Cyber insurance: what it covers and when it’s worth it for a small team

Cyber insurance pays for what an attack or a data breach costs you: the specialists who contain it, rebuilding your systems and data, the income you lose while you are down, and the claims of people whose data leaked. For a team without an IT department, the incident line that comes with many policies can be worth as much as the money.

It does not replace security, and it does not pay for everything. A claim is decided by a handful of lines: exclusions, sub-limits, conditions and the answers you give on the proposal form. This guide covers each of them, for policies bought in the UK and in France.

What cyber insurance covers

Most policies have two halves. First-party cover pays your own costs after an incident; third-party cover pays when someone else holds you responsible. The usual building blocks:

Some policies also cover what your website publishes, an outage at a provider you depend on, or an outage that is not an attack, such as a failed update. Others do not: read the list of insured events, not the brochure.

On fines, I would plan as if a regulator’s penalty stayed with you: in the UK, whether an ICO fine can legally be insured is uncertain at best, and in France the insurance supervisor, the ACPR, considers that public policy rules out insuring administrative fines. The legal costs of answering the regulator are the part you can count on.

The lines that decide whether you get paid

Payment fraud and social engineering

If a criminal persuades someone in your team to pay a fake invoice or send money to “new bank details”, nothing was hacked: your team made the payment. Many cyber policies exclude this, sell it as an option or cap it at a sub-limit far below the main limit, sometimes on condition that the new details were checked by phone. If you pay suppliers by transfer, read this line first; my guide to fake invoices and new bank details covers the habits that prevent the fraud.

In the UK, micro-enterprises (fewer than ten staff, turnover or balance sheet up to €2 million) can also claim back authorised push payment fraud on Faster Payments and CHAPS from their bank, up to £85,000 (about $113,000) per claim, under rules being reviewed as of 19 October 2026. Larger companies rely on their bank’s goodwill and on their policy.

War and state-backed attacks

Since 31 March 2023, Lloyd’s of London has required every standalone cyber-attack policy written or renewed in its market to exclude losses from state-backed cyber attacks, during a war or not, unless Lloyd’s agrees otherwise (Market Bulletin Y5381). Other insurers have their own war wording. Ask how the policy decides that an attack was state-backed, who has to prove it, and whether your systems are covered when the attack was aimed at another country.

Prior incidents and unpatched software

Anything you knew about before the start date is excluded, and some policies only cover incidents that began after a “retroactive date”. Some also exclude or reduce cover when the attacker used a flaw that an available update would have fixed, or software its maker no longer supports: look for clauses on minimum security or maintenance.

Excess, waiting period and sub-limits

You pay the excess first. Lost income is usually covered only after a waiting period, often counted in hours, and until the end of the indemnity period. Extortion, payment fraud and notification often have their own sub-limits, so the headline limit is rarely what one incident can get you.

What you must do when it happens

• Call the insurer’s incident line first. Many policies require its consent before you hire responders, pay a ransom or admit liability; costs committed without it may not be reimbursed.
• Tell the insurer within the policy’s deadline, which can be “as soon as possible”.
• Keep the evidence: do not wipe an infected computer or delete the attacker’s forwarding rule before they are recorded. My first-hour plan after a cyber attack lists what to keep and who to call.
• In France, file a complaint within 72 hours. Under Article L. 12-10-1 of the French Insurance Code, in force since 24 April 2023, an insurer can only pay for losses caused by an attack on your systems if a complaint was filed within 72 hours of you becoming aware of it. This applies to companies and to people working in a professional capacity; the complaint alone does not guarantee cover.

The insurance clock runs alongside the data protection one: when personal data is at risk, you have 72 hours to notify the ICO or the CNIL, as my guide to what to do after a data breach explains.

What insurers ask before they quote

The proposal form reads like a security questionnaire, and the insurer prices the policy, and later assesses claims, on the strength of your answers. Expect questions such as these:

1. Is multi-factor authentication on for email, remote access and every admin account? Switching it on everywhere takes an afternoon.
2. How often do you back up, is one copy offline or impossible to alter, and when did you last test a restore? My guide to the 3-2-1 backup rule covers all three.
3. Are updates automatic, and does any computer run a system its maker no longer supports?
4. Does every computer have antivirus or endpoint protection?
5. Who can add a payee or change bank details, and is every change checked by phone?
6. How many records of personal data do you hold, and do you take card payments?
7. Has the team been trained to spot phishing?

Answer as things are on the day, not as you plan them to be. Under the UK’s Insurance Act 2015, a business must make a fair presentation of the risk; if it does not, the insurer can reduce or refuse a claim, depending on what it would have done had it known. Large clients send their suppliers much the same questions, so my guide to answering a client’s security questionnaire helps with both.

Check the cover you already have

Before you buy, read the policies you already pay for.

• Business package and professional indemnity policies. Some include a small cyber extension; others exclude cyber events outright. Professional indemnity answers claims that your work was negligent, not your own costs after an attack.
• Cyber Essentials (UK). Organisations domiciled in the UK or a Crown Dependency, with a turnover under £20 million, that certify their whole organisation can opt in to cyber liability insurance at no extra cost when they apply. The NCSC says it includes 24/7 incident response support with technical, legal and crisis management help. IASME, which delivers the scheme for the NCSC, sets the total limit at £25,000 (about $33,000), incident response included, and warns that this may not be enough for a serious incident: treat it as a floor, not a full policy. Certification starts at £320 plus VAT (about $425) at the time of writing (October 2026).

When cyber insurance is worth it for a small team

I would look seriously at a policy if one of these is true:

• Your income stops when your IT stops: orders, bookings or client work that depend on email, files or a website you cannot do without for a week.
• You move money by transfer, to suppliers or on behalf of clients.
• You hold personal data in volume, or sensitive data such as health information or identity documents.
• A client or a tender requires it.

It is less pressing for a solo consultant whose work lives in mainstream cloud services with tested backups, and who could keep working from a phone for a week. There, I would spend the first budget on the basics in my cybersecurity guide for small teams: they make an attack less likely, while a policy only pays after one.

For scale, insurers in the Association of British Insurers’ data collection paid £197 million in cyber claims in 2024, 230% more than in 2023, with malware and ransomware behind 51% of claims (a sample of the market, ABI, November 2025). The government’s Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses, and 42% of micro businesses, had identified a breach or attack in the previous 12 months.

Questions to ask a broker before you sign

1. What are the limit, the excess, the sub-limits for payment fraud, extortion and lost income, and the waiting period?
2. Is social engineering covered, and on what conditions?
3. Can I use my own IT provider, or must I call the panel?
4. Which security measures does the policy assume, and what happens if one was missing on the day?
5. How does the war or state-backed exclusion define an attack, and who decides attribution?
6. Are outages that are not attacks, or that hit a provider I depend on, covered?

Get the answers in writing. This guide describes how cyber insurance works as of 19 October 2026; it is not legal advice. A broker who specialises in cyber is worth it once you hold a lot of personal data or a client sets the terms, and a lawyer when a contract makes you liable for more than the policy covers.

Before you need it: a short checklist

• Put the policy number and the incident line in the offline contact list of your incident plan.
• Write down your deadlines: telling the insurer, the complaint within 72 hours in France, the regulator within 72 hours for personal data.
• Make your declared answers true: multi-factor authentication, backups, updates, the call-back rule for bank details.
• Review the policy at each renewal, and whenever you start taking payments, hold more data or sign a client with requirements.

Whether or not you have a policy, a hacked website, a lost domain or a locked account is the kind of rescue I take on, the same day or within 24 hours; if you are insured, check first whether the insurer has to approve who you call.