Cyber insurance
What cyber insurance covers for UK small businesses, what it excludes, and why it is now the most likely large claim for an office-based firm.
For an office-based business, a cyber incident is now a more likely source of a large claim than a fire. Cyber insurance covers the cost of responding to one: the specialists who contain it, the legal and notification obligations that follow, the income lost while systems are down, and any liability to customers whose data was involved.
What a cyber policy actually does
The most valuable part is usually not the money — it is the incident response. A good policy gives you access to a breach response team within hours: forensic investigators, legal advisers who know the UK GDPR notification obligations, and PR support. For a small business with no in-house security function, that access is worth more than the indemnity limit.
- Incident response and forensic investigation.
- Legal costs and regulatory notification, including ICO obligations.
- Business interruption while systems are unavailable.
- Data restoration and system rebuild costs.
- Third-party liability where customer or supplier data was involved.
- Cyber extortion, subject to policy terms and legal constraints.
Insurers now underwrite on your controls
Multi-factor authentication, tested backups, patching and staff training are increasingly conditions of cover rather than discounts. If you declare controls you do not actually have, the claim is where that gets discovered. Answer the proposal form accurately, and fix the gaps it exposes — that is worth more than the policy.
What it does not cover
- The hardware itself — a stolen or damaged laptop is a contents claim.
- Losses arising from known unpatched vulnerabilities you failed to address.
- Loss of value in your own intellectual property, in most wordings.
- Fines that are uninsurable as a matter of law, which varies by jurisdiction and penalty type.
Cyber insurance: frequently asked questions
Does a small business really need cyber insurance?+
Small businesses are targeted precisely because their controls are weaker, and the response costs are largely fixed regardless of company size — forensic investigation and legal advice cost the same for a ten-person firm as a hundred-person one. That fixed cost is what makes the cover disproportionately useful at the small end.
Will cyber insurance pay a ransom?+
Some policies include cyber extortion cover, but it is subject to terms and to legal constraints — payments to sanctioned entities are prohibited, for instance. Practically, the more valuable part of the policy is the response team that helps you avoid needing to pay by restoring from backups. Tested backups remain the best defence.
What do insurers expect us to have in place?+
Commonly multi-factor authentication on email and remote access, backups that are tested and held separately from the main network, a patching routine, and some staff awareness training. These are increasingly conditions of cover rather than optional discounts, and they are worth having whether or not you buy the policy.
Cover usually bought alongside this
How this page is produced
Written by My Energy Deals Ltd and reviewed by Arkwright Insurance Brokers Limited (FCA firm reference 434855).
mybusinessdeals is an introducer, not an insurer and not an FCA-authorised broker. This page is general information about types of cover, not a personal recommendation or advice on which policy to buy. Any policy is arranged by, and you contract directly with, our FCA-authorised partner or their panel. Premium figures are indicative market ranges, never a quote.
Last reviewed 3 September 2026.
Free benchmark review
See what your rate should be
No obligation. You'll leave knowing exactly what the market is paying — whether or not you switch through us.
We never sell your details. We'll only contact you about your quote.