Cyber Insurance Excess Layers: Building Capacity Past One Carrier

Building Capacity When One Carrier Isn't Enough

Every cyber carrier has a ceiling on how much limit it's comfortable writing for a single risk. That ceiling exists for good reason, no insurer wants its entire book exposed to one catastrophic claim from one policyholder, but it creates a real problem for businesses whose actual exposure exceeds what any single carrier will offer. The solution the market settled on is layering: a primary policy up to a certain limit, then one or more excess layers stacked on top, each carrier taking a slice of the total tower rather than one carrier shouldering all of it.

What Exactly Is an Excess Layer, and How Does It Function?

An excess layer is additional coverage sitting above a primary policy that only responds once the primary limit has been fully exhausted by a covered claim.

Picture the primary policy as the first line of defense, paying out from the first dollar of a covered loss up to its stated limit. The excess layer sits directly above it, staying completely dormant unless a claim is large enough to burn through the entire primary limit. Once that happens, the excess layer picks up where the primary left off, up to its own separate limit, and so on through however many layers the tower has been built with.

Why Can't a Business Just Ask One Carrier for a Bigger Number?

Individual carriers cap how much limit they're willing to deploy on any single risk, which makes relying on one carrier for a very large total limit impractical for bigger organizations.

This isn't a negotiating tactic, it reflects genuine risk management on the carrier's side. Writing an outsized limit on one account concentrates too much of that carrier's own risk in a single policyholder, which is exactly the kind of concentration a well-run insurer avoids. Building a tower across multiple carriers spreads that concentration out, letting each participant take a manageable slice of the total risk instead of one carrier absorbing all of it.

How Do Excess Layers Actually Get Structured Into a Tower?

Layers stack sequentially, each with its own attachment point where it begins responding and its own limit for how much it will pay once triggered.

Layer	Attachment point	What triggers it
Primary	From the first dollar of a covered loss	Any covered claim up to the primary limit
First excess	Where the primary limit is exhausted	Only losses exceeding the full primary limit
Second excess	Where the first excess limit is exhausted	Only losses exceeding primary plus first excess combined
Additional layers	Wherever the prior layer's limit ends	Only losses large enough to reach that point in the tower

A business needing a total limit far beyond what any single carrier offers might end up with four or five layers, each written by a different insurer, all coordinated to work together as one continuous tower.

What Does "Follow Form" Actually Mean, and Why Does It Matter So Much?

Follow form means an excess layer adopts the same coverage terms as the primary policy beneath it, keeping the definition of a covered loss consistent as a claim moves up through the tower.

This sounds like a technical detail, but it's one of the most important things a broker checks when assembling a tower. If an excess carrier doesn't fully follow form and instead writes its own narrower terms, a loss that's clearly covered under the primary policy can hit a gap once it reaches that excess layer, effectively leaving the business exposed for the portion of the loss that falls into that specific layer. Coordinating this carefully connects directly to broader questions of how a cyber insurance program should be structured across primary, excess, and the gaps between them, since wording alignment is really the core challenge of assembling any multi-carrier tower.

Does the Availability of Excess Capacity Change With Market Conditions?

Yes, excess capacity is often the first place carriers pull back when the market hardens, since it represents concentrated exposure to the largest possible claims.

Primary layers tend to remain more stable through market cycles because they respond to a much wider range of claim sizes, including smaller, more predictable ones. Excess layers only get triggered by the largest, least frequent losses, which makes them harder for carriers to price confidently and more likely to see reduced appetite during a hardening cycle. Businesses that wait until the top of their tower is hard to place before starting the renewal conversation often find themselves with far fewer options than they expected.

How Does This Connect to the Reinsurance Market Behind the Scenes?

Excess cyber capacity ultimately depends on reinsurance capacity backing the carriers willing to write those higher layers.

A primary or excess carrier writing a large limit typically isn't holding all of that risk itself, it's ceding a meaningful share to reinsurers. When reinsurance capacity for cyber tightens, that tightening flows directly into how much excess capacity primary and excess carriers are willing to offer policyholders. This dynamic is explored in more depth in the discussion of how reinsurers build capacity for cyber as a systemic peril, since the excess cyber market and the reinsurance market backing it move together far more closely than most policyholders realize.

Building a cyber tower with excess layers isn't just about adding up bigger numbers until the total limit looks adequate. It's about making sure every layer actually talks to the one beneath it, so a large claim moves cleanly through the tower instead of falling into a gap created by mismatched wording between carriers who never coordinated closely enough.

Sources

• Insurance Information Institute: Cyber Insurance
• NAIC: Cybersecurity