Cyber insurance: your safety net, not your security plan

What cyber insurance covers, when you’d actually use it, and why the businesses with the best security tend to get the best deal.

I have a question I ask almost every business owner we sit down with. If you had a cyber attack tomorrow, would your insurer actually pay out?

Some aren’t sure they have cover at all. Others assume their normal business insurance will sort it. A few have a proper cyber policy but have never read beyond the first page.

The government’s latest Cyber Security Breaches Survey, published in April, found that 43% of UK businesses had a breach or attack in the last year. For small businesses it was 46%, and for medium sized firms it jumped to 65%. If you employ somewhere between 15 and 150 people, the odds are closer to a coin toss than you might like.

So let’s talk about cyber insurance properly. What it is, when you’d use it, what to watch for in the small print, and why the best way to get good cover is to need it as little as possible.

What is cyber insurance?

In simple terms, it’s a policy that helps your business recover financially and practically when something goes wrong with your technology or your data. It usually covers two sides of the problem.

Your own costs. Getting your systems back up and running, recovering data, paying specialist investigators to work out what happened, covering lost income while you can’t trade, and notifying customers if their information has been exposed.

Other people’s claims against you. If a customer or supplier suffers because of a breach on your side, the policy can help with legal costs and compensation. Many policies also help with the cost of dealing with a regulator like the ICO, although whether fines themselves can be covered is limited and depends on the policy.

One part people often overlook is the incident response helpline. Most good policies give you a number to call at 2am on a Sunday that puts you straight through to people who deal with this every day. Think of it like breakdown cover. The payout is useful, but what you really want when you’re stuck on the hard shoulder is someone turning up quickly who knows what they’re doing.

It’s also worth knowing that standard business or office insurance policies increasingly exclude cyber incidents, or only cover them in a very limited way. If you’re relying on that, it’s worth checking with your broker.

When would you actually use it?

It helps to picture the kind of situations that lead to a claim. These are the ones we see most often with businesses like yours.

You come in on Monday and nothing opens. Ransomware has locked your files and there’s a message on screen demanding payment. Your team can’t work, orders can’t be processed, and every hour costs money. This is exactly what cyber insurance is designed for. It’s also the biggest driver of claims. According to the Association of British Insurers, malware and ransomware made up over half of all UK cyber claims in 2024, and insurers paid out £197 million in total, more than three times the year before.

A customer pays an invoice into the wrong bank account. Someone has quietly got into your accounts inbox, watched your emails for a few weeks, then sent a perfectly convincing message with “new bank details”. By the time anyone notices, the money is gone. This is one of the most common and painful scenarios for owner led businesses, and it’s also one that some policies only cover as an optional extra or with a lower limit. Check yours.

Personal data ends up where it shouldn’t. A laptop is stolen from a car, or a mailbox is accessed and client records are exposed. Now you’re dealing with legal advice, reporting to the ICO within 72 hours, contacting affected customers, and managing your reputation. Cyber insurance can pay for the expert help to handle all of that properly.

Not all policies are created equal

This is where it pays to slow down. Two policies with the same headline figure can behave very differently when you actually need them. Here are the things we’d encourage any owner to look at with their broker.

• The overall limit and the sub limits. A policy might say £500,000 of cover, but the part that pays for invoice fraud could be capped at a small fraction of that.
• The excess. How much you pay before the insurer contributes.
• Business interruption terms. Many policies have a waiting period, so the first few hours of downtime aren’t covered, and a limit on how long they’ll cover lost income for.
• Exclusions. Common ones include attacks linked to war or hostile states, problems you already knew about before the policy started, and the cost of upgrading your systems beyond what you had before.
• Conditions. This is the big one. Most insurers now expect certain security measures to be in place, and your policy may depend on them.

Those conditions usually start with the questions on your proposal form. Do you use two step verification (often called MFA) on email and remote access? Are your backups kept separately and tested? Do you install security updates promptly? Do you train your staff?

Here’s the catch. If you tick “yes” and it turns out one mailbox didn’t have MFA switched on, and that’s how the attacker got in, your claim could be reduced or refused. It’s a bit like home insurance that requires approved locks on your doors. If the burglar walks in through the back door you’d left unlocked, expect a difficult conversation.

That’s why we always suggest getting your IT provider involved when you complete or renew a proposal form. Not to make the answers look better, but to make sure they’re true.

Prevention is better than the cure

Insurance is there for the day things go wrong. It won’t give you back the days your team spent unable to work, the stress of a week spent firefighting, or the trust of a customer who received a fraudulent invoice with your name on it. The best outcome is always the incident that never happens.

The good news is that the steps that keep you safe are the same steps insurers want to see, and they often have a direct effect on your premium. Insurers price risk, just like car insurers do. A careful driver with a clean record and a dashcam pays less than someone with three points and no idea where their car keys are.

For most businesses of your size, the basics that make the biggest difference are:

• Two step verification on email, remote access and anything holding money or client data.
• Regular security updates on laptops, phones and servers, ideally managed for you rather than left to each person.
• Backups kept separately and tested, so you can recover without paying anyone a ransom.
• Monitored protection on every device, so suspicious activity gets spotted and stopped early.
• Staff awareness training. Phishing emails are still the most common way in, yet the latest survey found only 19% of businesses ran any training or awareness activity.
• A simple incident response plan, so everyone knows who to call and what to do. Only a quarter of businesses have one.

If you want a recognised benchmark, look at Cyber Essentials, the government backed certification. The National Cyber Security Centre reports that certified organisations are 92% less likely to make a cyber insurance claim. And if your turnover is under £20 million, certifying your whole organisation comes with £25,000 of free cyber liability insurance. That won’t replace a proper policy for most businesses, but it’s a very useful starting point and a strong signal to insurers.

Think of it this way. Good security is the seatbelt, the brakes and the MOT. Cyber insurance is the policy in the glovebox. You wouldn’t want to drive without either, but only one of them stops the accident happening in the first place.

Where CREAVO fits in

We’re not an insurance broker, and we won’t pretend to be. What we do is make sure the security side of the equation is solid, so that when your broker asks the questions, you can answer them honestly and confidently.

That means putting the right protections in place, keeping evidence that they’re working, and helping you understand what your proposal form is really asking. We’re very happy to sit alongside your broker so everyone’s working from the same picture.

If your renewal is coming up, or you’re not sure whether you’d be covered at all, let’s have a chat before you sign anything. No jargon, no hard sell, just a clear view of where you stand.

Call us on 0330 002 2466 or get in touch at creavo.co.uk.

‍