Cyber Insurance

Small businesses do not usually get attacked by anyone targeting them specifically. The two things that actually happen are duller and more effective.

The first is business email compromise. Someone gets into an email account, watches quietly for an invoice or a payment conversation, then steps in at the right moment with changed bank details. The money is transferred willingly to the wrong account. Check the sub-limit for this specifically, because it is often lower than the headline policy limit and for most small firms it is the likeliest loss on the policy.

The second is ransomware arriving through a phishing email or an unpatched remote access point rather than anything sophisticated. Systems encrypted, trading stopped, and a decision to make under pressure. Neither requires you to be interesting, and both are largely prevented by the same handful of controls.

The part of a cyber policy people actually use is not the indemnity. It is the response.

When something happens you get access to a breach team: IT forensics to work out what was accessed and close it, legal advice on what has to be reported and to whom, negotiators if there is an extortion demand, and PR help if it becomes public. Most policies run a 24-hour notification line, and using it early is usually a condition of cover as well as good sense.

For a business without an in-house security team, which is most businesses, that is worth more than the limit of indemnity. The difference between an incident handled properly in the first six hours and one improvised over a weekend is usually the difference between an inconvenience and a serious loss.

Cyber underwriting has tightened considerably, and some controls are now effectively conditions rather than discounts. Expect to be asked about multi-factor authentication on email, remote access and administrator accounts, backups that are tested and held offline or immutably, how quickly security patches are applied, and whether staff have had any phishing training.

Answer honestly. A policy obtained by overstating your controls is a policy that may not respond, and multi-factor authentication in particular is now a condition on many wordings rather than a question.

The good news is that these are the same measures that prevent most incidents in the first place, so the work is not wasted either way.

A personal data breach usually has to be reported to the Information Commissioner's Office within 72 hours, and affected individuals told where the risk to them is high. That is a legal duty regardless of insurance, and the clock is short enough that working out the answer during the incident is not realistic.

Cyber cover typically pays the cost of managing that: legal advice on whether and what to notify, the notification itself, credit monitoring where appropriate, and representation during an ICO investigation.

Regulatory fines themselves are generally not insurable where the law does not permit it, but the costs of dealing with the regulator usually are, and on a small breach those costs are most of the bill.