Pick per‑incident if the business expects two or more claims in a year.
Pick aggregate only if the firm can cover one large deductible and expects fewer than two claims.
Key variables: aggregate versus per‑incident explained
An aggregate deductible is paid once and then reduced by each claim.
This can leave no cover after several small incidents.
An aggregate deductible reduces available insurer contribution as claims occur.
Read the policy wording to see which costs reduce the aggregate.
A per‑incident deductible applies to each loss separately.
This causes separate cash hits for each event across the year.
Per‑incident protects against a single cumulative depletion of cover across the policy year.
It suits firms needing steady cashflow and tender compliance.
Pause for clarity — key points follow.
What an aggregate deductible actually covers
The aggregate deductible lowers as each claim triggers insurer payment.
Confirm whether incident response, legal fees and third‑party claims count.
Ask whether regulatory fines or PCI penalties reduce the aggregate deductible.
The most frequent placement error is assuming only large claims affect an aggregate.
Read examples in the policy to see exclusions and sublimits.
A short clause can change the depletion outcome for the year.
How per‑incident deductibles work day to day
The insured pays the deductible for each separate event.
This means cashflow must cover each episode as it happens.
Per‑incident makes accounting cleaner for separate incidents and invoices.
That helps when response costs arrive in separate bills.
Most guides skip this bookkeeping advantage.
Clear invoices simplify claims and client reporting.
A short practical note:
Which deductible fits England SMEs by growth stage
Startups and microbusinesses need cashflow predictability more than premium shaving.
Per‑incident keeps cover available after a single loss.
Scaling SMEs face rising incident frequency as staff and systems grow.
Multiple small incidents change the expected total cost over a year.
Mature SMEs with reserves can accept an aggregate deductible to lower premiums.
Confirm reserves cover a plausible cumulative worst case before choosing aggregate.
Startup and microbusinesses
A small firm with limited reserves benefits from per‑incident wording.
This prevents multiple small claims from leaving the business uninsured later.
Typical incidents include phishing, small data exposures and short business interruption.
Expect low frequency but follow‑up costs that still add up.
A common placement error is choosing aggregate only for a cheaper premium.
The model often shows higher expected out‑of‑pocket costs in growth years.
Scaling SMEs
As headcount rises, frequency of minor incidents usually increases.
This makes aggregate deductibles riskier in practice.
Simulate two or three incidents per year when modelling a growing firm.
Use the simulation to see if the aggregate would deplete under stress.
Most brokers quote lower premiums for aggregate deductibles.
The expected annual cost often flips after modelling frequency and severity.
Pause to check your assumptions.
Modelling out‑of‑pocket costs and scenarios
A simple frequency times severity model shows expected annual retained costs.
Run three scenarios: low, medium and high frequency.
The model needs three inputs: incidents per year, average claim cost and deductible.
Use these to simulate annual payments under each structure.
Recommendation and caveat below.
Do not rely on a single arbitrary threshold when deciding.
Calculate expected annual out‑of‑pocket under both structures and add premium differences.
Prefer per‑incident when the model shows a high chance of aggregate depletion.
Also prefer it when total expected cost and cashflow volatility make aggregate unacceptable.
This works well in theory, but in practice errors in counting what reduces the aggregate can change outcomes.
Apply the model with real inputs from the IT Manager and CFO before renewing.
How to model frequency and severity now
List reasonable incident frequencies for the next 12 months.
Assign likely average costs using past invoices or market rates.
For per‑incident, sum the lesser of each claim and the per‑incident deductible.
For aggregate, simulate cumulative depletion across the year.
Consider the legal framework: Insurance Act 2015 and NIS Regulations 2018.
Also note the Computer Misuse Act 1990 when thinking legal exposure.
Sample calculations to test at renewal
Sample 1: small firm expects 0.5 incidents at £3,000 average.
Per‑incident £5,000 gives expected payment £2,500.
An aggregate of £25,000 gives low depletion risk in this scenario.
Sample 2: growing firm expects 3 incidents at £30,000 average.
Per‑incident £10,000 gives expected payment £30,000.
Aggregate £50,000 would likely be exhausted before year end.
A case to test: three similar ransomware events depleted the aggregate and left a fourth uninsured.
Premiums were lower, but the firm funded a costly response and paused trading.
| Criterion |
Aggregate deductible |
Per‑incident deductible |
| Cashflow impact |
Single cumulative hit that can exhaust cover |
Smaller episodic hits spread through year |
| Premium tendency |
Often lower annual premium |
Often higher premium but predictable exposure |
| Best for |
Firms with reserves and low expected frequency |
Firms needing cashflow certainty and tender compliance |
| Complexity |
Requires careful clause review and modelling |
Simpler claim accounting and client reporting |
Step 1
Set incidents per year and average cost.
Step 2
Compute per‑incident expected payment.
Step 3
Simulate cumulative depletion for aggregate.
A practical next step is to run simple deductible modelling to quantify expected annual retained costs.
Treat claim frequency as a random variable and severity with a chosen distribution.
For a per‑claim deductible d and claim severity S, expected payment per claim is E[min(S,d)].
For frequency N independent of severity, expected annual payment equals E[N] times E[min(S,d)].
For an aggregate deductible A, estimate E[min(A, sum_i min(S_i, limit))].
A small Monte Carlo run gives percentiles and probability of aggregate depletion.
Run 10,000 simulations with plausible incidents per year to see 75th to 95th percentile cash needs.
These percentiles show the cash required for tail events.
To decide at renewal, compare premiums plus expected retained costs under each structure.
Present mean cost and tail risk to the CFO and broker to clarify trade‑offs.
Negotiation wording, clauses and checklist to use now
Ask for side‑by‑side quotes with the same limits and different deductible structures.
This makes total cost comparison straightforward.
Use clear clause language in client contracts to match the chosen wording.
Avoid vague terms that insurers may interpret against the insured.
The broker should confirm in writing which costs reduce the deductible and whether reinstatement applies.
Get written answers to avoid later disputes.
Exact clause language to request
Request: "The deductible shall apply each and every loss/incident and not in the aggregate over the policy period."
Use this when per‑incident is required.
If aggregate is accepted, request: "The deductible shall be applied in the aggregate for the policy period as specified herein."
Ask for examples of how it operates in practice.
A practical negotiation mistake is not getting confirmation about regulatory fines in writing.
Always secure written clarification from the underwriter.
Broker and underwriting questions to ask
Ask: "Please provide two written quotes with identical limits and sublimits but different deductible types."
This allows apples‑to‑apples comparison.
Ask: "Which cost categories reduce the aggregate deductible: incident response, ransom, legal costs, regulator fines?"
Get a written answer and keep it with placement records.
The data points from the IT Manager and CFO must feed the model before final placement.
Do not model with guesses alone.
A short reminder to follow up.
Policy traps: reinstatement, fines and exclusions to check
Some policies reinstate limits after a claim but do not replenish an exhausted aggregate deductible.
Confirm reinstatement and deductible reset terms clearly.
Regulatory fines and contractual liabilities may be excluded or capped by sublimits.
Check wording against GDPR and client requirements.
A common concrete case: three mid‑size breaches consumed the aggregate deductible.
A fourth breach then left the firm funding response entirely and halted trading.
Reinstatement and depletion explained
Reinstatement can restore insurer limits but not always the spent deductible.
Always ask whether the deductible resets after reinstatement.
If the deductible stays spent, further incidents that year can become uninsured.
This creates sudden large cash demands on the business.
The data shows many disputes come from unclear reinstatement clauses.
This is why Insurance Act 2015 matters during placement.
Regulatory fines
Some insurers treat ICO fines differently or exclude them from cyber cover.
Confirm treatment with the underwriter and check policy schedules.
Refer to ICO guidance when considering fines and post‑breach obligations.
See guidance at Information Commissioner's Office.
Regulations such as the Network and Information Systems Regulations 2018 affect critical service obligations.
The Computer Misuse Act 1990 influences criminal liability, not insurance cover.
Not relevant for very large firms with enterprise placements, or for policies that do not offer an aggregate deductible option. Also less relevant where a single catastrophic event dominates the risk profile; in those cases per‑incident and aggregate outcomes may converge.
For a quick comparison, ask the broker to run two written scenarios and share the model with the CFO before renewal.
This shows when aggregate depletion materially increases catastrophic cash calls.
Deductibles and incident response costs have accounting and tax consequences that SMEs must not ignore.
Incident response costs are typically trading expenses for UK corporation tax when wholly and exclusively for trade.
An aggregate deductible creates a potential large one‑off liability that should be provisioned.
Directors must reflect this in working capital forecasts if cashflow might strain.
Also consider whether premiums are expensed or capitalised under accounting policy.
Expected uninsured losses should inform a reserve or contingency line.
Frequently asked questions
What is the practical meaning of "Each and every"?
"Each and every" means the deductible applies to each separate incident.
This prevents cumulative depletion across the year.
The phrase is common in client contracts and insurers often match it to "per‑incident" wording.
Confirm wording in both client contracts and insurer documents.
Does an aggregate deductible lower my premium
An aggregate deductible often reduces premium, but not always.
The premium effect depends on expected frequency and severity.
Only modelling actual incident likelihoods shows whether premium savings outweigh higher retained costs.
Ask the broker to include premium differences in the model.
How do reinstatement clauses affect deductible
Reinstatement may restore insurer limits but not the deductible.
Confirm whether the deductible resets after reinstatement and get this in writing.
Many disputes come from assumptions about reinstatement that differ from wording.
Record written confirmation from the insurer.
How often should an SME revisit its deductible
Review deductible choice every renewal and after significant growth events.
Increase review frequency with staff or data volume changes.
Insurers adjust underwriting and sublimits over time, so regular review keeps cover aligned.
A yearly review is the minimum for growing firms.
Ask the broker for two written quotes and share them with the CFO this week.
The plan to act this week
Step 1: set a single annual maximum out‑of‑pocket figure the business can absorb without cutting operations.
Share this figure with the broker and CFO.
Step 2: ask the broker for two written quotes with identical limits but different deductible types.
Include sample wording for both options.
Step 3: run the frequency times severity model with the CFO and IT Manager.
Then choose the deductible that matches the agreed tolerable figure.
Will GDPR fines be covered
Insurer treatment of GDPR fines varies between policies.
Some policies exclude fines; others cover defence and investigation costs but not the fine.
Check policy wording and seek written confirmation from the underwriter about fines and legal costs.
Do not assume fines are covered without written proof.
Which professionals should be involved
CFO for cashflow, IT Manager for likelihood inputs and the broker for wording.
The DPO should review regulatory exposure.
This mix produces realistic frequency and severity inputs and ensures clauses align with client contracts.
Keep all written answers with the placement documentation.
