Cyber insurance
Also known as: cyber liability insurance, cyber risk insurance, data breach insurance
Cyber insurance (also called cyber liability insurance) helps cover the costs of a cyber incident: recovery, legal fees, notification, ransom negotiation, and business interruption.
Insurers increasingly require baseline security controls (MFA, EDR, backups, training) before they'll issue or pay on a policy.
Cyber insurance, explained at three levels
At home
Cyber insurance works like home insurance for the digital side of your business. You pay a premium, and if a hack or ransomware attack strikes, the insurer helps pay for experts to clean it up, lawyers, notifying customers, and income lost while you're down. Just as a home insurer expects smoke detectors and locks, cyber insurers now expect basic protections such as MFA and backups.
At work
Cyber insurance is a policy that pays for the costs of a cyber incident, such as forensic investigation, data recovery, legal advice, customer notification, ransom negotiation, and business interruption. It matters because these costs can easily exceed what a small business can absorb. Policies also come with an incident response hotline, so you get experienced help in the first hours of an attack.
At home
Coverage splits into two halves. First-party coverage pays your own losses: forensic investigators, restoring data, lost income while closed, and sometimes ransom payments. Third-party coverage pays claims from others, such as customers whose data leaked, plus regulatory fines where insurable. Each part has a limit, a deductible, and exclusions, such as war or social engineering fraud that may need its own add-on. Reading exclusions matters as much as the headline limit.
At work
To get a policy, a business completes an application asking detailed security questions: is MFA on email and remote access, is EDR deployed, are backups offline and tested, are staff trained, are systems patched? Underwriters price the premium on those answers and often run external scans of your domain and exposed services. The answers become part of the contract, so an inaccurate one can give the insurer grounds to deny a claim.
At home
Policies use several mechanisms that shape the real payout. Sub-limits cap specific costs, such as ransom or social engineering fraud, well below the headline amount. Waiting periods mean business interruption cover typically starts only after eight to twelve hours of downtime. Insurers also steer you to their approved breach coaches and forensic firms. While the paperwork is tedious, in my view the application is a free security checklist that's worth answering honestly.
At work
Underwriting has shifted from questionnaires to evidence. Insurers scan for exposed RDP, unpatched VPNs, and missing DMARC, and may require attestations for MFA, EDR or MDR, immutable backups, and an incident response plan. At claim time, adjusters compare forensic findings against those attestations, and misrepresentation can void coverage. Ransom payments remain subject to sanctions checks. Businesses should keep dated evidence of each control, review exclusions such as war, and align limits with business impact analysis figures.
Real-world examples
At home
Marcus renewed his firm's policy and was surprised the insurer now required MFA on all accounts and proof of offline backups. Rather than a hassle, it pushed him to fix real gaps, and lowered his premium once his MSP documented the controls.
At work
When Nadia's firm suffered a ransomware attack, their cyber policy funded a professional incident response team, covered a week of lost billings, and paid the legally required client notifications. Because they'd maintained the attested controls, the claim was paid in full.
Common confusions
- Cyber insurance means we don't need strong security — It's the opposite: insurers now require solid controls to issue a policy and to pay claims. Insurance is a financial backstop for residual risk, not a substitute for prevention.
- Our general business liability policy already covers cyber — Standard commercial policies usually exclude or barely address cyber losses. Dedicated cyber coverage is generally needed for breaches, ransomware, and data liability.
- Any answer on the application is fine as long as we get the policy — Misstating your security posture can void coverage exactly when you need it. Applications should be answered accurately, with your MSP's help if needed.
For analysts
Treat the cyber insurance application as a free security audit. The controls insurers demand (MFA, EDR, tested backups, training) are the same ones that prevent incidents, so meeting them lowers both your risk and your premium.
History & origin
Cyber insurance emerged in the late 1990s but stayed niche until the surge of breaches and ransomware in the 2010s. As claims exploded, insurers tightened terms sharply around 2020 to 2022, raising premiums and adding strict security requirements. Today a policy application doubles as a security checklist, and MSPs often help clients meet the controls needed to qualify for affordable coverage.