Cyber Insurance
Cyber insurance is bought as a payout and used as a response. When an account is compromised on a Friday afternoon, what a business needs first is a forensic investigator, a specialist lawyer and someone who has done this before — not a claim form. That is the part most businesses underestimate, and it is the part that decides how bad the week gets. The money matters too, and so does knowing in advance which of your losses the policy actually treats as a cyber loss.
The Definition
A cyber policy usually combines incident-response services, first-party financial loss and third-party liability. The response element brings in forensic investigation, specialist legal advice, data restoration, customer notification and crisis communications. The first-party side covers your own losses, business interruption chief among them. The liability side answers claims from the people whose data or systems were affected.
The NCSC’s advice is to examine what a policy actually covers rather than to assume a category name, and that is the right instinct: cyber liability insurance is one of the least standardised products in the commercial market. Two quotes at the same price can differ enormously on business interruption, on systems failure as distinct from attack, and on whether the insurer’s responders or your own advisers run the incident. Businesses often come to us asking for cyber security insurance, which is a search term rather than a product — what matters is which of the three parts above the wording is actually strong on.
The value is often access rather than indemnity. Most small and mid-sized businesses do not have forensic or data-protection legal capability in house, and cannot acquire it at 7am on a Saturday. A business cyber insurance policy that comes with a tested response panel is worth more than a slightly larger limit with no one attached to it.
Insurance is not a substitute for secure systems or an incident plan — it sits alongside them. Nothing here reduces the work of getting the basics right, and the section below on underwriting is a fair summary of what an insurer will expect you to have already done.
It is one of seven covers in the same family; our liability insurance page sets out which of them answers which claim.
Cover Structure
A single compromise produces several different losses at once, and they are underwritten separately. Knowing which of them your policy is strong on is the whole point of reading it before you need it.
Forensic investigation, specialist legal advice, data restoration and crisis communications, usually delivered by the insurer’s panel. This is the part that starts within hours rather than after a claim is agreed.
Business interruption from an incident, with no physical damage anywhere. Waiting periods, restoration limits and whether system failure counts as well as attack are where two policies differ most.
Privacy and network-security liability: claims by customers, suppliers or anyone whose data or systems were affected. Notifying the individuals affected can be a legal duty as well as a significant cost.
Cyber extortion cover, subject to its terms, to sanctions law and to advice. It is support for handling a demand, not an undertaking to pay one, and the two should never be described as though they were the same thing.
Funds-transfer fraud and social engineering are the common exception: they frequently sit outside the core wording and need either a specific extension or a separate crime policy. The section on where claims fail deals with that.
The Legal Position
There is no general UK law requiring any company to buy cyber insurance. Every cyber insurance UK search that begins “is it compulsory” has the same short answer, and it is the wrong question. What the law does require is the rest of it: UK GDPR and the Data Protection Act 2018 impose duties on lawful processing, security and accountability, with the appropriate controls depending on the risk. A ransomware event can be a personal-data breach in its own right, even when the immediate problem is that nobody can open anything.
The clock is 72 hours. A controller must notify the ICO of a reportable personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. High-risk breaches may also require telling the affected individuals. Two things about that deadline are regularly got wrong: the threshold is a breach that risks people’s rights and freedoms, not every attempted attack, and the clock does not pause while an insurer decides whether to accept a claim.
The penalties sit in two tiers — up to £8.7m or 2% of worldwide annual turnover, and up to £17.5m or 4%, whichever is higher for an undertaking. Separately, the ICO’s maximum penalty powers under PECR rose to the same £17.5m or 4% when the change commenced in February 2026; the old £500,000 PECR ceiling that still appears all over the internet is out of date.
A cyber policy is not a way of paying a fine. An insurer agreeing to fund legal advice does not establish that a penalty is insurable, and cyber risk insurance should never be sold on a promise to pay GDPR penalties. Enforcement orders, restrictions on processing, contractual claims and claims from affected individuals are all separate consequences that arrive on their own terms.
Two Decided Cases
These are final decisions, not provisional intentions or press headlines. Both concern security failures rather than any failure to hold insurance, which is exactly why they are worth reading.
In March 2025 the ICO concluded a case about a 2022 ransomware incident at a software provider with a final penalty of £3,076,320 after settlement, having identified security shortcomings including incomplete multi-factor authentication.
That penalty was lower than the provisional figure announced earlier, which is why content should cite concluded decisions rather than first headlines. It is also why a quoted fine in a sales email is usually the wrong number.
In October 2025 the ICO penalised an outsourcing group £8m and its pensions arm £6m over security failures connected to a 2023 attack affecting more than six million people. Two entities, two penalties, agreed without appeal.
Neither case turned on insurance, and a penalty is not a standard insured benefit. What insurance buys is the response and the civil exposure that follows, which is a different question from what the regulator decides.
Directors can also face questions about governance after an incident, which is directors’ and officers’ territory rather than this policy’s. And the security controls the ICO examined in both cases are the same ones an insurer will ask you about before quoting — which is the subject of the next section.
Underwriting
Cyber underwriting has hardened into a checklist of minimum controls. Every answer is a declaration, and a declaration that does not match reality across the whole organisation is how a claim gets argued about later.
Multi-factor authentication on email, remote access and privileged accounts is close to a precondition now. “Mostly enabled” is the answer that causes trouble, because it was the finding in the £3m case above.
Backups, their separation from the live network, and whether a restore has actually been rehearsed. An untested backup is a plan rather than a control, and insurers increasingly ask which one it is.
Patching cadence, endpoint management and whether any business-critical software has gone beyond vendor support. Unsupported systems are frequently the single line on the form that changes the terms.
Privileged accounts, remote access, and the connections your contractors and suppliers hold. What an underwriter is asking is not only what you run, but who else can reach it, from where, and with what access.
Check the declarations against what is actually implemented everywhere, including the site that joined by acquisition and the department that still does things its own way. We would rather spend an hour on that before submission than have the conversation after an incident.
Where Claims Fail
These four account for most of the arguments. All four are readable in advance, and all four are worth asking about while there is still time to change the wording.
A member of staff tricked into paying a forged invoice is funds-transfer fraud. It often needs a specific extension or a separate crime policy, and may turn on your verification procedure and who authorised the payment.
Outsourcing IT does not move your obligations or guarantee cover for a provider’s outage. Dependent business interruption, cloud failure and supplier incidents each need checking on their own terms.
War and systemic-event exclusions, and failures of infrastructure you do not control, can narrow a policy materially. They are also the clauses most likely to have quietly changed at the last renewal.
Pre-existing incidents, waiting periods and the requirement to get the insurer’s consent before instructing responders. Calling your own lawyer first is a natural reaction and a common coverage problem.
Bodily injury and property damage sit elsewhere too: where a connected product’s defect hurts someone, that is products liability, and where the allegation is about professional work done for a client it is professional indemnity. If you want the whole programme reviewed rather than one section, start with business insurance or, for a risk-managed account, corporate insurance and risk management.
Named People
A commercial cyber insurance submission is only as good as its declarations, and the questions are technical enough that most businesses answer at least one of them optimistically. Going through the form together before it is signed is the most useful hour a cyber insurance broker spends on the risk.
Ian Cooke holds Cert CII and owns compliance across the book, which is where the declaration questions land. Kate Thompson places the cover and reads the two quotes that look identical until you compare the business interruption terms. Megan Quinn handles the day-to-day, including the mid-term changes that follow a new system or a new supplier. Colin Thompson runs the claim from this office alongside the insurer’s responders; our claims support page explains how that works, and the rest of the team is on meet the team.
Cyber Insurance Enquiry
Six questions and an optional upload. The one that matters most is how long you could trade without your main systems, because that sets the business interruption terms and the limit. Attach the current schedule or a proposal form you have been sent and we will work to it. Cyber insurance for businesses is quoted off the controls as much as the turnover, so a cyber insurance quote worth comparing needs the security answers with it. One working day, no fee, no obligation. If you are in an incident right now, call 0191 378 7100 instead of using this form.
Common Questions
No. There is no general UK law requiring a company to buy it. What the law requires is the security and accountability duties under UK GDPR and the Data Protection Act 2018, and reporting a qualifying breach to the ICO. Contracts are a different matter: client security requirements increasingly specify cyber cover at a stated limit.
Do not buy it expecting that. An insurer funding legal advice does not establish that a penalty is insurable, and a fine is not a standard insured benefit. What the policy is there for is the response, the business interruption and the claims that come from the people affected.
Outsourcing moves the work, not your obligations. You remain responsible for your data protection duties, and a provider’s outage or breach may or may not be covered depending on dependent business interruption and supplier wording. It is one of the first things worth checking.
No. The duty is to report a personal-data breach that risks people’s rights and freedoms, without undue delay and, where feasible, within 72 hours of becoming aware. Not every attempted attack meets that threshold — and the 72 hours does not pause while an insurer decides anything.
Often not by the core cyber wording. Funds-transfer fraud and social engineering usually need a specific extension or a separate crime policy, and cover can turn on your verification procedure and who authorised the payment. The fact that email was involved does not by itself make it a cyber claim.
Not as a matter of course. Cyber extortion cover is subject to its terms, and a demand needs criminal-law, sanctions and regulatory advice before anything is decided. NCSC and industry guidance is to consider the alternatives first. Paying also does not guarantee that systems are restored, that data stays unpublished, or that any legal duty is satisfied.
Yes. Send the schedule and we will tell you what we would change — usually the business interruption basis, the waiting period and who is on the response panel. If it is correctly arranged we will say so.
