How do cyber insurance policies work?

Data

Business pack policies won’t usually provide cover for the costs associated with a cyber event. Which means it may be prudent for businesses to take out a separate cyber event protection policy through a specialist insurer.

These policies provide cover for data rectification, extortion costs, business interruption costs, regulatory costs, emergency response costs and liability to third parties.

An example of an insurable event may be if a criminal hacks into a computer system of a business and steals personal customer information. Some other examples of cyber events are:

  • Cyber extortion: an attack coupled with a demand for money.
  • Denial of service: which prevents the business from accessing its computer system.
  • Credit card skimming.
  • Theft and loss of computers, laptops and other mobile devices.
  • Malware, which is malicious software implanted into a system to cause damage to the IT infrastructure.

When it comes to preventing these attacks, the best defence is to educate employees about what fraudulent emails look like to reduce the risk of them being scammed. Insurance should be the last line of defence.

To provide cover, insurers will typically require evidence the business has put sensible safeguards in place such as up-to-date anti-virus and anti-spam software as well as firewalls. Staff training and education and sound email management systems are also essential.

When it comes to excesses, there are typically two types attached to cyber policies: either an amount or a waiting period. The first works in the same way as other policies with an excess that’s a fixed amount – the policyholder pays the amount before a claim is paid. A waiting period means the insurer pays costs after a certain period of time after the insurable event was identified, for instance 12 hours.

Cyber insurance is still an attractive option for businesses in terms of cover and pricing because it’s a relatively new type of policy. So buying insurance now will benefit firms. This is because as more policies are sold and more claims are paid, premium prices will rise and cover may become more restrictive. So the message to businesses is to consider this insurance now before the market changes.


The information contained herein is of a general nature only and is not intended to be relied upon nor is it a substitute for appropriate professional advice. Whilst all care has been taken in the preparation of the material, it is not guaranteed to be accurate. Individual circumstances are different and as such require specific examination. Asparq cannot accept liability for any loss or damage of any kind arising out of the use of or reliance upon all or any part of this material. Additional information may be made available upon request.