Cyber Insurance for Businesses: Cover Against Data Breaches and Attacks

Cyber insurance is a type of business insurance that helps you manage the financial impact of a cyber incident, such as a data breach, ransomware attack, phishing scam, or system failure. It covers the costs that arise when your digital systems or data are compromised, whether that is through a deliberate attack or an accidental exposure.

Cyber insurance typically provides two types of cover:

First-party cover

This covers your own costs as a business. It includes things like the cost of investigating the breach, notifying affected customers, restoring data and systems, business interruption losses while your systems are down, and crisis management expenses such as hiring PR consultants to manage reputational damage.

Third-party cover

This covers claims made against you by other people or organisations. If customer data is exposed and those customers sue you, or if a regulatory body such as the ICO investigates your handling of personal data, third-party cover pays for your legal defence and any compensation or fines.

Unlike professional indemnity insurance, which covers claims arising from your professional advice, cyber insurance specifically targets digital and data-related risks. Some PI policies include limited cyber cover, but a standalone cyber policy provides much broader protection.

If your business uses computers, email, online payment systems, stores customer data, or relies on any kind of digital infrastructure, you are at risk of a cyber incident. The question is not whether your business could be targeted, but what the financial impact would be if it were.

Signs your business needs cyber insurance

• You store personal data - Customer names, email addresses, payment details, health records, or any other personal information. Under GDPR, a breach involving personal data can trigger mandatory notification requirements and potential fines.
• You take payments online or by card - Any business processing card payments is a target for cybercriminals. A breach of payment card data can result in significant costs and loss of customer trust.
• You rely on IT systems to operate - If a ransomware attack locked you out of your systems tomorrow, how long could you survive without them? Cyber insurance covers the business interruption costs during recovery.
• You send and receive sensitive information by email - Email is the most common vector for phishing attacks and business email compromise. A single fraudulent email can result in significant financial losses.
• You are a small business - Small businesses are disproportionately targeted because attackers know they often lack dedicated IT security. The UK government's Cyber Security Breaches Survey consistently shows that a significant proportion of small businesses experience cyber attacks each year.

Even self-employed professionals and sole traders who work from a laptop and a phone have exposure to cyber risk. If your email is compromised and a fraudster uses it to redirect a client's payment, you could face a claim and the cost of investigating and resolving the incident.

Cyber insurance policies vary between providers, but most will include a core set of first-party and third-party covers. Understanding what is included, and what is not, helps you choose the right policy for your business.

First-party costs (your own losses)

• Incident response costs - The cost of hiring forensic IT specialists to investigate the breach, identify how it happened, and close the vulnerability. This is often the largest first-party cost.
• Data restoration - The cost of recovering or rebuilding lost or corrupted data from backups, or recreating it where backups are not available.
• Business interruption - Lost income and additional operating expenses while your systems are down. This can include the cost of temporary workarounds, such as manual processes or temporary equipment hire.
• Notification costs - Under GDPR, you may be required to notify affected individuals and the Information Commissioner's Office (ICO) within 72 hours. Cyber insurance covers the cost of managing this notification process at scale.
• Crisis management and PR - Professional communications support to manage the reputational impact of a breach. This might include hiring a PR firm, setting up a customer helpline, and preparing public statements.
• Cyber extortion - The costs associated with a ransomware demand, including negotiation with the attacker (through specialist firms), and in some cases, the ransom payment itself, though this varies by policy.

Third-party costs (claims from others)

• Regulatory defence and fines - Legal costs of defending an investigation by the ICO or another regulatory body, and in some cases, the fines or penalties imposed.
• Compensation claims - If customers, clients, or business partners suffer a loss because of your breach, they may sue you for compensation. Cyber insurance covers the legal defence and any settlement or award.
• Media liability - Claims arising from defamatory content posted by a hacker on your website or social media channels.

Common exclusions

• Losses arising from a known vulnerability that you failed to patch
• Bodily injury or physical property damage (covered by public liability insurance)
• Losses caused by an act of war or state-sponsored attack (often excluded under a "war exclusion" clause)
• Infrastructure failures affecting your internet service provider or cloud provider (unless specifically covered)
• Fraudulent transfer of funds by an employee (may be covered under a crime or fidelity policy instead)

Cyber insurance premiums depend on the size of your business, the volume and sensitivity of the data you handle, your industry, and the strength of your existing cyber security measures. For small businesses, premiums can start from as little as £100 to £200 per year, while larger firms with more complex risk profiles will pay considerably more.

Compared to other types of business insurance, cyber cover is still relatively new and the market is evolving rapidly. Premiums have risen in recent years as the frequency and severity of cyber attacks has increased, but competition between insurers is also growing, which helps keep pricing in check. The best way to find competitive cover is to compare quotes from multiple providers.

The cost of a policy is typically a fraction of the cost of a single uninsured breach. The average cost of a cyber breach for a UK small business is estimated at several thousand pounds, and for larger businesses the figure can run into hundreds of thousands. The table below gives an indication of typical annual premiums based on business size and a standard cover level.

Several factors will influence where your premium falls within these ranges:

• Industry sector - Healthcare, financial services, and legal businesses tend to pay more because they handle highly sensitive personal data. Retail and hospitality businesses pay less on average but face significant risks around payment card data.
• Volume of records held - A business with a database of 100,000 customer records will pay more than one with 1,000, because the cost of a breach response scales with the number of affected individuals.
• Revenue and turnover - Higher turnover generally means a higher premium, as the insurer assumes a larger business has more to lose.
• Existing security controls - Businesses that can demonstrate strong cyber security practices, such as multi-factor authentication, regular patching, encrypted backups, and staff training, will typically qualify for lower premiums.
• Claims history - Previous cyber incidents or claims will increase your premium. A clean record works in your favour.

Comparing quotes through Money Saving Advisors helps you find competitive pricing while making sure the policy actually covers the risks that matter to your business.

Not all cyber insurance policies are created equal. When comparing quotes, look beyond the headline price and examine what each policy actually covers. The features that matter most will depend on your business, but there are several key areas that every buyer should check before committing to a policy. A thorough comparison at the quote stage can save you from discovering gaps in your cover when you need it most.

Cyber insurance is more complex than many other types of business insurance because the risks are technical and constantly evolving. A policy that looks comprehensive at first glance may contain sub-limits, exclusions, or conditions that significantly reduce the effective cover. For example, some policies exclude ransomware payments entirely, while others cap business interruption cover at a fraction of the overall limit. These details are often buried in the policy wording rather than highlighted on the summary page.

The table below lists the most important features to compare when evaluating cyber insurance quotes. Use it as a checklist when reviewing policy documents or speaking with brokers to make sure you are comparing like with like.

When you receive quotes, ask each insurer or broker to provide a summary of these features so you can compare them side by side. A cheaper policy that excludes business interruption or ransomware cover may not provide the protection you actually need. The goal is to find a policy that matches your specific risk profile at a competitive price, rather than simply choosing the cheapest option available.

It is also worth asking whether the insurer offers any added-value services, such as free cyber security training for your staff, vulnerability scanning, or access to an online security portal. These extras can help you strengthen your defences and may reduce the likelihood of needing to make a claim in the first place. Some insurers also offer pre-breach planning services that help you prepare a response plan before an incident occurs.

If your business handles particularly sensitive data, such as health records, financial information, or children's data, make sure the policy does not exclude or limit cover for breaches involving these categories. Some policies apply higher excesses or lower sub-limits for high-sensitivity data. Similarly, if you process payment card information, check that the policy covers Payment Card Industry (PCI) fines and assessment costs, as these can be substantial.

Understanding how a cyber insurance claim plays out in a real scenario helps illustrate the value of the cover. Here is a worked example based on a common type of incident.

Scenario: ransomware attack on a small accountancy firm

A 12-person accountancy firm receives a phishing email that appears to come from a client. An employee clicks the link, and ransomware encrypts the firm's server within hours. The attackers demand £40,000 in cryptocurrency to provide the decryption key. The firm cannot access client records, tax returns in progress, or their email system.

How the claim unfolds

• Day 1: Incident reported - The firm calls their cyber insurer's 24/7 breach response line. The insurer immediately assigns a forensic IT team, a legal adviser, and a crisis communications specialist.
• Days 2-3: Investigation - The forensic team identifies the attack vector (the phishing email), confirms the extent of the encryption, and checks whether any data was exfiltrated before the encryption. They also assess whether backups are viable for restoring the data.
• Days 3-5: Negotiation and recovery - The insurer's specialist negotiation firm communicates with the attackers. In parallel, the IT team begins restoring data from backups. The firm is able to recover most of their data without paying the ransom.
• Days 5-14: Remediation and notification - The IT team rebuilds the server with improved security controls. The legal adviser helps the firm determine whether they need to notify the ICO and affected clients under GDPR. Notification letters are prepared and sent.
• Ongoing: Business interruption claim - The firm was unable to operate normally for 10 working days. The insurer reimburses lost fee income and the cost of temporary manual processes.

Total claim cost

Forensic investigation: £15,000. System restoration: £8,000. Legal and GDPR advice: £6,000. Business interruption: £22,000. Client notification: £3,000. Total: £54,000, covered in full under the policy minus the £500 excess.

Insurers reward businesses that take cyber security seriously. By strengthening your defences before you apply for cover, you can often secure a lower premium and improve your overall risk profile at the same time. Here are the most effective steps you can take.

• Get Cyber Essentials certified - Cyber Essentials is a UK government-backed certification that demonstrates your business meets a baseline standard of cyber security. Many insurers offer discounts to businesses that hold Cyber Essentials or Cyber Essentials Plus certification.
• Implement multi-factor authentication (MFA) - MFA is one of the single most effective controls you can put in place. Requiring a second factor, such as a code from an authentication app, for email, remote access, and admin systems significantly reduces the risk of account compromise.
• Regular staff training - Human error is the cause of most cyber incidents. Running regular phishing simulations and cyber awareness training helps your team recognise and avoid common threats. Insurers view staff training favourably when assessing your risk.
• Patch and update systems promptly - Keeping your operating systems, software, and firmware up to date closes known vulnerabilities that attackers exploit. Some policies specifically exclude losses arising from unpatched systems.
• Maintain encrypted backups - Regularly back up your data, keep at least one copy offline or in a separate cloud environment, and test your restore process. Good backups are your last line of defence against ransomware and can dramatically reduce the cost and duration of a claim.
• Use endpoint protection - Modern endpoint detection and response (EDR) software provides better protection than traditional antivirus. Insurers are increasingly asking about the specific tools you use.

Taking these steps before seeking quotes through Money Saving Advisors will help you demonstrate a strong security posture and access the best available pricing from contractors and specialist cyber insurers alike.