurate, the insurer may not have to pay. An MFA answer that was true for email but not for the VPN is the classic example.
• Prior known circumstances: incidents or vulnerabilities known before inception are excluded.
• Infrastructure and widespread events: outages of power, telecoms or major cloud infrastructure may be excluded or sublimited.
• Silent cyber: traditional property and liability policies increasingly exclude cyber, so do not assume another policy covers the gap. NCSC advises checking existing policies for cyber cover before buying.

The Cyber Insurance Guide covers policy structure and exclusions in more depth; this page focuses on what they mean for the retain or transfer decision.

Premiums against reserves

• What a premium buys: expected losses, the insurer's expenses and profit, and capital for the tail. In a soft market the tail is cheap to transfer; in a hard market retentions rise and limits shrink. Policies are typically reassessed every 12 months, so the price and terms of transfer are never fixed.
• What a reserve costs: the opportunity cost of the capital set aside, the risk that a severe loss arrives before the reserve is built, and the cost of buying services (retainers, counsel) that a policy would bundle. Agree with finance how the reserve is held and reported before relying on it.
• Retention sizing rule of thumb: set the retention near the loss you could absorb in a bad year without breaching covenants or cutting planned investment, then compare the premium saving from a higher retention with the extra expected retained loss from your model.
• Do the arithmetic both ways: if the expected retained loss rises by less than the premium falls when you raise the retention, the higher retention is efficient; repeat until the curves cross or you reach your appetite limit.

Incident response panel access

For many organisations the decisive difference is what happens in the first 24 hours. NCSC notes that insurers may provide forensics, legal and public relations support or access to incident response organisations. A policy usually comes with a hotline and pre-vetted panel firms whose rates are agreed, which removes procurement delay during a crisis. The trade-offs are that you may need insurer consent to use your own preferred firms, and the panel firm is engaged through the insurer's process.

A self-insurer must build the same capability: an incident response retainer with agreed hours and response times, breach counsel on standby, a ransomware negotiation and sanctions-check route, and a crisis communications firm. Contract these in advance; buying them mid-incident is slow and expensive. See the Incident Response Retainer Buyer's Guide and, for insured organisations, Cyber Insurance Claims.

Controls insurers demand, and why self-insurers need them too

NCSC's advice is not to limit yourself to the insurer's minimum requirements. Treat the questionnaire as a floor and your own risk assessment as the target. Most of the underwriting questions are identity questions: see the Identity Controls for Cyber Insurance Questionnaires Guide and the Backup Security and Immutable Backup Guide.

Where identity fits

Identity compromise drives the severe scenarios in most loss models: stolen credentials, abused service accounts and backup consoles reached with domain admin rights. For an insured organisation, inaccurate answers about MFA coverage or admin accounts are a misrepresentation risk. For a self-insurer, the same weaknesses inflate the retained tail directly. Include non-human identities (service accounts, API keys, OAuth applications) in the evidence: they often hold standing privilege and are easily missed when an underwriter asks "is MFA enforced on all privileged access?".

Decision criteria

Small vs large organisations: UK survey data show specific cyber policies are held by 7 percent of businesses overall and 27 percent of large businesses, with more organisations relying on cyber cover inside wider policies (Cyber Security Breaches Survey 2025). For small organisations, the services bundled with a policy are often worth more than the limit, and self-insurance is rarely credible. Large organisations can model their losses, carry bigger retentions and use captives, buying commercial cover only for the catastrophic layer. The Cyber Insurance Statistics Guide tracks market data.

Worked scenarios

• Scenario A, 40-person professional services firm: its severe scenario (ransomware plus client data notification) is modelled at several times its cash reserve, and it has no IR retainer. It buys a commercial policy with a low deductible for the panel access and limit, and reserves only for exclusions it cannot transfer, such as lost future fees.
• Scenario B, mid-sized manufacturer facing a hard market: the renewal quote doubles the retention and adds a known-vulnerability sliding scale. Modelling shows the higher retention adds less expected retained loss than the premium saved, so it accepts it, funds a reserve for the retained layer, signs an IR retainer and cuts critical patch latency below the 30-day threshold to protect the remaining cover.
• Scenario C, multinational group with an existing captive: the captive writes a cyber layer above a per-event retention held by business units, reinsures part of it, and the group buys commercial excess cover for catastrophic losses. A funded reserve covers state-backed attack exposure that neither the captive's reinsurers nor the commercial market will take.

Common failure patterns

• Self-insurance by default: no policy, no reserve and no retainer, described to the board as "self-insured".
• Assuming the limit is the cover: sublimits for extortion, contingent business interruption and fraud, plus exclusions, mean the transferred amount is far below the headline limit.
• Questionnaire drift: controls declared at renewal decay during the year, creating a misrepresentation exposure at claim time.
• Patching outside the policy window: critical fixes left beyond the wording's grace period push a loss into a sublimit or exclusion.
• No pre-agreed responders: a self-insurer procuring forensics and counsel during an outage loses days.
• Single-number modelling: sizing cover on an average breach cost ignores the tail, which is what insurance exists for.

Implementing the decision: a phased approach

1. Set appetite: agree with the board the largest cyber loss the organisation can retain per event and per year; use the Cyber Risk Appetite Statement Template.
2. Model losses: build three to five scenarios with frequency and impact ranges, informed by a business impact analysis, and produce a loss exceedance curve.
3. Inventory existing cover: check property, liability, crime and bundled policies for cyber cover and cyber exclusions.
4. Test the market: obtain quotes at two or three retention levels and map each wording's exclusions (state-backed attack, known vulnerabilities, infrastructure) onto your scenarios.
5. Compare options: for each structure, compute premium plus expected retained loss plus the cost of services you would need to buy, and check the 1-in-100 year retained loss against appetite.
6. Fund and contract: set up the reserve or captive layer, and sign IR, counsel and negotiation retainers if self-insuring any meaningful layer.
7. Exercise it: run a tabletop that walks through notifying the insurer or releasing reserve funds, and fix the gaps.
8. Review annually: re-run the model before each renewal; if terms worsen, adjust the retention rather than renewing by habit.

Measuring that it is working

• Total cost of risk: premium plus retained losses plus risk-related services, tracked year on year.
• Retained tail against appetite: modelled 1-in-100 year retained loss as a percentage of the approved appetite limit.
• Exclusion exposure: share of modelled severe-scenario loss falling into exclusions or sublimits.
• Control attestation accuracy: percentage of declared underwriting controls verified by evidence at mid-term review.
• Patch latency against policy window: critical vulnerabilities older than the wording's grace period (target zero).
• Time to engage responders: minutes from incident declaration to panel or retainer firm engagement, measured in exercises.

Framework mapping

Practitioner checklist

• Get board approval for a per-event and annual cyber retention figure.
• Model frequency and severity for at least three scenarios and produce 1-in-20 and 1-in-100 year losses.
• Map every exclusion and sublimit in your wording onto those scenarios.
• Check state-backed attack and known-vulnerability clauses, including the attribution mechanism and grace period.
• Fund a reserve for losses that are retained or excluded, whichever strategy you choose.
• Contract IR, breach counsel and negotiation support in advance if any layer is self-insured.
• Verify underwriting answers with evidence, including service accounts and backup consoles.
• Keep critical patch latency inside the policy's grace period.
• Re-run the comparison at each renewal and record the rationale for the chosen retention.

Standards and references

• NCSC: Cyber insurance guidance
• Lloyd's: Market Bulletin Y5381, State backed cyber-attack exclusions
• DSIT: Cyber Security Breaches Survey 2025
• Vermont Department of Financial Regulation: Captive insurance
• IASME: Cyber Essentials cyber liability insurance
• Allens: Limitations in cyber cover for known vulnerabilities and end-of-life hardware
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Cyber Insurance Guide, Cyber Insurance Executive Briefing, Cyber Risk Quantification Worksheet Template, Business Impact Analysis Template, Identity Controls for Cyber Insurance Questionnaires Guide.