Cyber insurance is a type of business insurance that protects companies from financial losses caused by cyber attacks, data breaches, and IT failures.
Cyber insurance (also known as cyber liability or cyber risk insurance) helps protect your business if you suffer a cyber-attack, data breach, or digital system failure.
It’s a standalone policy designed to cover both immediate response and longer-term costs, from forensic investigations and data recovery, to legal defence, compensation claims, and reputational repair.
Half of UK businesses were hit by a cyber attack last year. The average cost for an SME was over £21,000. These attacks include ransomware, phishing scams, data leaks, and system faults. A staggering 81% of reported victims were small businesses.
Cyber insurance helps you respond quickly, cover the costs, and stay operational.
Cyber insurance protects your business against the financial and reputational damage caused by cyber attacks, data breaches, and system failures.
Most policies include two types of protection: First-party cover for your own losses and third-party cover for claims made against you.
If your systems are breached or your data is compromised, a typical policy covers:
Some policies offer a fixed daily payout during downtime to help with cashflow.
If your incident affects others, your policy may cover:
Read our guide on cyber liability insurance to understand the core concepts.
Some policies also include:
CyberSure insight: Policies vary. Always check for cover on phishing, cloud failures, and accidental data loss. These are common causes of serious claims.
Any business connected to the internet is a target. If you store data, take payments, or rely on software to operate, you face real risk. Cyber insurance helps limit the damage when that risk becomes reality. Here’s who needs cyber insurance to ensure their business isn’t interrupted.
Most cyber attacks target small firms. They’re seen as easier targets due to limited IT security and fewer resources.
If you run a business that:
...you’re exposed. A single breach could disrupt operations, damage your reputation, or lead to significant legal costs.
Some industries face higher risks and tighter rules.
Many regulators expect firms to manage cyber risks. Insurance helps meet these expectations.
Small teams are often connected, but not protected. They rely on SaaS platforms, shared access, and remote tools that bring speed and risk.
Cyber insurance offers:
Even one laptop or email account is enough to expose your business.
No. Cyber insurance is not a legal requirement in the UK. But that doesn’t mean it isn’t expected. If your business handles sensitive data or operates in a regulated sector, insurance may be necessary to meet client, contractual, or compliance requirements for cybersecurity.
Cyber insurance is not a legal requirement in the UK. No law forces businesses to buy it, even if they hold personal data. But if you process sensitive information, you must protect it under GDPR. That includes having systems in place to reduce risk and respond to breaches.
Some regulators now expect standalone cyber cover. For example, the Solicitors Regulation Authority excludes first-party cyber losses from professional indemnity policies. Law firms must handle that risk separately.
Cyber insurance is often expected, even if not enforced by law. It’s recommended if you:
Many supply chains now require Cyber Essentials Plus. Insurers often bundle this with cyber cover or offer discounts when certified.
It depends on your size, sector, and security setup. Most small businesses pay between £300 and £3,500 a year. High-risk industries and businesses handling sensitive data will pay more, but strong controls can reduce your premium.
Premiums vary by risk. Key factors include:
Firms without basic controls, such as multi-factor authentication or off-site backups, may pay more or be refused coverage.
Cyber insurance costs vary widely for SMEs, depending on turnover, sector, and cover limits. The table below gives a realistic price range based on current UK market data, so you can see what similar businesses typically pay.
To improve pricing:
Cyber cover is more affordable when paired with strong cyber hygiene. Insurers reward firms that reduce their risk.
Cyber policies vary. So do the risks businesses face. Start with what matters most: what it covers, what it excludes, how cyber insurance claims work. Then you can match the policy to your current setup. Remember, though, cheap cover that doesn’t pay out is no cover at all.
Cyber cover isn’t one-size-fits-all. You need a policy that matches how your business operates, the data you handle, and where you’re vulnerable.
Before you buy, ask:
If you don’t understand the exclusions, ask for them in plain terms. You need to know where the policy stops.
Price matters, but cover matters more. When comparing policies:
Some policies won’t pay if you haven’t met minimum security standards. Ensure those conditions are clear from the outset.
Cyber insurance works best as part of a wider plan. If you have Cyber Essentials or Cyber Essentials Plus, insurers may:
These schemes also help you put controls in place, such as multi-factor authentication and data backups, which reduce the likelihood of a breach.
Insurance transfers risk. It doesn’t fix weak systems. Use it to plug the gap, not replace the basics.