Guide
What drives a small business cyber premium
Updated
Most business insurance is priced on size and sector. Cyber is priced substantially on what you do, which is unusual and useful: it means the buyer can change the price before applying, rather than only shopping it afterwards.
The two answers that matter most
Multi-factor authentication on email and remote access, and backups you have actually restored from. These two come up in almost every proposal form because they map onto the two losses that dominate small business cyber claims: account compromise leading to fraud, and ransomware.
Both are things a small business can usually fix in a week, and both are usually free or close to it. Doing them before you apply is the single most effective thing you can do about the premium.
Why a backup you have not tested does not count
Underwriters distinguish between having backups and being able to restore from them, because the claims experience is full of businesses that had backups which turned out to be incomplete, encrypted along with everything else, or unrecoverable in any useful timeframe.
Run a real restore of something that matters, write down the date, and say so on the form. It converts an assertion into evidence.
The question about paying invoices
Somebody emails, apparently from a supplier, with new bank details. If your business can act on that without a separate check, you carry a live exposure that has nothing to do with hacking at all.
Insurers know this and it is why funds transfer fraud is so often sub-limited far below the headline policy limit. A call-back to a number you already held, written into your process, changes both the risk and the answer you give.
What you cannot change before applying
Sector, data volume and claims history. Holding health records or handling large volumes of personal data raises the cost of a breach response regardless of how good your controls are, and that drives the LIMIT you should buy rather than only the price.
Prior incidents should be disclosed. A loading is survivable; a non-disclosure discovered at claim is not, and it is the one thing on the form that can turn a paid claim into a declined one.