A few thoughts in no particular order: It's pretty standard for human ransom (aka kidnapping) policies to require the insured to deny they're covered to anyone

A few thoughts in no particular order: It's pretty standard for human ransom (aka kidnapping) policies to require the insured to deny they're covered to anyone who asks. So who is covered and how much for is never really public. I assume the same applies here. Ransomware is a new threat. So there isn't a good data set to do statistical analysis on yet. Doubly so as these events aren't reportable etc. Ransomware threat risk is quite client specific. How good is infosec etc? How much do you rely on these systems? Is your company an obvious target? And none of these factors can be easily assessed by an insurer. There are national political concerns around both the general risk and specific ones. And insurers hate anything like that. They won't cover acts of war, what about "acts of cyberwar"?