FAQ category: Cyber Insurance

Yes. If you use IT, store data or have any reliance on IT or technology, you need cyber insurance to protect your business.

Cyber insurance helps your business get back on track in the event of a cyber-attack.

Most importantly, you need a policy that provides incident response services, such as hands-on help and support from your cyber insurers.

A specialist package should also include:

• IT forensics – Costs associated with IT forensics and investigations.
• Data breach – Costs associated with a data breach, including legal costs and costs covering communications with affected data subjects.
• Regulatory and legal – Legal advice for notifying appropriate legal authorities like the Information Commissioner’s Office or national crime agency.
• Restoration – Costs associated with the re-build or restoration of your computer systems.
• Extortion – Costs associated with communicating and negotiating with cyber criminals who may be attempting to extort your business.
• Business interruption – Covers your lost revenue.
• Crime – Costs covering traditional ‘cash’ losses, for example if you have been subject to funds transfer fraud or push payment fraud. This is often a policy extension.

Mostly, cyber insurance claims relate to human error, for instance an employee or director making a mistake, clicking on a harmful link or downloading a harmful file.

The most common claims are:

• Ransomware or malware – A hacker gains access to your systems and sensitive data which they might encrypt before demanding a ransom to decrypt it.
• Phishing – A fraudulent email deceives an employee or director into providing sensitive business information or perhaps even passwords. Often these types of emails will attempt to deceive a business into making a payment to the criminal’s bank account. Accounts departments are particularly vulnerable to this type of crime and this is known as funds transfers fraud or push payment fraud (PPF).
• Business email compromise – A cybercriminal gains access to your business email account which they can potentially use to monitor your business communications and payments. They intervene and send emails on your behalf without your knowledge in an attempt to get your business or third parties to pay funds to their criminal account. They can continue undetected for months without your knowledge. Sometimes they will change passwords, blocking your access to your own email account.
• Traditional data breaches and associated legal costs – A cyber event which results in the loss of confidential data.

Despite competition amongst insurers, which has led to very broad products, certain types of cover often remain excluded:

• Fines and penalties – Most policies say they cover fines and penalties, but only “where insurable”. If local legislation states such fines are not insurable then the cyber insurance may assist with the legal representation related to the fine but will not cover the value of the fine itself.
• Cyber war – Many insurers will exclude claims related to attacks on governments or states, known as cyber warfare. Insurers should only rely on such as an exclusion if it is evident the cyber-attack affecting your business is an attack on the state more holistically and intended to bring down the entire UK infrastructure.
• Retro-date – Some insurers will apply a retro-active date, which means complaints or claims related to work prior to that date are excluded.
• Non-cyber event damage to system – Damage or business outages which are not related to a cyber event, for instance if a software update causes you to be unable to access your own system, resulting in business downtime.
• Time excess – Most policies will have a time excess, usually around eight to 12 hours. Whilst insurers will want to be immediately involved in incident response to mitigate losses, they usually exclude these first hours of lost trading.

We can provide cyber insurance for any business, large or small.

There’s no simple answer because a judgement will be dependent on a number of factors, such as the size of your business, its business activities, the level of IT security and sensitivity of the data you hold.

Our cyber insurance partners can provide sample loss scenario reports, offering guidance on the value of different types of cyber claims for a business of your size and industry. These are a good starting point for negotiations around how much cover you need.

Some cyber insurance is better than none, so if budgets are tight at least consider entry level cover.

All our quotes are personalised, and the premium is typically linked to the size of the business, your IT security and your precise business activities. We find that in most cases, our policies are incredibly competitive.