Almost every modern business depends on technology in some form.
You might operate entirely online, run an ecommerce website or store thousands of customer records. Equally, you could run a traditional shop, restaurant, construction company or professional service where computers are mainly used for email, banking, invoicing and administration.
Either way, technology introduces risks.
A compromised email account, fraudulent payment request, ransomware attack, stolen laptop or data breach can disrupt a business and potentially lead to substantial financial losses.
This is why cyber insurance has become an increasingly important consideration for businesses of all sizes.
Cyber insurance cannot prevent an attack and should never replace appropriate security measures. However, suitable cover can provide valuable financial protection and access to specialist support when a cyber incident occurs.
What Is Cyber Insurance?
Cyber insurance is designed to protect businesses against certain financial losses and liabilities arising from cyber incidents.
Depending on the policy, this can include incidents such as:
- Data Breaches
- Cyber Attacks
- Ransomware
- Malware
- Hacking
- Business Email Compromise
- System Interruptions
- Data Loss
- Cyber-related Liability Claims
- Certain Forms of Cyber Fraud
Unlike traditional property insurance, which primarily protects physical assets, cyber insurance addresses many of the risks associated with digital systems, information and online operations.
The precise protection varies considerably between insurers, making it important to understand exactly what your policy covers.
Does Every Business Need Cyber Insurance?
Cyber insurance is not generally a legal requirement for UK businesses.
However, businesses should not assume they have no cyber exposure simply because they are small or do not operate primarily online.
Consider how your business would function if you suddenly lost access to:
- Customer Records
- Accounting Software
- Online Banking
- Your Website
- Cloud Storage
- Booking Systems
- Payment Systems
- Supplier Information
- Internal Documents
Even businesses traditionally regarded as “bricks and mortar” increasingly depend on digital technology.
A restaurant might rely on an online booking system and card payments. A tradesperson could use email, cloud accounting and online banking. A retailer could store customer details and operate electronic tills.
Cyber risk is therefore no longer restricted to technology companies.
How Common Are Cyber Attacks Against UK Businesses?
Cyber attacks remain a significant issue for UK organisations.
Phishing continues to be one of the most widespread threats, with criminals using fraudulent emails, websites, messages and other communications to persuade employees into revealing information, transferring money or providing access to business systems.
Businesses can also encounter:
- Account Takeovers
- Impersonation Attacks
- Malware
- Ransomware
- Unauthorised Network Access
- Online Banking Attacks
- Denial-of-service Attacks
Large corporations regularly make headlines following major cyber incidents, but small businesses can also be targeted.
Criminals do not necessarily choose victims according to turnover or company size. Automated attacks, stolen passwords and phishing campaigns can target thousands of organisations simultaneously.
What Does Cyber Insurance Cover?
There is no completely standard cyber insurance policy.
Different insurers provide different levels of protection, exclusions and additional services.
However, cover can potentially include several important areas.
Data Breach Response
A data breach can involve personal, confidential or commercially sensitive information being accessed, disclosed, altered, lost or stolen.
Examples could include:
- Customer Information
- Employee Records
- Payment Information
- Contact Details
- Confidential Business Documents
- Login Credentials
Responding appropriately can require specialist assistance.
Depending on the policy, cyber insurance may help with expenses associated with investigating the incident, determining what information has been compromised and managing the response.
Cyber Incident Investigation
When something suspicious happens, businesses first need to understand what has occurred.
Has somebody compromised an employee’s email account?
Has malware entered the network?
Have customer records been accessed?
Is an attacker still inside your systems?
Cyber insurance can provide access to forensic technology specialists who investigate the incident and help determine its cause, extent and potential consequences.
For a smaller organisation without an internal cyber security team, access to this specialist expertise can be particularly valuable.
Data and System Restoration
A cyber attack can damage, encrypt or delete important information.
Depending on the policy, cyber insurance may contribute towards certain costs associated with restoring data and systems following an insured incident.
However, insurance should work alongside a reliable backup strategy.
Businesses should maintain appropriate backups of the information required to continue operating, such as customer records, accounts, documents, website data and business-critical files.
Business Interruption
One of the most significant consequences of a cyber attack can be an inability to trade normally.
Imagine being unable to access your systems for several days.
Orders might stop, employees could be unable to work, customers may be unable to make payments and important business processes could grind to a halt.
Cyber business interruption cover can provide protection against certain financial losses arising from system downtime following an insured cyber incident.
The extent of cover, waiting periods and maximum indemnity periods will depend on the policy.
Ransomware and Cyber Extortion
Ransomware is malicious software used to encrypt systems or information, often followed by a demand for payment.
Other forms of cyber extortion can involve threats to publish stolen information, disrupt systems or cause reputational damage unless money is paid.
Some cyber insurance policies provide specialist incident response and financial protection relating to cyber extortion.
However, the precise terms can be complicated, particularly where sanctions, legal restrictions or other regulatory considerations apply.
Businesses should never assume that an insurer will simply reimburse any ransom payment made.
Cyber Liability
A cyber incident does not necessarily affect only your own business.
Customers, employees or other organisations could claim that your failure to protect information caused them damage.
Cyber liability insurance can provide protection against certain third-party claims arising from data breaches and other insured cyber events.
Depending on the policy, this may include certain legal defence and compensation costs.
Privacy and Data Protection Costs
Businesses holding personal information have responsibilities concerning how that information is handled and protected.
Following a serious data breach, you may need legal or specialist guidance to determine your obligations.
A cyber policy may provide access to legal advisers experienced in privacy, data protection and cyber incidents.
The precise regulatory expenses that can legally be insured will vary, so businesses should check policy wording carefully.
Crisis Management and Public Relations
A significant cyber attack can become a reputational problem as well as a technical one.
Customers may want to know:
- What Happened?
- Has Their Information Been Stolen?
- Is It Safe to Continue Using Your Business?
- What Are You Doing About the Incident?
Poor communication can make an already difficult situation worse.
Some cyber policies provide access to crisis-management and public-relations specialists who can help businesses manage communications following a major incident.
Cyber Crime and Fraud
Businesses should also consider the financial risks associated with criminals manipulating digital communications.
A common example is business email compromise.
A criminal could gain access to an employee’s email account or impersonate a trusted supplier and send fraudulent bank details.
An employee may then transfer money believing the request is genuine.
Some cyber policies provide protection against specified forms of cyber crime or social engineering, while others exclude these losses or require separate cover.
If fraudulent payments are a particular concern, check the policy carefully.
Phishing Remains a Major Business Risk
Phishing is one of the most common methods criminals use to target organisations.
A phishing message may appear to come from:
- A Bank
- Supplier
- Customer
- Director
- Employee
- Delivery Company
- Government Department
- Online Service Provider
The objective could be to steal passwords, persuade somebody to open malicious software or encourage an employee to transfer money.
Modern phishing attempts can be extremely convincing.
They may use genuine company names, realistic branding and information collected from websites or social media.
This is why cyber security is not solely an IT department responsibility.
Every employee with access to email, business systems or company information can potentially play a role in preventing cyber incidents.
Staff Training Is an Important Part of Cyber Security
Technology can reduce cyber risks, but people remain an important part of any organisation’s security.
Employees should understand how to:
- Recognise Suspicious Emails
- Check Unexpected Payment Requests
- Avoid Opening Unknown Attachments
- Report Suspicious Activity
- Use Strong Passwords
- Protect Login Credentials
- Use Multi-factor Authentication
- Handle Sensitive Information Appropriately
Training should not be treated as a one-off exercise completed when somebody joins the company.
Cyber threats continually change.
Regular reminders and awareness training can help employees recognise new methods used by criminals.
What Security Measures Do Cyber Insurers Expect?
Insurers increasingly want to understand how businesses manage their cyber risk before providing cover.
Questions can vary depending on the size and nature of the organisation.
You may be asked about areas such as:
- Multi-factor Authentication
- Software Updates
- Security Patching
- Backups
- Antivirus and Endpoint Protection
- Email Security
- Firewall Protection
- Access Controls
- Password Policies
- Employee Training
- Remote Working
- Data Encryption
- Incident Response Procedures
- Previous Cyber Incidents
The more sensitive information your business holds and the more heavily it depends on technology, the more detailed the assessment may become.
Why Is Multi-factor Authentication Important?
Multi-factor authentication, often shortened to MFA, adds another layer of security to online accounts.
Instead of relying solely on a password, the user must provide another form of verification.
This could involve:
- An Authentication App
- Security Key
- One-time Code
- Biometric Verification
A stolen password becomes considerably less useful to a criminal if they cannot complete the additional authentication step.
Businesses should consider enabling MFA on important services, particularly:
- Email Accounts
- Cloud Platforms
- Administrator Accounts
- Online Banking
- Remote Access Systems
- Accounting Platforms
Some cyber insurers may also expect particular types of MFA to be in place before providing certain levels of cover.
Keep Software and Systems Updated
Software vulnerabilities can give criminals opportunities to access business systems.
Developers regularly release updates and security patches to address known problems.
Businesses should therefore have a clear process for updating:
- Operating Systems
- Web Browsers
- Business Software
- Servers
- Website Platforms
- Plugins
- Mobile Devices
- Network Equipment
Leaving unsupported or outdated software connected to important business systems can increase your cyber exposure.
Back Up Important Business Data
Imagine losing every important file your business uses tomorrow.
Could you continue operating?
Regular backups can reduce the consequences of hardware failure, accidental deletion, ransomware and other incidents.
Important data could include:
- Customer Information
- Accounts
- Emails
- Documents
- Website Files
- Supplier Information
- Employee Records
- Booking Data
- Business Contacts
Backups should be protected appropriately and businesses should be confident that information can actually be restored when required.
Simply having a backup is not enough if nobody has ever tested whether it works.
Limit Access to Sensitive Information
Not every employee needs access to every system.
Access permissions should reflect what people require to perform their jobs.
For example, an employee responsible for marketing may not need administrator access to financial systems.
Restricting privileges can reduce the amount of information potentially exposed if an individual account is compromised.
Businesses should also remove access promptly when employees leave or change roles.
What Information Will a Cyber Insurer Ask For?
When requesting cyber insurance, you may need to provide information about the size and nature of your organisation.
Questions could cover:
- Annual Turnover
- Number of Employees
- Industry
- Types of Data Held
- Number of Customer Records
- Payment Processing
- Cyber Security Controls
- Previous Cyber Claims
- Software and Systems
- Backup Procedures
- Remote Working
- Third-party Technology Providers
Answer these questions accurately.
Insurers use the information to assess the risk and decide whether they can offer cover, what premium to charge and whether additional conditions are required.
Could Poor Cyber Security Affect an Insurance Claim?
Cyber insurance is not a substitute for maintaining reasonable security.
Your policy may contain conditions relating to the security measures you stated were in place when arranging cover.
For example, if you confirmed that multi-factor authentication was enabled across specified systems, it is important that this remains accurate.
Providing incorrect information when applying for insurance or failing to comply with policy requirements could potentially affect a future claim.
If you make major changes to your IT systems or security practices, discuss them with your insurer or broker where appropriate.
Are Third-party Suppliers a Cyber Risk?
Many businesses outsource important technology.
You might rely on third parties for:
- Cloud Storage
- Payment Processing
- Website Hosting
- Accounting
- Customer Relationship Management
- Payroll
- IT Support
This creates additional dependencies.
Your own systems might remain secure while an important supplier experiences a cyber incident that disrupts your business.
Some cyber policies provide forms of contingent business interruption or dependent business interruption cover relating to specified third parties.
If your business depends heavily on external technology providers, ask whether this type of protection is included.
What Doesn’t Cyber Insurance Cover?
Exclusions vary between policies, but businesses should never assume that every technology-related loss is insured.
Potential restrictions can concern areas such as:
- Known Cyber Incidents
- Pre-existing Problems
- Failure to Maintain Specified Security
- Unauthorised Payments
- Certain Infrastructure Failures
- Contractual Liabilities
- Intellectual Property Claims
- War and Cyber Warfare
- Unsupported Software
- Specific Types of Fraud
Policy wording matters.
If a particular risk concerns you, ask your broker or insurer specifically whether it is covered.
Cyber Insurance for Small Businesses
Smaller organisations sometimes assume that cyber criminals are only interested in major companies.
That is a dangerous assumption.
Small businesses can still hold valuable information, make electronic payments and depend heavily on email and online systems.
They can also have fewer internal resources available to respond when something goes wrong.
A small company may not have an internal:
- IT Department
- Cyber Security Specialist
- Data Protection Team
- Lawyer
- Public Relations Department
One of the potential benefits of specialist cyber insurance is therefore access to experienced professionals when an incident occurs.
Cyber Insurance for Retailers and Physical Businesses
You do not need to operate an online business to have a cyber exposure.
A physical retailer could depend on:
- Electronic Tills
- Card Payments
- Stock Management
- Customer Databases
- Online Banking
- Accounting Software
Similarly, a hotel or restaurant might rely on online reservations, Wi-Fi networks and electronic payment systems.
A cyber incident affecting any of these systems could interrupt normal operations.
Businesses should assess their dependence on technology rather than simply asking whether they consider themselves an “online company”.
Cyber Insurance for Professional Businesses
Professional businesses can hold particularly valuable information.
Accountants, solicitors, financial advisers, consultants and other professional service providers may store confidential client records and regularly exchange documents electronically.
A compromised email account could potentially expose sensitive information or enable criminals to impersonate members of staff.
Cyber protection therefore needs to be considered alongside other forms of insurance such as professional indemnity.
Cyber Insurance Doesn’t Replace Cyber Security
Perhaps the most important point is that insurance and cyber security perform different roles.
Security measures are designed to reduce the likelihood and severity of an attack.
Insurance is designed to help manage some of the financial consequences when an insured incident still occurs.
Businesses need both prevention and preparation.
A sensible cyber risk strategy could include:
- Multi-factor Authentication
- Regular Backups
- Software Updates
- Employee Training
- Strong Access Controls
- Email Protection
- Endpoint Security
- Incident Response Planning
- Appropriate Cyber Insurance
No single measure can eliminate every cyber threat.
Layering different forms of protection makes it harder for one mistake or compromised account to result in a serious business incident.
Review Your Cyber Risk Regularly
Technology changes quickly.
Your business may have significantly different cyber exposure today than it did when you arranged insurance several years ago.
Review your requirements if you:
- Introduce New Software
- Launch an Ecommerce Website
- Employ More People
- Begin Holding More Customer Data
- Change Cloud Providers
- Introduce Remote Working
- Process More Online Payments
- Acquire Another Business
- Expand Into New Markets
Your cyber security and insurance should develop alongside your organisation.
Do You Need Cyber Insurance?
There is no universal cyber insurance policy suitable for every business.
The amount and type of cover you need depends on your reliance on technology, the information you hold and the potential financial consequences of a cyber incident.
Start by asking a simple question:
What would happen to your business if you could not access your computers, email, customer records or essential online systems tomorrow?
If the answer involves lost income, disrupted operations, unhappy customers or significant recovery costs, cyber risk deserves serious consideration.
At West Craven Insurance, we can help you assess your exposure and consider cyber insurance suited to your organisation.
Whether you operate a small local business, professional practice, retailer or larger organisation, our team can discuss the risks you face and the cyber cover available to help protect your business.
Looking for Cyber Insurance?
Cyber threats can affect businesses of every size and in almost every industry.
Contact West Craven Insurance today to discuss your cyber risks and find out more about arranging suitable cyber insurance for your business.
