What is cyber insurance? A plain-English guide for business owners

A staff member opens a fake invoice email on a Monday morning. By lunchtime, every file on the shared drive is locked and a message on the screen demands payment. If you have ever asked "what is cyber insurance, and would it help me on a day like that?", this guide is for you. Cyber insurance is a policy that pays for many of the costs a business faces after a cyber attack, a data breach or an online fraud.

Think of this as cyber insurance for dummies, with no jargon and plenty of examples. You will learn what a policy pays for, what it often leaves out, what insurers ask before they quote, and how to get your business ready.

What is cyber insurance? The short answer

Cyber insurance protects a business against the money it loses, and the money it owes others, when something goes wrong with its computers, data or online accounts. Most policies have two halves.

• Your own losses (first party). Costs your business pays directly, such as IT experts, restoring data and lost income while systems are down.
• Claims from others (third party). Costs when customers, partners or regulators say your incident harmed them, such as legal defence and settlements.

For example, a dental practice with 12 staff keeps patient records in a cloud system. A criminal steals a staff password and downloads those records. The practice must find out what happened, tell affected patients, answer the data regulator and deal with any complaints. A cyber policy aims to help with each of those steps.

What a cyber insurance policy usually pays for

Every insurer words its policy differently, so check your own wording. Many policies include these sections:

1. Incident response. A hotline, plus IT forensics experts, lawyers and public relations help in the first hours.
2. Data restoration. The cost of rebuilding or recovering data and systems.
3. Business interruption. Lost profit while your systems are down, usually after a waiting period set in your policy.
4. Cyber extortion. Help dealing with criminals and, where the law and the policy allow it, some ransom costs.
5. Privacy liability and regulatory costs. Defence costs and, where the law allows, fines or penalties after a data breach.
6. Funds transfer fraud or social engineering. Money sent to a criminal after a fake email. Some insurers offer this only as an optional extra, often with a lower limit.

Take a travel agency with 70 staff. Its booking system goes down for three days after an attack. The agency pays an IT firm to rebuild servers, loses bookings while offline, and must email customers whose passport details may have leaked. Several sections of the policy could respond. For more detail, read cyber insurance coverage explained.

What many policies leave out

Exclusions are the parts of a policy that remove cover. Common ones include:

• Incidents that started before the policy began, or that you already knew about.
• Upgrades that leave your systems better than before the attack, often called betterment.
• War and certain state-backed attacks, worded differently by each insurer.
• Failure of outside infrastructure, such as a nationwide power or internet outage.
• Losses linked to a security control you said you had, but did not.

Say a small law firm tells its insurer that every email account uses multi-factor authentication (MFA). After a breach, the insurer learns that two partners had switched it off. Depending on the wording, the insurer may reduce or refuse the claim, because your application answers usually form part of the policy. See the exclusions that catch businesses out and our policy wording review checklist.

What insurers ask before they quote

Before an insurer offers cover, an underwriter reviews how well you protect yourself. Questions vary by insurer and business size, but most forms cover the same core controls:

1. Multi-factor authentication on email, remote access and admin accounts.
2. Backups kept separate from your main network, and tested by restoring them.
3. Patching, meaning how quickly you install security updates.
4. Endpoint protection on laptops and servers.
5. Staff training on phishing and payment fraud.
6. An incident response plan that names who does what.

For example, an accountancy firm with 25 staff may answer a short form. A manufacturer with 400 staff and a factory network may face a long questionnaire and a call with the underwriter. In both cases, clear answers backed by evidence lead to a smoother quote. Our MFA checklist shows what underwriters usually accept, and cyber insurance underwriting explains how they think.

What happens when you need to claim

The first hours after an incident shape the whole claim. Here is the usual order:

1. Call the insurer's incident hotline, or your broker, as soon as you suspect a problem.
2. Follow the notice period in your wording. Many policies set a deadline in hours or days, so check yours now.
3. Use the insurer's approved experts where the policy asks you to, since the insurer may refuse or reduce costs from other firms.
4. Keep evidence. Save logs, emails and screenshots, and leave machines as they are until the experts say otherwise.
5. Agree costs before you spend them, where your policy asks for consent.

Picture a logistics company that finds ransomware on a Friday night. If the IT manager calls the hotline straight away, approved experts can start that night, with costs inside the policy. If the team spends the weekend fixing it alone, some of that work may fall outside cover. Keep our ransomware first 72 hours checklist somewhere everyone can find it.

How to get your business ready for cyber insurance

A little work before you apply makes buying cover far easier:

1. List what you have. Write down your main systems, the data you hold and the suppliers who can reach it.
2. Check your controls against the questions above, and be honest about gaps.
3. Gather evidence, such as MFA screenshots, a backup restore record and training logs.
4. Fix the quick wins first, such as switching on MFA for every email account.
5. Ask your broker to explain the wording, especially notice periods and exclusions.

For example, a family-run hotel group might find that its booking system has no MFA and its backups have never had a test restore. Fixing both before applying gives the underwriter a stronger picture. PrismX guides a business through exactly this: it maps your controls, collects your evidence and builds a signed submission pack your insurer can review. PrismX prepares the risk information, and your insurer decides eligibility, pricing and cover. Start with our application readiness checklist.

Cyber insurance works best when you understand it before the bad day arrives. Book a pilot conversation to see how PrismX gets your business ready.