We are the voice of insurance and long-term savings | Contact us

Cyber risk insurance

What is Cyber insurance?

Cyber insurance covers the losses relating to damage to, or loss of information from, IT systems and networks.

This page provides information on why businesses should consider cyber insurance, what a typical policy covers, how to buy cyber insurance, how businesses can manage their cyber risks, and actions taken by the Government to assist businesses protect themselves.

Why do I need cyber insurance?

As a business of any size, it is likely you will rely on information technology (IT) infrastructure to some degree.  If so, you will be exposed to the risks of business interruption, income loss, damage management and repair, and possibly reputational damage if IT equipment or systems fail or are interrupted.

A UK Government survey estimated that in 2018, 61% of large corporations and 31% of small businesses suffered a cyber breach. The average cost of a cyber-security breach is £22,700 for large businesses and £3,650 for small businesses.

Cyber image

While existing insurance policies such as commercial property, business interruption or professional indemnity insurance, may provide some elements of cover against cyber risks, businesses are increasingly buying specialised cyber insurance policies to supplement their existing insurance arrangements, particularly if they:

  • hold sensitive customer details such as names and addresses or banking information
  • rely heavily on IT systems and websites to conduct their business
  • process payment card information as a matter of course

What does it cover?

Cyber insurance covers the losses relating to damage to, or loss of information from, IT systems and networks. Policies generally include significant assistance with and management of the incident itself, which can be essential when faced with reputational damage or regulatory enforcement. 

Generally cyber risks fall into first party and third party risks. Insurance products exist to cover either or both of these types of risk.

First-party insurance covers your business’s own assets. This may include:

  • Loss or damage to digital assets such as data or software programmes
  • Business interruption from network downtime
  • Cyber exhortation where third parties threaten to damage or release data if money is not paid to them
  • Customer notification expenses when there is a legal or regulatory requirement to notify them of a security or privacy breach
  • Reputational damage arising from a breach of data that results in loss of intellectual property or customers
  • Theft of money or digital assets through theft of equipment or electronic theft

Third-party insurance covers the assets of others, typically your customers. This may include: 

  • Security and privacy breaches, and the investigation, defence costs and civil damages associated with them
  • Multi-media liability, to cover investigation, defence costs and civil damages arising from defamation, breach of privacy or negligence in publication in electronic or print media
  • Loss of third-party data, including payment of compensation to customers for denial of access, and failure of software or systems

Buying cyber insurance

You can buy cyber risk insurance directly from an insurer or from a broker. You can find brokers specialising in cyber insurance through the British Insurance Brokers’ Association (BIBA).

Policies are generally available for SMEs with cover limits between £100k and £5 million, although significantly higher amounts of cover are available for firms facing more complex cyber risks.

Shield and swords

Managing cyber risks

As well as putting adequate insurance in place, it is important for you to manage your own cyber risks as a business. This includes:

  • Evaluating first and third party risks associated with the IT systems and networks in your business
  • Assessing the potential events that could cause first or third party risks to materialise
  • Analysing the controls that are currently in place and whether they need further improvement

In 2014 the Government launched Cyber Essentials – a basic cyber security hygiene standard to help organisations protect themselves against common cyber attacks. Considering Cyber Essentials accreditation is a good first step in becoming cyber resilient.

If you suffer a cyber breach, having cyber insurance can make the recovery process as straightforward and rapid as possible (however it is still likely to take a number of days or weeks depending on the severity of the incident). Many insurers include technical assistance with managing a breach as part of the insurance policy – if so, get in touch with them as soon as possible after the breach is discovered.

UK and European action to tackle cyber risks

The UK Government views cyber attacks as a highest level risk to national security, alongside terrorism threats.  As such it has introduced a number of changes to help prevent cyber attacks, including:

More information on the UK Government’s cyber security policies is available here.

The European Union has also introduced a number of policies to help prevent cyber-attacks, including:

  • Cybersecurity Act
    Introduced in 2017, this Act strengthened the EU Agency for Cybersecurity (ENISA) and established an EU-wide cybersecurity certification framework.
  • NIS Directive
    The Directive on Security of Network and Information Systems (NIS) was the first EU-wide legislation on cybersecurity and provides legal measures to boost levels of cybersecurity in the EU.
  • Blueprint for rapid emergency response
    The EU has developed a blueprint for rapid emergency response in the vent of a large-scale cross-border cyber incident.
  • European Cybersecurity Industrial, Technology and Research Competence Centre
    In 2018, the European Commission proposed the creation of a Competence Centre to invest in stronger and pioneering cybersecurity capacity in the EU.
  • Cyberdefence
    Developed a framework for a joint-EU diplomatic response to malicious cyber activities.

More information on the EU’s cyber security policies is available here.