If you run a small to medium-sized enterprise (SME), you’re probably wondering what you need to know about buying cyber insurance.
Costs and cover can vary but protecting your business from cyber-attacks is vital. Here’s everything you need to know.
How much will it cost?
The cost of cyber insurance for SMEs can vary drastically.
Turnover, sector, the types of data handled and your IT security will impact how much you pay.
For very small or low‑risk businesses, premiums can be as low as £250 a year, maybe less. Beware of anything less than £200 a year though – that’s likely to be too good to be true and might not offer the comprehensive cover you need.
For small businesses with a revenue between £100,000 and £5 million, premiums can range from £250 to £5,000. For larger businesses with higher revenue, or those in high-risk sectors like healthcare or finance, annual premiums can exceed £10,000.
How is my premium calculated?
Insurers will look at a range of factors to determine how much you’ll pay:
- Turnover and size – bigger businesses often have more exposure.
- Data exposure and sensitivity – the more sensitive data you process, the more you’ll pay.
- Sector and risk profile – sectors like finance and health, or companies that store payment details come with greater risk.
- Existing cyber security controls – if you have MFA, backups, incident response plans and certifications like Cyber Essentials, your risk is reduced.
- Coverage limits and policy scope – more extensive cover, such as larger indemnity limits, more first‑party and third‑party cover, means higher premiums.
- Claim and loss history – if you’ve had past incidents or claims, it can raise premiums.
- Exclusions, excesses and policy terms – higher excess, meaning you accept more risk, may lower your premium. Narrow cover may cost less but leaves you more exposed.
Can I just go for the cheapest policy?
No, don’t assume the cheapest policy is fine.
You need cover that matches your risk. Business interruption, reputational costs and regulatory fines might not be covered by the cheapest policy, but they matter.
Can I do anything to bring my premium down?
Yes. Improving your cyber security by enhancing controls, policies and training may reduce your premium or make you more insurable.
Focus on low-cost, quick wins, like implementing multi-factor authentication on your websites and email accounts.
What is ‘cyber liability insurance’?
Beware of products labelled ‘cyber liability insurance’ because they often don’t provide the support you need during a cyber-attack.
These policies only cover legal action made against you by third parties, such as clients, in relation to a cyber-attack.
Claims from clients come weeks or even months after a cyber-attack. As well as protection from those claims, what you need is real-time, hands-on support as it happens. That’s what you’ll get with a comprehensive cyber policy.
Be prepared
The best thing you can do to protect your SME is be prepared.
That means making sure you ask the right questions when you’re getting quotes: what is and isn’t covered; what’s the limit of indemnity; how much is the excess; and are first‑party and third‐party claims covered?
It also means thinking about what you’ll do when the worst happens and making sure you’re ready.
If you don’t know who to call when your car breaks down, your roadside assistance isn’t much help and it’s the same with your cyber insurance. Make sure you store your insurer’s emergency contact details and policy number offline, so you can still access them when the worst happens.
