A cyber policy carries two deductibles that do not compare, and setting them side by side in a quotation table is the surest way to make an insured choose what does not suit it. The monetary deductible removes a fixed sum from every indemnity, whatever the incident's duration. The time deductible, or waiting period, removes the first hours of interruption, whatever they cost. The first is a percentage of the loss, the second a share of its duration, and two offers at the same price can leave the insured bearing amounts differing by a factor of five depending on its incident profile.
One must first see that the waiting period does not act where intuition places it. A monetary deductible bites on large losses as on small ones, proportionally more on small ones. A waiting period purely and simply eliminates a whole class of events: if cover responds only after twenty-four hours, no eighteen-hour incident opens any right at all, and those incidents are the most numerous. It is a guillotine and not an abatement, and that is what makes it so badly understood: it does not reduce the indemnity, it removes the loss.
The arithmetic is done on the insured's real interruption profile, and it is done before signing. A company whose incidents typically last four to forty-eight hours is highly exposed to the choice of period: at twelve hours, a large part of its events is covered; at twenty-four, half disappears; at forty-eight, only catastrophes remain. A company whose incidents, when they occur, last weeks because its rebuild is heavy, is almost indifferent to the period and highly sensitive to the monetary deductible. These are two opposite profiles, and the same comparison table treats them identically.
Then comes a computational subtlety contracts express in three different ways that changes the result. The period can be a deductible, in which case the hours elapsed are never indemnified and are always deducted; it can be a threshold, in which case crossing the period opens cover from the first hour; it can finally be a combination where cover runs from the period but a minimum indemnity duration is acquired. On a thirty-hour interruption with a twenty-four-hour period, those three wordings give six hours, thirty hours and a lump sum. That line is read, and it weighs more than the number of hours displayed.
It must be added that the waiting period interacts with the conduct of the loss, which no monetary deductible does. A company knowing its cover opens at twenty-four hours has no reason to rush to restart in eighteen, and that incentive is real even if nobody states it. Conversely, a fast partial recovery can take the insured out of the period without taking it out of the loss, since a return to forty percent is not a return. How the contract defines interruption, total or substantial, then decides everything, and that definition is rarely found next to the number of hours.
A word on what these two deductibles actually buy, because it is not the same thing. A monetary deductible buys a premium reduction by leaving the insured the share it can absorb from cash. A waiting period buys a premium reduction by taking a whole family of events out of the contract, those with the highest frequency and lowest unit cost, that is, precisely the ones the insurer does not want to handle. Both reduce the price for different reasons, and an insured that understands the difference knows which of the two matches what it is looking for.
The method comes to three steps that take an hour. Establish the duration profile of past interruptions, even approximate, even on uninsured incidents: that is the data that decides. Read, in each offer, not the number of hours but the method of computation, deductible, threshold or lump sum, and redo the calculation on a typical interruption. And check the definition of interruption, total or substantial, because a partial recovery treated as a recovery closes the meter before the loss ends. A comparison table without those three elements compares prices and nothing else.
A digital services company receives two offers at the same price. Offer A carries a monetary deductible of 150,000 euros and an eight-hour waiting period. Offer B carries a deductible of 25,000 euros and a forty-eight-hour waiting period. Over the last four years, the company suffered six significant interruptions: 6 hours, 11 hours, 14 hours, 20 hours, 31 hours and one of 9 days. Its hourly margin is 4,200 euros. The broker presents both offers in a table and lets the client choose. What must be calculated?
The broker's table compares two identical prices and hides a considerable gap, because a waiting period is not an abatement but a guillotine: it does not reduce the indemnity, it removes the loss. Of the six observed incidents, offer B at forty-eight hours covers only one, the nine-day event; the other five, from 6 to 31 hours, fall entirely outside the contract whatever their cost. Offer A at eight hours covers five out of six. The calculation is done on the 4,200 euro hourly margin. On the 31-hour incident, offer A indemnifies, after eight hours of waiting and a 150,000 euro deductible, a loss of 23 hours or 96,600 euros, which stays below the deductible and gives nothing; offer B does not open. On the 11, 14 and 20-hour incidents, neither pays, A's monetary deductible being too high and B's period too long. On the nine-day incident, 216 hours and about 907,000 euros, A indemnifies 907,000 less the waiting hours and 150,000 of deductible, B indemnifies from the forty-eighth hour less 25,000. That is where the method of computation decides, and the table does not give it: depending on whether the period is a deductible or a threshold, B pays 685,000 or 882,000 euros. What must be asked comes to three questions: the method of computing the period in each offer, the definition of interruption, total or substantial, and the treatment of partial recovery. Without those three answers the two offers do not compare, and this company's profile, with five incidents out of six lasting under forty-eight hours, argues for the short period even with a higher deductible.
- 01A monetary deductible reduces the indemnity; a waiting period removes the loss, and it is a guillotine rather than an abatement.
- 02The period eliminates the most numerous class of events, the one with the lowest unit cost: precisely what the insurer does not want to handle.
- 03Three wordings of the period coexist, deductible, threshold or lump sum, and on a thirty-hour interruption they give six hours, thirty hours or a lump sum.
- 04The duration profile of past interruptions is the data that decides, and it can be reconstructed even from uninsured incidents.
- 05A partial recovery treated as a recovery closes the meter before the loss ends: the definition of interruption weighs as much as the number of hours.