Home / Knowledge hub / Cyber insurance
Knowledge hub
Cyber insurance
Cover for costs after a cyber incident, usually conditional on controls being in place.
What it means
Cyber insurance is a policy that helps pay for the costs of a cyber incident. First-party cover can include incident response, data restoration, business interruption and extortion. Third-party cover can include customer claims, legal costs and regulatory proceedings, depending on the policy and the law.
It transfers part of the financial risk. It does not prevent an incident, reduce its cause or restore trust, and the terms vary a great deal between insurers. The wording of the policy matters more than the name on the cover.
Why it matters
A serious incident can bring forensic fees, legal advice, customer notices, downtime and lost sales in the same month. For a growing company, policy support for those costs can decide whether it recovers. Larger customers also increasingly ask whether you hold cover.
Insurers check what you do. Applications ask about controls, and cover may be reduced, costly or refused without them. An answer that proves untrue can create problems at claim time, so the proposal form is a document to take seriously.
How it shows up
Insurers commonly ask about multi-factor authentication, tested backups, patching, endpoint protection, logging, an incident response plan and staff training. Some ask for evidence of regular security testing. Gather proof you can show, such as scan and test reports with fixes verified.
Read the exclusions: acts of war, known prior issues, failure to maintain stated controls, and sub-limits for ransomware or funds transfer fraud. Check whether you must use the insurer's response firms and report within a set time. Treat cover as a final layer behind continuity and controls, never a replacement.
Questions people ask
Cyber insurance, answered
What does cyber insurance usually cover?
Common covers are incident response and forensic costs, restoring data and systems, business interruption, extortion payments where lawful, legal costs, and notification expenses.
Policies differ, so read the schedule and the exclusions.
Why do insurers ask for security controls?
Because controls change the likelihood and size of a claim. They look for measures such as multi-factor authentication, backups, patching and monitoring.
Missing basics can mean higher prices, lower limits or no cover.
Can a claim be denied?
Yes, for reasons such as an exclusion, late notice or inaccurate statements on the proposal. A claim that depends on controls you said you had but did not can be disputed.
Answer proposal forms accurately and keep evidence.
Does cyber insurance replace security testing?
No. Insurance pays for losses after the event. Testing reduces the chance of the event.
Insurers often view regular testing and fast fixing favourably. Insurers may ask to see both.
Is a small business likely to need it?
If you hold customer data, take payments or depend on one system to operate, a serious incident could be hard to afford. Many customers also ask.
Compare quotes and exclusions, not just price.
Sources
Where this comes from
Related
Terms that sit next to this one
Incident response plan
A written plan for who does what in the first hours after a security incident.
Backup integrity
Knowing your backups are complete, untouched and actually restorable.
Data breach
Information you hold ends up somewhere it should not be.
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
Breach notification
Telling regulators and affected people about a data breach within a set time.
Can you show the controls?
Insurers like evidence of testing. A Cyberlop report holds what it actually exploited, with the request, response and line of code, and fixes are proven by replay. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.