As cyber attacks on Australian businesses have climbed, cyber insurance has moved from a nice-to-have to a serious consideration for organisations of every size. But policies vary widely, and it’s not always clear what you’re actually buying. This guide explains, in plain English, what cyber insurance typically covers, what it doesn’t, and how to think about whether it’s right for your business.
This article is general information only and isn’t financial or insurance advice; always check the specific terms of any policy and consider your own circumstances.
What cyber insurance typically covers
While every policy differs, most cyber insurance covers a combination of the following:
- Incident response costs: the specialists who investigate, contain and clean up an attack.
- Data recovery: the cost of restoring lost or corrupted data and systems.
- Business interruption: lost income while your operations are down.
- Cyber extortion: support and, in some cases, funds related to ransomware demands.
- Legal and regulatory costs: including managing a notifiable data breach and any resulting claims.
- Third-party liability: claims from customers or partners whose data was exposed.
What it often excludes
Cyber insurance is not a substitute for good security. Policies commonly exclude losses that result from poor basic hygiene, and increasingly, insurers require you to have certain controls in place before they’ll pay out, or even before they’ll offer cover at all. Missing patches, no multi-factor authentication, or a lack of backups can all affect a claim.
Insurers now expect baseline security
One of the biggest shifts in recent years is that insurers ask detailed questions about your defences before quoting. Multi-factor authentication, regular backups, staff training and timely patching are now common prerequisites. The upside: the same controls that lower your premium also dramatically reduce your chance of a claim in the first place.
Do you need it?
Ask yourself how your business would cope financially if it were offline for a week, lost access to its data, or faced a claim from customers after a breach. If the answer is “not well,” cyber insurance is worth serious consideration, as one layer of protection alongside, not instead of, strong security practices.
Before you speak to an insurer, it pays to know how strong your defences already are. Take our free cyber security assessment to see where you stand, and to be ready for the questions insurers will ask.