Cyber Insurance: What Does It Really Protect?

Cyber insurance can provide valuable financial and specialist support following ransomware, data loss, business interruption, fraud or another serious cyber incident. However, buying a policy does not mean every cyber-related loss will automatically be covered.

Policies contain conditions, exclusions, limits and security requirements. The protection available depends on the wording purchased, the information provided during the application and whether the business continues to operate the security controls it declared.

What is cyber insurance?

Cyber insurance is intended to help an organisation manage some of the financial and operational consequences of a cyber incident. Depending on the policy, it may provide:

• Financial reimbursement
• Specialist incident-response support
• Forensic investigation
• Legal advice
• Data-breach support
• Public-relations assistance
• System-restoration support
• Business-interruption cover
• Liability protection
• Access to specialist negotiators, where legally and contractually permitted

Several points apply to almost every policy: policies vary considerably; cover depends on the wording; policy limits and sub-limits apply; excesses may apply; not every incident or cost is covered; and some support may require prior insurer approval. Cyber cover may also be included within another business policy — but businesses must check the actual extent of that cover rather than assuming it exists.

First-party and third-party cover

Most cyber policies group protection into two broad areas, and the distinction is worth understanding before any broker conversation.

Not every policy includes every item listed above, and whether regulatory penalties can be insured depends on the legal position and the policy — it should never be assumed.

What cyber insurance may cover

Subject to the policy wording, and within the applicable limits, a cyber policy may respond to areas such as:

• Ransomware response, where specifically included
• Malware incidents
• Data breaches and notification support
• Forensic investigation
• Restoration and recovery costs
• Business interruption, subject to waiting periods and limits
• Crisis management and communications
• Legal advice
• Certain fraud losses, where explicitly included
• Certain supplier-related incidents, where the wording extends to them
• Certain cloud-service interruptions, where specifically covered
• Third-party claims

Every item above is conditional. There is no universal coverage list — only the list in the policy your business actually holds.

What may not be covered?

Exclusions and limitations vary between insurers and policies. Examples worth reviewing in any wording include:

• Incidents known before the policy began
• Inaccurate or incomplete application answers
• Failure to maintain declared security controls
• Unsupported or obsolete systems
• Unencrypted devices or data where encryption was required
• Weak or absent multi-factor authentication where it was declared or required
• Voluntary shutdowns outside the policy wording
• Contractual liabilities not otherwise covered
• Losses below the excess or above the policy or sub-limit
• Certain payment-diversion or social-engineering fraud
• Infrastructure failure not caused by a covered cyber event
• Bodily injury or physical damage
• Acts involving sanctioned parties
• War, state-backed activity or systemic cyber-event exclusions
• Costs incurred without required insurer approval
• Reputational harm that cannot be quantified under the policy

Not all policies contain every exclusion above — which is precisely why the specific wording matters.

Why application answers must be accurate

Cyber-insurance applications and renewal forms may ask about multi-factor authentication, backups, encryption, security updates, endpoint protection, administrator accounts, remote access, incident-response plans, employee training, email security, unsupported software, cloud services, previous incidents, the types of data held, business continuity and supplier access.

These answers should be verified rather than assumed. If an application states that MFA protects all remote and administrator access, the business should confirm that this is genuinely true across every relevant account and system — not just the obvious ones.

In practice, application forms may be completed by a director, finance, an insurance broker, an office manager or an IT provider. Whoever fills in the form, ensuring the answers are accurate remains important — inaccurate declarations are a common route to disputes at claim time.

The security controls insurers may expect

Expectations vary according to business size, turnover, sector, the data handled, the systems used, claims history, risk profile, policy limits and the individual insurer. Controls commonly asked about include:

• Multi-factor authentication
• Endpoint protection
• Vulnerability and patch management
• Protected administrator accounts
• Secure remote access
• Encrypted backups
• Isolated or offline backups
• Restoration testing
• Supported software
• Staff awareness training
• Email security
• Incident-response planning
• Access reviews
• Logging and monitoring
• Business-continuity planning

Cyber insurance does not replace security

Insurance transfers some financial risk. It does not prevent an attack, install security updates, stop phishing, protect administrator accounts, restore data automatically, communicate with customers, run the business during an outage, make unsupported software safe or guarantee that every claim will be paid.

What happens during a claim?

1. 1Recognise and contain the incident.
2. 2Follow the organisation’s emergency plan.
3. 3Contact the insurer or approved incident hotline promptly.
4. 4Follow the policy’s notification and consent requirements.
5. 5Preserve evidence and records.
6. 6Use approved forensic, legal, recovery or communications specialists where required.
7. 7Keep a record of decisions, costs and communications.
8. 8Assess whether other notifications may be required, including customers, regulators, insurers or law enforcement.
9. 9Continue regular communication with the insurer and response team.
10. 10Complete a post-incident review.

The incident-response service may matter as much as the payout

A useful cyber policy may provide access to forensic investigators, specialist lawyers, data-breach advisers, recovery specialists, crisis-communication support, specialist negotiators, identity-monitoring services and claims coordinators.

This matters because, during a serious incident, the business may not know what happened, whether attackers still have access, what data was affected, whether systems are safe to restore, who must be informed, what evidence must be retained or what communications are appropriate.

Business interruption

Business-interruption cover is one of the most commonly misunderstood parts of a cyber policy. Before relying on it, a business should understand the waiting period, the indemnity period, the definition of interruption, how lost income is calculated, whether increased operating costs are covered, whether supplier or cloud outages are included, whether voluntary shutdown is covered, the applicable limit, any sub-limit and the evidence required to support the loss.

For example, a policy may cover certain lost income after a qualifying cyber incident — but only after a waiting period and only within the defined indemnity period.

Social engineering and payment fraud

Business email compromise, invoice redirection, fraudulent payment instructions, impersonation and funds-transfer fraud may not always be covered by standard cyber wording. Some businesses may need specific social-engineering cover, crime cover, fidelity cover, funds-transfer fraud cover or endorsements and extensions. The final position depends on the actual policies held.

Suppliers and cloud services

Many businesses depend on managed IT providers, cloud platforms, hosted applications, payment providers, website hosting, data centres, payroll providers and other outsourced services. It is worth checking whether the policy covers incidents affecting those suppliers — concepts to ask about include dependent business interruption, contingent business interruption, system-failure cover and any supplier-related exclusions.

Practical business implications

Ownership

Assign responsibility for the insurance relationship, technical verification, policy renewal, incident notification, document storage and an annual review. Insurance that nobody owns tends to be insurance nobody has read.

Documentation

• Policy schedule and full wording
• Broker details and insurer emergency number
• Policy number
• Incident-response instructions
• The security controls declared to the insurer
• Application and renewal answers
• Endorsements, exclusions, excesses, limits and sub-limits

Testing

• Insurer contact details
• The incident-response plan
• Backup restoration
• Alternative communication
• Management escalation
• Decision-making responsibilities

Questions to Ask Your Broker or Insurer

1. 1What events and losses does the policy cover?
2. 2What are the principal exclusions?
3. 3What is the policy limit?
4. 4Which areas have separate sub-limits?
5. 5What excesses and waiting periods apply?
6. 6Does the policy cover business interruption?
7. 7How is lost income calculated?
8. 8Are cloud and technology-supplier outages covered?
9. 9Is social-engineering or payment-diversion fraud included?
10. 10Does the policy cover ransomware response?
11. 11What restrictions apply to extortion-related costs?
12. 12Does the policy include forensic and legal support?
13. 13Which specialists must we use?
14. 14Must we obtain approval before incurring costs?
15. 15How quickly must an incident be reported?
16. 16Is cover available for regulatory investigation or defence costs?
17. 17Are state-backed or systemic cyber incidents excluded?
18. 18What security controls must remain in place?
19. 19What changes must we report during the policy period?
20. 20What evidence would be required during a claim?
21. 21Does another existing business policy already include or exclude cyber losses?
22. 22Who should we contact outside normal working hours?

A broker can explain and arrange cover, but the business should still read the policy schedule, wording, endorsements and exclusions.

Questions to Ask Your IT Provider

1. 1Can you verify the technical answers in our insurance application?
2. 2Is MFA enabled for all administrator and remote-access accounts?
3. 3Are any systems or users excluded from MFA?
4. 4Which systems are unsupported or approaching end of support?
5. 5How are security updates monitored?
6. 6What endpoint protection is deployed?
7. 7Which accounts have administrative access?
8. 8Are our backups encrypted?
9. 9Are backups separated from the production environment?
10. 10When was restoration last tested?
11. 11How long would full recovery take?
12. 12Is Microsoft 365 or other cloud data backed up separately?
13. 13How is supplier access controlled and logged?
14. 14Do we have an incident-response plan?
15. 15Who should contact the insurer during an incident?
16. 16Can you support an insurer-appointed forensic team?
17. 17Which security-control changes must be reported before policy renewal?
18. 18Can you provide written evidence of the controls we have declared?

The IT provider should confirm technical facts. It should not provide regulated insurance advice unless authorised and qualified to do so.

The IT Club View

Cyber insurance is worthwhile for many businesses, because a serious cyber incident can require expertise and expenditure that a small organisation could not quickly assemble on its own. However, the insurance must be treated as part of cyber resilience rather than a replacement for it.

The most common business mistake is to view the policy as a document that can be filed away until an incident occurs. A better approach is to connect the policy to the organisation’s security controls, the IT provider, the incident-response plan, backups, recovery testing and management decision-making.

Cyber insurance works best when the insurer, broker, business and IT provider all understand their responsibilities before anything goes wrong. The goal is not simply to obtain a certificate of insurance. It is to ensure that the policy, technical controls and response plan genuinely work together.

The Operational Heartbeat

Insurance conditions and technical controls can drift after the policy starts. A recurring review should check MFA coverage, administrator accounts, backup success, restore testing, endpoint-protection coverage, unsupported systems, patching, remote access, cloud backup, leaver accounts, supplier access, policy contact details, the controls declared to the insurer and any material technology changes.

Cyber insurance needs an operational heartbeat: the controls declared to the insurer should be checked, failures acted upon and evidence retained throughout the policy period.

This article provides general technology and cyber-security information, not insurance, legal or financial advice. Insurance advice should be obtained from an appropriately authorised insurer or broker.