Such policies typically cover the cost of tracing the source of data breaches and compensation, but not ransom paid to cyberattackers.