Cyber insurance has attracted much attention fromboth practitioners, policymakers and academics in the past fewyears. However, it also faces some challenges before it can reachits full potential as a tool for better cyber risk management. Onesuch challenge is the gap between what customers expect andwhat insurers really offer.

This paper investigates this gap empirically, based on interviewswith informant companies in Norway and Sweden consideringcyber insurance. The expectations expressed in the interviewsare compared to anonymized incident claims reports and claimsstatistics for 2018 from a global insurance intermediary.

The results show no obvious pattern of discrepancies betweendifferent domains. However, informant expectations on businessinterruption coverage are much greater than one would expectfrom its share of claims. In this respect, informant expectationson business interruption coverage are more aligned with somerecently published scenarios on possible major business interruptions.