When you're comparing cyber insurance policies, most people focus on the premium and the coverage limit. Both matter. But there's a single coverage detail that could cost your business hundreds of thousands of dollars in a crisis — and most buyers never ask about it.

It's called the ransomware payment provision, and it determines whether your insurance carrier pays the ransom on your behalf or makes you front the money yourself and get reimbursed later.

The difference sounds subtle. It isn't.

What ransomware actually looks like

Here's the scenario. It's a Tuesday morning and your systems are locked. Files are encrypted. A ransom note demands $200,000 in Bitcoin within 72 hours or the decryption key gets destroyed. Your IT team can't fix it. Your backups may be compromised. Every hour of downtime is costing you money.

You call your insurance carrier. And this is where the two policy types diverge dramatically.

Pay-on-behalf: the carrier handles it

With a pay-on-behalf policy, the carrier steps in directly. They deploy their incident response team, negotiate with the threat actor, and wire the ransom themselves. You never have to come up with the funds.

This matters enormously for most small and mid-size businesses because:

• You may not have $200K in liquid cash available on 72 hours notice
• Wiring large amounts of cryptocurrency is not something most businesses have done before
• The carrier's negotiators often reduce the ransom significantly before paying
• Your systems get back online faster because the process is handled by professionals

Reimbursement: you pay first

With a reimbursement policy, the coverage works differently. You are responsible for paying the ransom out of pocket. The carrier reimburses you after the fact, subject to the claims process.

This creates several problems:

• You need to find and wire a large sum of money during an active crisis
• The reimbursement process takes time — often weeks — while your cash flow is already strained from the downtime
• If your business doesn't have the liquidity, you may be unable to pay the ransom at all, even with coverage
• Documentation and claims requirements add stress at the worst possible moment

Which carriers offer pay-on-behalf?

Not all carriers offer pay-on-behalf ransomware coverage, and among those that do, the terms vary. In general, tech-native cyber insurers like At-Bay and Coalition are more likely to offer pay-on-behalf provisions, while traditional carriers more often use reimbursement models.

This is one of the reasons that carrier selection matters so much in cyber insurance — two policies with identical limits and similar premiums can behave very differently when you actually need to file a claim.

What to ask when comparing policies

When you receive a cyber insurance comparison, look specifically for the ransomware payment provision row. It should say one of two things:

• Pay on behalf — carrier pays directly
• Reimbursement — you pay first, carrier reimburses

If you're comparing two policies at similar price points and one offers pay-on-behalf while the other offers reimbursement, that difference alone may justify choosing the pay-on-behalf option even at a slightly higher premium.