A single phishing email can lock a company out of its own systems for days. Payroll stalls, customers can’t get through, and someone has to explain to the regulator what happened to the data. Most businesses have insurance for fire and theft, but far fewer have anything in place for this. Cyber insurance is designed for exactly this situation. This guide covers what it pays for, where it stops and how to choose a policy that fits.
What is cyber insurance?
Cyber insurance, sometimes called cyber liability insurance, is designed to pay for the financial fallout when a business is hit by a cyberattack or data breach. Think of it like motor insurance. It won’t stop the accident, but it can cover the repair bill and the legal work that follows.
What does cyber insurance cover?
Policies differ between insurers, but most may pay for some mix of business interruption while systems are down, forensic investigation to find and contain the breach, restoring systems and recovering data, and breach response such as customer notifications, call centre support and credit monitoring. Legal costs, regulatory investigations and PR support to repair your reputation are usually included too. Business interruption cover typically runs for a set period, often 90 to 120 days, and cover for supply chain incidents is becoming more common.
What is the difference between first-party and third-party cover?
First-party cover addresses your own losses, such as getting systems back up, the profit you lose while they’re down, the specialists you bring in. Third-party cover deals with claims made against you by other people. If a breach exposes customer data and they take action, or an investigation is opened, third-party cover can pay for your legal defence and any damages. Comprehensive policies include both, so check you’re getting each half rather than assuming.
Does it cover ransomware and phishing scams?
Ransomware usually falls under cyber extortion cover, which can help pay for specialist consultants. Any cover for ransom payments is subject to the policy terms and applicable law, including UK sanctions rules. That last part is changing. Some insurers are limiting or dropping ransom payments because the sums have grown so large, and government agencies generally advise against paying at all.
Phishing depends on what the scam does. If a phishing email leads to malware or a data breach, the response costs are normally covered. If an employee is tricked into transferring money, for instance by someone posing as a director, that’s social engineering fraud. Most policies cover it only as an optional extension, often with tight limits.
Why do businesses need cyber insurance?
Many owners assume their property or liability policy has them covered. Those policies often leave out data restoration, forensic support and PR costs, and where they do mention cyber risk, the definitions can be too narrow to help in a real incident. A standalone cyber policy can close that gap and keep a cyber claim from eating into the limits on your other insurance.
Cost is also a consideration. Even a modest incident can mean forensic specialists, legal fees and days of lost trading, which a smaller business has less room to absorb.
A policy often brings other benefits as well. Applying for one pushes you to look at your vulnerabilities and work out what a bad day would cost. Many policies also give you access to an incident response team when you need one most, and holding cover shows customers and suppliers that you take the risk seriously.
What is not covered, and does it replace good cybersecurity?
It doesn’t replace cybersecurity, and insurers are upfront about that. Breaches that happened before you bought the policy are excluded, as are attacks that exploit a vulnerability you knew about and never fixed. Losses caused by insiders or employee error are often excluded, as well as war-related and state-backed attacks. So is the cost of upgrading your systems afterwards unless the policy says otherwise, along with future lost profit from reputational damage and any fines that can’t legally be insured.
Insurers also look at your controls before they quote. Some won’t offer cover at all without multi-factor authentication and encryption in place. Good security is what keeps a policy affordable and a claim payable.
How much does cyber insurance cost and how do you choose a policy?
Cost varies greatly. A small business can pay anywhere between £100 and £1,000 a year. Larger firms, and those holding sensitive data, pay more. Turnover, industry, the data you handle, the limit you choose and any claims in the past five years all push the price up.
When comparing policies, check the limit against a realistic worst-case and how long business interruption cover lasts. Look at whether supply chain incidents and social engineering are included, how ransomware is worded and whether there’s a 24-hour incident response line. Insurers may ask for a security audit before quoting, so have your documentation ready.
About JENOA
JENOA is a digital insurance and reinsurance broker offering risk advisory, InsurTech and Shariah-compliant solutions alongside its traditional London market capabilities. Backed by Abdul Latif Jameel, an international family business, JENOA combines established insurance expertise with technology-led approaches to risk management and product development.
If you’d like cover that fits how your business works, contact us for tailored cyber insurance advice.
This article is for general information only and does not constitute advice. Cover is subject to the terms, conditions, limits and exclusions of the individual policy.
