From an interview with Drew Bartkiewicz of CyberFactors.
Right now the norm is that cloud companies cap their indemnification at the value of the contract. So if you spend $10,000 a year on a cloud application, the maximum you can get in the case of a breach is $10,000. But the data in question could be worth many times that. The average cyber-incident in our models costs $4.5 million.