Cyber insurance

What it means

Cyber insurance covers the aftermath of an attack or an IT failure: forensics, data restoration, crisis communication and the loss from downtime, measured much as business interruption cover measures it.

Damaged hardware belongs to property insurance, not here. Regulatory fines are usually not insurable and the policy pays only the cost of defence, so the exclusions are worth reading before signing rather than after a loss.

It is not the same as ordinary liability insurance. That covers injury and damage to third parties’ property, and data leaks or system outages are usually expressly excluded from it. Cyber cover addresses exactly that area, both the company’s own costs and third-party claims.

How it works in practice

Before binding, the insurer sends a questionnaire on backups, two-factor authentication and patching. The answers become part of the contract: if a claim shows two-factor was never deployed, the payout is cut or refused.

The downtime payout is calculated from the financial statements and starts to run only after the hours the policy sets as an excess counted in time rather than in euros. A data leak is reported to the insurer and, within 72 hours, as a personal data breach as well.

A small firm’s typical incident is not encrypted data but a fraudulent payment: a spoofed e-mail from a supplier with a new account number. Many policies cover it only with a low sum insured or not at all, so when we process payments we verify every change of a supplier’s account by phone.

What to watch out for

After ransomware a company calls its own IT provider and starts restoring. Most policies require a call to the insurer’s hotline before any work begins and tie the payout to its own vendors, so the restoration invoices stay with the company, and the excess on top.

A policy taken out once and left for years ages along with the company. When an online shop, cloud systems or new processing of personal data are added and the insurer is not told at renewal, the change in risk can be grounds for reducing the payout, even though the questionnaire was true when signed.