The Plain English Version

Cyber insurance covers costs from cyber incidents - breach response, legal fees, regulatory fines, business interruption, and sometimes ransom payments. It is a financial safety net when things go wrong.

But it is not a substitute for security. Insurers increasingly require evidence of controls before they will cover you, and poor security leads to denied claims or unaffordable premiums.

What Cyber Insurance Typically Covers

First-party: Your direct costs - incident response, forensics, notification, business interruption, data recovery

Third-party: Claims against you - legal defence, settlements, regulatory fines

Read the policy carefully - coverage varies significantly between insurers.

What Affects Your Premium

  • Your security posture - MFA, backups, patching, training
  • Industry - Healthcare and finance face higher premiums
  • Data held - More sensitive data means more risk
  • Revenue - Larger businesses pay more
  • Claims history - Previous incidents affect pricing
  • Certifications - Cyber Essentials can reduce premiums

Getting the Right Coverage

Work with a broker who specialises in cyber insurance. Understand what is and is not covered. Check exclusions carefully - some policies exclude nation-state attacks, social engineering fraud, or incidents from unpatched systems.

Ensure coverage limits match your potential exposure. A 100k policy is inadequate if a breach could cost you millions.

The Security Connection

Insurers now require minimum security controls - typically MFA, backups, endpoint protection, and patching. Some require Cyber Essentials certification. Failing to maintain these controls can void your policy when you need it most.