Cyber insurance can soften the financial blow of an attack, but it's no substitute for security — and insurers know it. Premiums, coverage and even eligibility now depend on the controls you can prove you have.
What policies typically cover
Policies vary widely, but common coverage includes:
- Incident response costs, such as forensic investigators and legal advice.
- Business interruption losses while systems are down.
- Data restoration and system recovery.
- Privacy breach costs, including notifying affected people.
- Liability claims from customers or partners.
- Cyber extortion, in some policies.
What insurers commonly expect
Applications increasingly ask detailed questions about your security. Common requirements include:
- Multi-factor authentication on email, remote access and administrator accounts.
- Endpoint detection and response software on computers and servers.
- Backups that are separated from your main network and regularly tested.
- Timely patching and security awareness training.
- A documented incident response plan.
Answer the questionnaire carefully
The application is part of your policy. If you say multi-factor authentication is enforced everywhere and it isn't, an insurer may challenge a claim. Have someone who knows your environment review every answer, and fix gaps before renewal rather than guessing.
Read the fine print
- Sub-limits: some losses, such as social engineering or payment fraud, may have much lower limits than the headline amount.
- Exclusions: check how the policy treats acts of war, state-sponsored attacks, unpatched systems and prior known incidents.
- Vendor panels: many insurers require you to use their approved incident response firms and lawyers. Know who they are before you need them.
- Notification requirements: most policies require prompt notice of an incident. Late notice can jeopardize coverage.
Questions to ask before renewal
- Do our answers on the application match reality today?
- Are our limits enough to cover a week or more of downtime?
- Who do we call first under this policy, and is that number stored somewhere we can reach during an outage?
Key takeaways
- Insurance transfers some financial risk; it doesn't prevent attacks.
- Strong controls lower premiums and make claims smoother.
- An independent assessment before renewal helps you answer honestly — and fix gaps first.