Part of the Shmor.ai network · Free, independent insurance guides for the UK, US & Europe

DomesticCommercial
DomCom Insure
Red padlock resting on a black computer keyboard

Commercial · Cyber

Cyber insurance

If your business takes payments, stores customer data or depends on its systems, a cyber incident can mean lost income, notification costs and claims from customers. Cyber insurance pays for expert help and the financial fallout.

Photo: FlyD on Unsplash

At a glance

Ref. COM-CYB
First-party cover
Incident response, IT forensics, data restoration, business interruption, extortion (where legal).
Third-party cover
Claims and regulatory investigations after a data breach, and media liability.
Who needs it
Any business that holds personal data, takes card payments or relies on IT to trade.
Conditions
Insurers often ask about multi-factor authentication, backups, patching and staff training.
Watch out for
War and state-backed attack exclusions, social engineering sub-limits.

Cyber cover at a glance

Usually covered

  • 24/7 incident response hotline and specialist support
  • Forensic investigation and system restoration
  • Notifying customers and regulators
  • Lost income during system downtime
  • Liability claims from people whose data was exposed
  • Legal costs of regulatory investigations

Usually not covered

  • Failing to meet stated security conditions
  • Upgrading systems beyond their previous state
  • Known vulnerabilities left unpatched (some policies)
  • Physical damage to hardware (often)
  • Losses from war or state-backed attacks, as defined

Common add-ons

  • Social engineering / invoice fraud
  • Hardware replacement (“bricking”)
  • Reputational harm
  • Contingent business interruption (supplier outages)

General guide only. Cover varies by insurer and policy: the policy wording and key facts document decide what you’re actually insured for.

Why small businesses are targets

Attackers often go after businesses with weaker defences, using phishing emails, stolen passwords and fake invoices. Even a small firm can face costs from downtime, specialist recovery work and dealing with affected customers. Cyber insurance doesn’t replace good security; it pays for help when something gets through.

Basics insurers look for

  • Multi-factor authentication on email and remote access.
  • Regular, tested backups kept separately from your main systems.
  • Prompt software updates and supported operating systems.
  • Staff awareness of phishing and payment-change scams.
  • Clear processes for verifying changes to supplier bank details.

In the UK, the NCSC’s Cyber Essentials scheme sets out a baseline, and some insurers recognise it. In the US, CISA publishes free guidance for small businesses. See cyber insurance basics.

Data protection duties

Under UK GDPR and the EU GDPR, organisations must report certain personal data breaches to the regulator within 72 hours of becoming aware of them, and tell affected people when there’s a high risk to them. US breach notification rules are set state by state. Cyber policies typically fund the legal advice and notification work.

Last updated: 15 October 2026

Frequently asked questions

Does cyber insurance pay ransoms?
Some policies cover extortion payments where legal, but many insurers and authorities discourage paying. Check the wording and the law where you operate, including sanctions rules.
Isn’t this covered by my business package?
Usually not in any meaningful way. Standard property and liability policies often exclude or barely cover cyber events.
Does cyber cover invoice fraud?
Only if the policy includes social engineering or cyber crime cover, often with a lower sub-limit.

Sources and official links

Keep exploring

Consultant presenting to a client across a table with a laptop

Professional indemnity

Cover for claims that your advice or work cost a client money.

Explore → Glowing teal LED panel suggesting digital security

Cyber basics

What small businesses should know before buying cyber insurance: insurer questions, security basics, invoice fraud and breach reporting duties.

Explore → Empty boardroom with a long wooden table and chairs

Directors & officers

Protects directors’ personal assets from claims about how they ran the company.

Explore → Two women running a small café, chatting at the counter

Business insurance

The covers small businesses combine, and which ones are legal requirements.

Explore →

From across the Shmor network

OnBusLaw

Identity theft: what to do if your details are stolen

What to do in the first 24 hours, credit freezes and fraud alerts, and where to report.

Read more →

What do you want to insure?