One ransomware attack can stop your business for days and cost far more than you expect. Staff cannot work, customers cannot reach you, and the bills start arriving before you know how the attacker got in. That is why you need cyber insurance: it gives you money and expert help when you are least able to find either.
In short, a good policy pays for the costs of recovering from an attack. That typically means ransomware response, data breach notification, forensic investigation, lost income during downtime, and legal and regulatory costs, including those linked to UK GDPR and the ICO. Many policies also cover third-party claims from customers whose data was exposed. Cover varies, so the wording matters.
Below, we explain what cyber insurance covers, what it usually excludes, and where small and medium-sized UK firms most often get caught out. At TrustedIA, we respond to incidents through our CyberSOS service, so we see how insurers expect you to be prepared and what claims look like in practice.
Why UK businesses need cyber insurance
The threat is routine, not rare
The government’s Cyber Security Breaches Survey finds that around four in ten UK businesses report a breach or attack each year. Attackers rarely choose targets by size. They go after whoever is easiest to reach, and a small firm with basic defences often fits that description.
Ransomware shows the problem well. Criminals encrypt your files, then demand payment for the key. Even if you refuse to pay, you still face days of rebuilding systems and explaining the outage to customers. That is why you need cyber insurance even if you think nobody would bother with your business.
The costs arrive all at once
Within days of an incident, you can face several bills at the same time. Most small firms do not hold that much spare cash, and the ransom is rarely the biggest cost:
- Forensic investigators and IT specialists to find the cause and restore systems
- Lost income while you cannot trade
- Legal advice, plus ICO notification within 72 hours where personal data is at risk
- Customer notification, credit monitoring and public relations support
A cyber attack is a cash-flow problem as much as a technical one, and insurance is how you fund the fix.
Contracts and regulators expect you to be prepared
Larger customers now ask about cyber insurance in tenders and supplier questionnaires. Some make it a condition of the contract, alongside certifications such as Cyber Essentials or ISO 27001. Without a policy, you can lose work before an attack ever happens.
Regulators add pressure. Under UK GDPR, you are responsible for protecting personal data, and the ICO can fine up to £17.5 million or 4% of turnover. A policy cannot make you compliant, but good cover brings in breach lawyers and response experts from the first call.
What cyber insurance covers and what it excludes
What a typical policy pays for
Most policies split cover into two parts. First-party cover pays for your own losses, while third-party cover pays when customers or suppliers claim against you.
| Cover | What it pays for |
|---|---|
| Ransomware and extortion | Negotiators, system restoration, sometimes the ransom |
| Data breach | Forensics, notification, credit monitoring, PR |
| Business interruption | Lost income and extra costs while you cannot trade |
| Legal and regulatory | Defence costs, ICO response, third-party claims |
What is usually excluded
Once you see why you need cyber insurance, read the exclusions before you sign. This is where claims fail more often than anywhere else.
- Security controls you promised but did not maintain, such as multi-factor authentication or patching
- Upgrades beyond restoring what you had before
- War or state-backed attacks, which Lloyd’s market policies now exclude
- Incidents you knew about before the policy started
- Fines that the law does not allow insurers to pay
Insurers treat the application form as a promise about your security. If you declare multi-factor authentication and an attacker gets in through an account without it, the insurer can refuse the claim.
A policy only pays out if you can prove the security you declared.
How to decide what cover your business needs
Put a number on a week offline
Knowing why you need cyber insurance is only half the job. Sizing the policy is the other half. Take your daily revenue, add the wages and fixed costs you still pay, then multiply by the days you could be down. Most firms underestimate recovery time, so use five to ten working days, not one.
Next, count your data. Customer, employee and payment records drive notification and legal costs, so more personal records usually means a higher limit to protect you.
Size your cover from your own downtime sums, not from the cheapest quote.
Match the cover to your risks
Your answers point to the parts of the policy that matter most to you.
| Your situation | Prioritise |
|---|---|
| You hold personal or card data | Data breach and regulatory cover |
| You cannot trade without your systems | Business interruption with a short waiting period |
| You supply other businesses | Third-party liability |
| You depend on one IT or cloud supplier | Cover for a supplier outage |
Check the limit of indemnity against your worst realistic scenario, and compare waiting periods. A 12-hour wait before business interruption cover starts costs you far less than a 48-hour wait.
Finally, run a vulnerability assessment before you apply. It shows which security controls you can honestly declare, and it stops you promising what you cannot prove at claim time.
How to get a policy and keep your premium down
Start with a broker and an honest application
Most small firms buy through a specialist cyber broker, who compares several insurers and reads the wording for you. Whichever route you choose, answer the proposal form truthfully. It becomes the basis of any claim, and one wrong answer can void your cover.
Gather your evidence before you ask for quotes: your systems list, the number of personal records you hold, your backup arrangements and your key suppliers. Your broker can then quote quickly and accurately.
Controls that lower your premium
Insurers price on the controls you can prove, and what underwriters expect is the same few things every time:
- Multi-factor authentication on email, remote access and admin accounts
- Offline or immutable backups, with restore tests
- Endpoint detection and response on every device
- Prompt patching of internet-facing systems
- Staff phishing training and simulations
- A written incident response plan
The controls that lower your premium are the same ones that make your claim safe to pay.
Fixing gaps before you apply wins better terms and a wider choice of insurers. A vulnerability assessment or penetration test shows you what to fix first. You can also agree a higher excess to cut the price, but only if you could pay it tomorrow.
What to do when a cyber incident hits
Act in the first hour
Speed matters more than perfection. Call your insurer’s incident hotline before you pay anyone or wipe anything, because many policies only cover responders from an approved panel. Then work through these incident response steps:
- Isolate affected devices from the network, but leave them powered on so evidence survives.
- Tell your insurer or broker and follow their instructions.
- Preserve ransom notes, logs and suspicious emails.
- Disable compromised accounts and reset passwords.
- Note when you discovered the incident, because the ICO’s 72-hour reporting clock starts then.
Phone your insurer before you fix anything, because the wrong first move can cost you your cover.
Let the response team lead
Once you call, the insurer appoints forensic investigators, breach lawyers and negotiators. This is why you need cyber insurance in practice: experienced people coordinate the response while you keep the business running. Do not contact the attackers yourself, and never pay a ransom without legal advice, as sanctions rules may apply.
Keep every invoice and a timeline of downtime. Your lost income claim depends on that evidence. Afterwards, a post-incident review shows which controls failed, so you can fix them before your policy renews.
Making the decision for your business
Cyber insurance does not replace good security, but it is the safety net that pays for recovery when prevention fails. Attacks are routine, the bills arrive together, and customers and regulators expect you to be ready. That is why you need cyber insurance: it funds the response and puts experts beside you while you keep trading.
Size your cover from your own downtime figures, read the exclusions before you sign, and declare only the controls you can prove. Those same controls lower your premium and keep your claim payable.
Before you apply, it helps to know where your defences stand. Speak to TrustedIA’s cyber security team about a vulnerability assessment, and you will approach insurers with evidence, not guesses, and have a partner on call if an incident hits.
