Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Option B total expected annual cost
$70,000
Option A total expected annual cost
$55,000
Difference (A − B)
-$15,000
Lower expected-cost option
Option A (lower retention) is cheaper on expected value
Out-of-pocket per incident under Option B
$100,000
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter option a: annual premium (lower retention).
- 2Enter option a: retention (deductible) per incident.
- 3Enter option b: annual premium (higher retention).
- 4Enter option b: retention (deductible) per incident.
- 5Enter expected covered incidents per year.
- 6Enter average incident cost (before insurance).
- 7Read your option b total expected annual cost on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
Cyber insurance policies trade premium against retention (deductible): a higher retention lowers your annual premium but means you self-fund more of any incident before coverage kicks in. This calculator compares two policy options by combining the premium cost with expected out-of-pocket cost based on your own incident frequency assumption, so you can see total expected annual cost rather than just sticker premium price. It also flags a common trap: choosing the cheapest premium without checking whether your realistic annual incident frequency and severity would blow through the retention on a regular basis, turning a 'discount' into a bad bet. This isn't a substitute for reading policy sub-limits and exclusions (war exclusion, unencrypted-device exclusion, and 'failure to maintain minimum security standards' clauses have all been used to deny real claims), but it does make the pure cost tradeoff explicit.
Worked example
Using the values the calculator loads with:
Inputs
- Option A: annual premium (lower retention): 45000
- Option A: retention (deductible) per incident: 25000
- Option B: annual premium (higher retention): 30000
- Option B: retention (deductible) per incident: 100000
- Expected covered incidents per year: 0.4
- Average incident cost (before insurance): 400000
Results
- Option A total expected annual cost: $55,000
- Option B total expected annual cost: $70,000
- Difference (A − B): -$15,000
- Lower expected-cost option: Option A (lower retention) is cheaper on expected value
- Out-of-pocket per incident under Option B: $100,000
What each field means
Inputs
- Option A: annual premium (lower retention)
- The option a: annual premium (lower retention) used in the calculation. Starts at 45000 so you have a working example on load.
- Option A: retention (deductible) per incident
- The option a: retention (deductible) per incident used in the calculation. Starts at 25000 so you have a working example on load.
- Option B: annual premium (higher retention)
- The option b: annual premium (higher retention) used in the calculation. Starts at 30000 so you have a working example on load.
- Option B: retention (deductible) per incident
- The option b: retention (deductible) per incident used in the calculation. Starts at 100000 so you have a working example on load.
- Expected covered incidents per year
- The expected covered incidents per year used in the calculation. Starts at 0.4 so you have a working example on load. Accepted range: 0–10.
- Average incident cost (before insurance)
- The average incident cost (before insurance) used in the calculation. Starts at 400000 so you have a working example on load.
Results
- Option A total expected annual cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Option B total expected annual cost
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Difference (A − B)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Lower expected-cost option
- Returned as a plain value. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Out-of-pocket per incident under Option B
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Should I always pick the lower expected-cost option?
Not automatically. Expected value math favors higher retention when incident frequency is low, but it assumes you can actually absorb the full retention amount in cash without disrupting operations if an incident hits in a bad year; if a $100,000 retention would strain your reserves, the lower-retention option's cash-flow predictability has real value beyond the math.
What incident frequency should I assume?
Use your own claims/incident history if you have 3+ years of data; otherwise, industry cyber incident frequency benchmarks from your broker (often available by industry and revenue band) are more reliable than a guess. Small and mid-size companies commonly underestimate this because near-misses caught by existing controls never show up as 'incidents' in memory.
Does this account for sub-limits within the policy?
No, this compares premium and retention only. Real policies often have separate sub-limits for ransomware, business interruption, and regulatory fines that can be far lower than the headline policy limit, so always cross-check the actual policy schedule against your largest realistic loss scenario.
Why would an insurer deny a claim even with a valid policy?
Common real-world denial reasons include failure to maintain the minimum security controls attested to in the application (like MFA that was promised but not actually enforced everywhere), war/nation-state exclusions invoked for certain ransomware groups, and claims filed outside the notification window specified in the policy.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Annualized Loss Expectancy (ALE) Calculator
Turn asset value, exposure, and threat frequency into a yearly risk dollar figure.
Data Breach Cost Calculator
Estimate total breach cost from records exposed, industry, and detection speed.
Incident Response Retainer Value Calculator
Compare a pre-paid IR retainer against emergency hourly rates during a real breach.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Cyber Insurance Premium vs. Retention Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/cyber-insurance-premium-vs-retention
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/cyber-insurance-premium-vs-retention" target="_blank" rel="noopener">Cyber Insurance Premium vs. Retention Calculator — RevenueLab</a> (2026).</p>
Source: [Cyber Insurance Premium vs. Retention Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/cyber-insurance-premium-vs-retention) (2026).