Guide
What a cyber policy actually pays for
Updated
Cyber cover is sold as one product and pays in about three directions, and for a small business the most valuable part is often not the money at all. Understanding the split makes the sub-limits legible, which is where most disappointment in this class comes from.
First party: your own costs
Investigation, restoring systems and data, business interruption while you are down, and in some policies extortion payments and the specialist negotiation around them.
For most small businesses this is the part that gets used. A ransomware event is mostly a cost-of-recovery event, and the interruption element is frequently larger than the technical cost.
Third party: what you owe others
Liability to people whose data was exposed, defence costs, and the costs of dealing with a regulator. This is where holding large volumes of personal data changes the shape of the policy you need.
Note that a regulatory investigation can proceed on its own timetable irrespective of the insurance position, and that reporting duties to the ICO exist independently of whether you claim.
The incident response service
Most policies include access to a breach response team: forensics, legal, communications, sometimes a 24 hour line. For a business with no in-house security function this is often worth more than the indemnity, because the first eight hours of an incident determine most of what it eventually costs.
It is also what no premium comparison measures. Ask what the service actually includes, who provides it, and whether calling it counts as notifying a claim.
Where the sub-limits are
Funds transfer fraud, social engineering and sometimes extortion carry limits well below the headline. A policy described as £1m of cover can carry a much smaller inner limit on exactly the loss a small business is most likely to suffer.
Read the schedule for inner limits rather than the summary for the headline, and compare quotes on the inner limits that match your actual exposure.