What is cyber insurance and what does it actually cover for an SMB?

Cyber insurance is the contract by which a company transfers to an insurer part of the residual financial risk of a cyberattack, the part left over after investing in technical and organizational controls. It typically covers incident response costs (forensics, mandatory notifications, customer communications), business interruption and lost revenue, third-party liability for compromised data and, in some cases, ransomware extortion payments. It almost always excludes damage traceable to documented negligence, such as a critical patch left unapplied for months, and state-backed attacks, an exclusion the Lloyd's market has required on every standalone cyber policy since 2023. It also makes payout conditional on the requirements declared at underwriting. It is therefore not a product that replaces technical defense: it is a product that assumes it, and it tests that assumption at the worst possible moment, when a claim actually has to be settled.

See also: Incident response · The set of roles, decisions and procedures by which a company detects, contains and closes a security incident.

What insurers demand before taking on the risk

Underwriting starts from a proposal form, but the answers become contract terms: what you declare at signing is what gets verified when a claim is filed. Multi-factor authentication on email, VPN and privileged access (specifically in its phishing-resistant form) has become a yes-or-no question on the proposal form: missing it, the policy is declined or the premium rises significantly. The second recurring requirement is backups verified through an actual restore test, offline or immutable, not merely present. The third is a written incident response plan with at least one tabletop exercise documented within the past year. The IVASS survey on cyber risk insurance policies examined the cyber policies on sale in Italy, SME products included, and found them poorly standardized, with exclusion clauses worded ambiguously: reading the wording before signing is not excess caution. On the European side, industry commentary notes that NIS2 compliance is now read by underwriters as an indicator of organizational maturity, not as an obligation separate from the policy.

An enterprise example

A manufacturing company with two hundred employees suffers a ransomware attack that encrypts its production systems. It holds a cyber policy, but when the claim is filed the insurer discovers backups had not been tested for over a year and VPN access required no second factor. The carrier does not deny cover outright, but applies the reduction clauses tied to the minimum requirements declared at underwriting, and the final payout covers only a fraction of the estimated damage. A comparable company that had renewed its controls the year before, with active MFA and a restore tested within the last six months, instead receives full reimbursement within the contractual deadlines. The difference is not the premium paid, it is the proof of controls at the moment of the claim.

Why it matters for decision makers

The first mistake to avoid is treating the policy as the security strategy, when it is only the last layer after technical controls. The second is signing without reading the exclusions and the prior authorization clauses on forensic suppliers, which need checking now, not once a claim is open. According to the Global Federation of Insurance Associations (GFIA), whose data is cited in a joint Bank for International Settlements and IAIS study, the share of global cyberattack losses actually covered by insurance remains minimal, a signal that the insurance market has not closed the protection gap for businesses. For decision makers, the practical point is arriving at renewal with the evidence already in place, not scrambling to build it when the premium gets renegotiated or a claim is opened.