A cyber warranty is a contract in which a security vendor reimburses defined breach costs, provided the customer maintained the security controls the warranty requires.

If a vendor has offered you a cyber warranty, you may be wondering whether it provides meaningful protection or is simply a marketing claim attached to a security product. While warranties can help offset the financial impact of qualifying incidents and support stronger cybersecurity practices, the details matter. Coverage, exclusions, eligibility requirements, and claims processes vary significantly between providers.

This article looks beyond the headline coverage amount by examining a real-world cyber warranty program as a worked example. You’ll learn what cyber warranties are designed to do, what they typically cover and exclude, how claims work, and what questions to ask when comparing warranty offerings.

Key points of this article: A cyber warranty pays predetermined amounts when specific conditions are met. It isn’t insurance and doesn’t transfer broad risk. Coverage is conditional. If the required controls weren’t maintained, the claim can be denied. In practice, the control requirements are among the most important warranty terms. Read the limit structure before the limit. Per-endpoint caps and per-participant caps produce very different real-world payouts. Warranties complement cyber insurance. They cover costs the policy doesn’t, including the deductible, the waiting period, and eligible expenses beyond policy limits. Where the required controls contain the incident below the deductible, the warranty covers the event outright.

Key points of this article:

A cyber warranty pays predetermined amounts when specific conditions are met. It isn’t insurance and doesn’t transfer broad risk.
Coverage is conditional. If the required controls weren’t maintained, the claim can be denied. In practice, the control requirements are among the most important warranty terms.
Read the limit structure before the limit. Per-endpoint caps and per-participant caps produce very different real-world payouts.
Warranties complement cyber insurance. They cover costs the policy doesn’t, including the deductible, the waiting period, and eligible expenses beyond policy limits. Where the required controls contain the incident below the deductible, the warranty covers the event outright.

What is a cyber warranty?

A cyber warranty is a contractual promise from a security vendor to reimburse defined costs if a breach occurs while its products are correctly deployed. Unlike insurance, it isn’t a regulated policy: it pays predetermined amounts when specific conditions are met, only when required security controls were in place.

Cyber warranties vs. cyber insurance

A cyber warranty isn’t a small insurance policy. A warranty relates directly to the implementation of specific cybersecurity controls and their ability to reduce incident severity and impacts. By contrast, cyber insurance protects against a wide range of events independent of how specific controls or tools perform.

The two coverage types are complementary. In practice, the controls a warranty requires hold incident severity down far enough that many incidents never exceed the cyber insurance deductible. The warranty covers those events in full and the policy is never called on. Cyber insurance is there for the events that do exceed it, and to comprehensively mitigate attack impacts. We cover this in depth in the article about cyber insurance vs. cyber warranty.

Why security vendors started offering warranties

Security vendors started offering cyber warranties once insurers standardized their control requirements. Multi-factor authentication (MFA), managed detection and response (MDR), immutable (tamper-resistant) backups and a fixed patch cadence became common requirements for obtaining and maintaining coverage, and those are precisely the controls a security vendor can verify and stand behind.

The first widely reported cyber warranty was announced by WhiteHat Security at Black Hat in 2014 and covered a service refund plus the first $250,000 of breach-related costs. CrowdStrike has offered a breach prevention warranty of up to $1 million on its Falcon Complete service since 2018.

Recent cyber warranty growth is often wrongly attributed to escalating cyber insurance costs. U.S. cyber insurance direct written premiums fell 2.3% in 2024, the first annual decline on record, according to AM Best’s analysis of NAIC statutory filings. Rates continued softening into 2026, according to the Marsh Global Insurance Market Index. Pricing and control requirements have moved independently. Rates softened while the security controls insurers require became more demanding.

The real reasons for cyber warranty growth are:

Control convergence. Around 2021 to 2023, insurers began mandating MFA, endpoint detection and response (EDR)/managed detection and response (MDR), immutable backups, and timely patching as coverage conditions. A security vendor can validate and attest to these controls’ operation, making a cyber warranty a form of documented proof that key cybersecurity controls are in place and operating as intended.
When controls provably work, providers can more confidently take on the financial risk. Allianz Commercial reported that cyber claims severity fell by more than 50% and large-loss frequency fell by around 30% in the first half of 2025. The report attributed this trend to detection and response investment. According to Allianz Commercial, a ransomware attack that progresses to data theft and encryption can cost up to 1,000 times more than an attack detected and contained early. This is why an MDR vendor can warranty an offering’s detection speed, and why cyber warranties are typically tied to product tiers rather than sold standalone.
Accountability has become a competitive demand. As warranties proliferated, buyers stopped accepting prevention claims without assurance. An MDR vendor with no cyber warranty has become the exception.
Cybercriminals are increasingly targeting small and midsized business (SMBs). Industry studies like the Verizon Data Breach Investigations Report 2026 find ransomware present in a far higher share of SMB breaches than of large organization breaches, and Allianz Commercial reports attacker activity shifting toward smaller targets. SMBs are less able to absorb the financial impacts of cyber insurance deductibles (sometimes called retentions) and waiting periods, making cyber warranty benefits more relevant to them.

As Kirsten Bay, co-founder and CEO of Cysurance, the independent provider of ESET’s cyber warranty, puts it, “The honest version is that underwriting got harder, product companies stepped up to carry part of the risk, and controls brought severity down far enough to make that possible.”

What does a cyber warranty cover?

A cyber warranty covers a defined list of event types rather than a broad category of loss. ESET’s cyber warranty covers four: ransomware and business email compromise, compliance events, cyber legal liability, and lost business income. Each event type carries its own maximum payout.

Here is an example of actual cyber warranty coverage based on that provided by ESET.

Business email compromise events in which social engineering results in a funds-transfer are excluded from ESET’s cyber warranty, even though business email compromise is a covered event category. The dividing line is whether a security control was defeated, or if authorizing the payment was a business process failure.

When evaluating a warranty, it’s also important to understand how the limits are structured. ESET’s cyber warranty limits are set per event and per participant, rather than per endpoint. The distinction is important because the two types pay out very differently:

A per-endpoint limit defines the maximum payout available for each individual device or machine (laptops, servers, desktops, smart office infrastructure, industrial IoT) the incident affected. In a ransomware attack on an organization with 100 endpoints, a payout capped at $1,000 per endpoint would increase with the number of systems infected up to a maximum of, for example, $100,000, even if the warranty’s headline figure is “up to $1 million.”
A per-participant limit defines the overall capped maximum payout allocated to a business as a participant in the warranty program. The limit could apply to individual incidents or an aggregate payout for a one-year period. Given a ransomware attack with a per-participant cap of $1 million, the maximum payout could be up to $1 million if incident costs reached or exceeded that amount.

Keep in mind that per-endpoint caps often pay on endpoints compromised, not endpoints owned. A contained incident would pay very little under that structure, even at a large company, despite the substantial headline number.

What isn’t covered by cyber warranty?

A cyber warranty pays only if the required security controls were in place when the incident occurred. ESET’s cyber warranty requires nine: endpoint protection, MDR or security information and event management (SIEM) monitoring, MFA, immutable backups, AES-256 encryption, regulatory compliance,patching and known vulnerability fixes within 60 days, security awareness training, and wire-transfer verification procedures.

Systemic events are one of the most commonly misunderstood areas of cyber warranty coverage. A cyber warranty is intended to respond to events arising from the customer’s own network exposure. Where a widespread incident affects a shared service such as Microsoft 365 or AWS, a warranty may still respond depending on the program and the facts.

What governs is the connection to the customer’s own environment, not the scale of the event. Cyber insurance treats widespread events differently from policy to policy, and many policies carry widespread event or cyber catastrophe exclusions, so the policy language governs.

Common reasons a cyber warranty claim may be denied include:

Patching or MFA wasn’t fully deployed, or patch levels were several versions behind.
The participant reported the incident after the notification deadline. No network monitoring capability (e.g., MDR, SIEM) was in use when the incident occurred.
The solution was licensed but never deployed on the assets involved.
The participant ignored alerts from the security vendor.
The participant couldn’t provide proof of the event.
The incident didn’t arise from the participant’s own network exposure.
The warranty wasn’t in force at the time of the incident.

Cyber warranty self-audit checklist

Cyber warranty requirements vary by provider. However, most programs require organizations to demonstrate that core cybersecurity controls are operating before considering a claim. The checklist below uses ESET’s cyber warranty requirements to illustrate the controls providers may mandate.

How does a cyber warranty claim work?

A cyber warranty claim runs on a fixed clock. Under ESET’s cyber warranty, for example, an incident must be reported within 48 hours of discovery, and the supporting evidence must be submitted within 15 days or the claim can be declared invalid.

More important than what to do in a claims scenario is what not to do: Don’t pay a ransom without your cyber insurer's written consent. Most cyber policies cover extortion payments, and most will decline to reimburse a payment made without that consent. Contact your cyber insurer at the start so it can orchestrate the claims process.

Once the customer notifies the cyber warranty provider within the mandated time window, these steps follow:

In parallel with notifying the cyber warranty provider, the customer should notify their cyber insurer. If the incident is also covered by cyber insurance, the insurer takes the lead and directs the response.
The provider validates the customer’s enrollment as of the incident date.
The provider validates that the customer’s required security controls were correctly configured and active when the incident occurred. This should show the control was in place and operating on the affected assets when the incident occurred.
Based on the evidence, the provider determines whether the trigger was met and, if so, makes the payment.

When no cyber insurance policy applies, a cyber warranty claim may be resolved more quickly because the provider focuses on whether the warranty’s payment requirements were met. A cyber insurer needs to determine which costs are covered and how much the covered loss is worth, which is more complicated.

Where both apply, the warranty pays eligible expenses after the insurer determines what the policy covers, so the warranty follows the insurance timeline.

The most common reasons cyber warranty claims fail are missing security controls, incomplete deployment, and late notification. In practice, organizations may discover that MFA, patching, or other required controls weren’t fully implemented, or that the covered security product was licensed but never deployed on the affected asset. Late notification is one of the most avoidable causes of claim denial.

Are cyber warranties worth it?

A cyber warranty is worth having when it comes included with security a business was already buying, and worth scrutinizing when it is sold as a replacement for cyber insurance. The benefit is real but bounded by named events, predetermined payout amounts, and usually one qualifying claim per term.

Critics point out that cyber warranties have several shortcomings:

Most cyber warranties only pay out when a vendor’s product or service doesn’t function as promised.
Most cyber warranties are only valid when the solution associated with the warranty is in use.
Many cyber warranties have historically been withdrawn from the market within five years of being announced.
It has traditionally been difficult to compare cyber warranties because obligations and exclusions vary widely.

Cyber warranties and cyber insurance serve different purposes. While cyber insurance provides broader protection against a wide range of cyber-related losses, a cyber warranty may help reimburse certain qualifying expenses that remain payable by the business.

Some cyber incidents result in losses below the policy deductible, leaving the organization responsible for the full cost. In those situations, a cyber warranty may provide value if its terms reimburse qualifying expenses. Cyber insurance remains the broader financial safety net for larger losses and risks that fall beyond the warranty's scope.

Maintaining compliance with cyber warranty terms adds business value beyond potential payouts if controls fail:

A cyber warranty can support reduced cyber insurance premiums because correctly deploying the mandated controls significantly reduces a cyber insurer’s risk exposure.
Many of today’s cyber warranties are based on verifiable control implementation and frequent (e.g., every two weeks) external scans covering network security, DNS health, application security, data leaks, vulnerabilities, etc. Both these benefits elevate an organization’s cybersecurity posture.
A cyber warranty may cover business interruption costs incurred within a cyber insurance policy’s waiting period, because its trigger is the incident’s occurrence and how long the outage lasts.
If an incident is contained before it reaches the cyber insurance deductible—as many are because the required controls work—the cyber warranty covers the cost and the policy is never called on. If the loss exceeds the insurance policy’s limit, the warranty may also cover certain remaining expenses that qualify under its terms. Both reduce overall exposure.

How to evaluate a vendor’s cyber warranty

When evaluating a cyber warranty, look at how the maximum payout is calculated, not just the advertised coverage amount. A warranty capped per endpoint pays very differently from one capped per participant, and a warranty that is excess to other benefits pays only once those benefits are exhausted.

Questions to help compare cyber warranties include:

Is the limit per participant or per endpoint, and what is the realistic maximum payout for your business?
How many claims can a participant make per term? (One per 12 months is common.)
What specific cybersecurity controls must participants maintain?
How is control operation verified, how frequently, and by whom?
What is the notice window?
What exclusions could void a claim?
Does the warranty pay independently, or only after other insurance, warranties, or financial benefits have been applied?
Do you have to buy the most expensive solution tier to get the warranty?
Does the warranty provide meaningful support for incidents of different sizes and types, or only a few narrow scenarios?
Are the full terms available for review, not just a summary or overview?

In practice, the key comparison is between the cybersecurity solutions themselves, not the warranties. “A warranty on a weak product is a weak warranty,” explains Kirsten Bay of Cysurance. “The warranty instrument only works because the controls underneath it are holding incident severity down.”

ESET’s cyber warranty

ESET’s cyber warranty is included at no additional cost with eligible ESET subscriptions tiers and is currently available in selected markets. Provided by Cysurance, it offers maximum coverage amounts (formally called indemnification levels) of $500,000 or $1,000,000 and covers one qualifying incident per 12-month period.

Unlike many cybersecurity offerings that leave customers to piece together required controls themselves, ESET provides a comprehensive security platform that helps organizations satisfy many of the technical requirements associated with cyber warranty eligibility.

Features such as Vulnerability & Patch Management (V&PM) and MFA are available within ESET PROTECT Premium Plus and ESET PROTECT Ultimate Plus, helping organizations address key controls related to patching, access security, and ongoing risk reduction.

Under ESET’s cyber warranty, an incident must be reported within 48 hours of discovery and supporting evidence must be submitted within 15 days.

To help customers maintain eligibility and avoid configuration issues that could affect coverage, ESET also offers guided onboarding and deployment services that support proper implementation, ongoing management, and operational readiness.

FAQs

Is a cyber warranty the same as cyber insurance?

No. Cyber insurance is a regulated policy that transfers a broad range of losses to an insurer and assesses each claim individually. A cyber warranty is a contract with your security vendor that pays set amounts on defined triggers. Most organizations that carry a warranty still need insurance.

What does a cyber warranty typically cover?

Programs differ, so read the terms. ESET’s warranty covers four event types: ransomware and business email compromise, compliance events that trigger legal reporting obligations, cyber legal liability arising from those events, and lost business income. Each has its own limit, capped by your indemnification level.

Do I have to do anything to keep the warranty valid?

Yes, and this is where claims most often fail. You must keep specified controls in place: endpoint protection, active MDR monitoring, enforced MFA, immutable backups, AES-256 encryption, patching within 60 days, and documented security awareness training. Ignoring your provider’s alerts can also affect eligibility.

How long do I have to report an incident?

Under ESET’s program, 48 hours from discovery. You then have 15 days to provide the supporting evidence, namely enrollment records, log files and incident details. Miss either window and the claim can be declared invalid. Report to your insurer at the same time.

Is a cyber warranty worth having?

A cyber warranty can add value when it is included with security services a business already intends to buy. Buyers should scrutinize any warranty presented as a replacement for cyber insurance. Its benefits remain limited to defined events, specified payments, and the applicable number of qualifying claims per term.