A cyber attack rarely arrives with a helpful warning. It may start with a convincing invoice, a reused password or an employee clicking a link while trying to get through a busy morning. Cyber insurance can help a business recover from the financial and practical fallout, but it only works as intended when the policy matches your risks and your IT security meets the insurer’s requirements.

For small businesses, the question is not whether insurance replaces good cyber security. It does not. The sensible approach is to treat it as one part of a wider plan: reduce the chance of an incident, limit the damage if one occurs, and make sure you can get back to work quickly.

What cyber insurance is designed to do

Cyber insurance is cover for losses and costs arising from certain cyber incidents. Depending on the policy, this can include ransomware, fraud, data breaches, accidental loss of personal information and disruption caused by an attack on your systems.

The value is not limited to a cheque after the event. A serious incident can require urgent specialist support: technical investigation, legal advice, customer notification, data recovery and public relations help. For a business without a large internal IT department, having access to those services can make a difficult situation far more manageable.

That said, policies vary considerably. Some focus mainly on first-party losses to your own business, while others include third-party liability where customers, suppliers or employees suffer a loss because their information was exposed. Reading the headline figure alone is not enough.

What cyber insurance may cover

The detail depends on the insurer and policy wording, but cover commonly falls into four areas:

• Incident response and recovery: forensic investigation, specialist IT support, restoring data and systems, and reasonable costs of getting operations running again.
• Business interruption: loss of income and additional costs incurred while a covered cyber event prevents normal trading.
• Data breach costs: legal support, regulatory advice, notifying affected people, call handling and credit monitoring where appropriate.
• Cyber crime and extortion: some policies cover ransomware response, social engineering fraud or funds transferred after a targeted deception. These sections often have strict conditions and exclusions.

A garage unable to access booking records, diagnostic platforms or customer communications can lose revenue quickly. A charity that holds supporter details may face difficult notification and regulatory obligations after a breach. The exact risk looks different, but the underlying issue is the same: technology downtime has a real operational cost.

Cover is not the same as a guarantee

Insurers will investigate whether an event is covered and whether the business met the conditions of the policy. If a claim relates to a compromised account that had no multi-factor authentication, for example, an insurer may challenge the claim if multi-factor authentication was a stated requirement.

There may also be exclusions for known vulnerabilities, unpatched systems, poor password controls, contractual penalties, reputational harm or incidents caused by a supplier. This does not make cyber insurance poor value. It means the policy needs to be understood before a crisis, not while your team is locked out of its systems.

Why insurers now ask tougher security questions

Cyber insurance used to be seen by some organisations as a relatively simple add-on. That has changed as ransomware, email fraud and supply-chain attacks have become more frequent and expensive. Insurers increasingly expect businesses to show basic controls are in place before offering cover or paying a claim.

Questions commonly cover multi-factor authentication, backups, patching, antivirus or endpoint protection, staff awareness training, administrator access and incident response plans. Some insurers will ask whether backups are protected from alteration or deletion, whether remote access is secured, and how quickly critical updates are applied.

These are not arbitrary hoops. They address the weaknesses attackers use most often. A strong password is helpful, but it is far more effective when backed up by multi-factor authentication. A backup is valuable, but much less so if ransomware can encrypt it at the same time as the live system.

For business owners, this can feel like another compliance task. In practice, these controls also reduce everyday disruption. Good patching, monitored backups and properly managed user access make your technology more dependable as well as more insurable.

How to assess cyber insurance for your business

Start with your dependency on technology, rather than the policy brochure. Ask what would happen if staff could not access email, files, finance software, cloud services, phones or key industry systems for two days, a week or longer. Consider how much customer and employee information you hold, where it is stored, and which suppliers can access it.

Then look at the financial impact. The right level of cover is not simply your annual turnover. It should reflect likely lost income, recovery costs, professional fees and the potential cost of informing affected people. A business that can operate manually for a short period may need a different policy from one where every booking, payment and customer interaction relies on online systems.

When comparing policies, check the excess, waiting period for business interruption claims, sub-limits for ransomware or fraud, and whether the policy covers both cloud services and on-site equipment. Also establish who you must contact first after an incident. Many insurers require you to use their appointed response providers, particularly for legal and forensic work.

Questions worth asking before you buy

Ask the insurer or broker to explain, in plain English, what happens during the first 24 hours of a claim. Find out whether business email compromise and invoice fraud are covered, as these losses are not always treated in the same way as a technical breach.

You should also ask which security controls are mandatory, whether those requirements apply across every user and device, and what evidence you may need to provide. A policy that appears cheaper can become expensive if its conditions are unrealistic for the way your business currently operates.

Cyber insurance and cyber security work together

The most useful way to think about cyber insurance is as a financial safety net, not a security tool. It cannot stop phishing emails, patch vulnerable software, monitor suspicious activity or restore confidence after repeated downtime. Those jobs belong to your people, processes and technology controls.

A practical security baseline usually includes managed updates, multi-factor authentication, secure backups tested through restoration, endpoint protection, staff training and clear procedures for reporting suspicious messages. It should also include a record of what systems and accounts you have. You cannot protect what nobody has responsibility for.

This is where a managed IT partner can be useful. My Tech Team helps Sussex businesses put the day-to-day controls in place, keep an eye on systems and translate technical requirements into actions that make sense for the business. That can make insurance applications less daunting and, more importantly, reduce the likelihood that you will need to use the policy.

What to do when an incident happens

Speed matters, but so does avoiding rushed decisions. If you suspect a cyber incident, isolate affected devices where possible and report it immediately through your insurer’s claims process if you have cover. Do not wipe systems, pay a ransom or contact affected customers before taking advice, unless there is an immediate safety or legal reason to do so.

Keep a simple record of what was noticed, when it happened and which systems or accounts may be involved. Your IT team or incident response provider will need that information. Staff should know who to contact outside normal working hours, because delaying action until the next business day can turn a contained problem into a widespread outage.

It is also worth testing this process before anything goes wrong. A short tabletop exercise can reveal whether key contacts are out of date, whether your backups are genuinely recoverable, and whether the business can continue if email or cloud files are unavailable.

Cyber insurance is most valuable when it sits behind well-managed technology, tested backups and a team that knows what to do under pressure. Review your cover before renewal, check that your security controls match the policy, and make recovery part of normal business planning rather than something left for a bad day.