What Is Cyber Insurance? A Basic Guide to Whether SMBs Need It and What It Covers

Cyber insurance is a general term for insurance products that cover losses a company incurs from IT-related incidents such as cyberattacks, system failures, or data breaches. Depending on the type of incident, the scope of coverage can include damages from personal data leaks, the cost of restoring systems, and lost profit from halted operations. It is not simply a matter of 'having a policy means you're safe' — understanding what is and isn't covered is essential before considering a policy. This article outlines, from a neutral standpoint, the general mechanics of cyber insurance and what small and medium-sized businesses (SMBs) should know before considering coverage.

Cyber insurance was once seen mainly as a product for large enterprises, but more products designed for SMBs have appeared in recent years. One reason is that business partners and outsourcing clients increasingly check on a company's security posture. Another is that the investigation and recovery costs following an incident can be a significant burden for smaller companies. For a broader view of how to think about IT risk and where to start, see our Complete Guide to IT Risk Management for SMBs — insurance is best understood as one option within that larger picture.

Ransomware incidents in particular often require engaging outside specialists to restore systems, making them costly and time-consuming. For the basics of how ransomware works and the reality of the damage it causes, see Ransomware Basics for SMBs. Cyber insurance is sometimes considered as one way to prepare for this kind of incident.

Coverage details vary by insurer and product, but cyber insurance is generally thought of in terms of three broad areas. The specific names, scope, and payout conditions differ from product to product, so treat the following as a general tendency rather than a fixed rule.

- Liability/damages coverage: costs when customers or business partners file claims for damages following a data leak
- Incident response and recovery costs: forensic investigation, system restoration, call center setup, condolence payments, and similar costs
- Business interruption loss: compensation for profit lost due to system downtime
- Other cost items: some products also cover legal fees and PR/crisis communication costs

At the same time, certain items tend to fall outside coverage, or come with conditions attached. For example, how a policy treats an incident caused by a vulnerability that already existed before the policy began, or one attributed to inadequate basic security measures, varies significantly by product and policy terms. Coverage for ransom payments themselves is also limited to a handful of products, and even where it exists, it is not meant to encourage paying a ransom.

- Incidents caused by a known vulnerability that existed before the policy took effect
- Incidents judged to stem from inadequate basic security measures (handling varies by product)
- Reputational damage that is difficult to quantify financially
- Ordinary system aging or malfunctions unrelated to a cyberattack
- Losses that exceed the policy's coverage limit

When considering cyber insurance, it's more practical to weigh the necessity against your business's specific situation — the nature of the data you handle and the potential impact of downtime — rather than judging solely by the size of the coverage amount. For example, the level of coverage that makes sense will differ depending on how much personal data you handle and how much a system outage would affect your operations. Because coverage details and premiums vary by insurer, it's advisable to compare products from multiple companies rather than deciding based on one insurer's explanation alone.

- The volume and sensitivity of personal data or data entrusted to you by clients
- How much a system outage would affect your business operations
- The technical and organizational measures you already have in place
- Security requirements requested by business partners or outsourcing clients
- The balance between coverage scope, exclusions, and premiums (compare across multiple insurers)

Cyber insurance is a mechanism for reducing the financial burden after an incident occurs — it does not prevent the incident itself. Some insurers check the status of a company's basic security measures at the time of enrollment or renewal. For that reason, it's practical to put basic measures in place first, as a prerequisite for considering insurance. See 5 Basic Security Steps SMBs Should Take First for where to start.

- [ ] Have you assessed the necessity of coverage based on your business and the nature of your data?
- [ ] Have you compared products from multiple insurers (coverage, exclusions, premiums)?
- [ ] Have you checked the policy terms for what is excluded from coverage?
- [ ] Have you implemented the basic security measures that are a prerequisite for coverage?
- [ ] Is your internal incident response and communication flow documented and shared?

Cyber insurance is one option for reducing the financial burden after an incident — it is not a cure-all. It's important to understand what is and isn't covered, and to weigh the necessity against your own business situation. When considering a policy, it's best to first put basic security measures in place, then compare products from multiple insurers before deciding.