Cyber insurance is becoming a standard requirement for UK businesses, but many owners misunderstand what it actually does.

What cyber insurance does cover

  • Incident response
  • Legal support
  • Data recovery
  • Customer notification
  • Some ransomware costs

What it doesn’t do

  • Prevent attacks
  • Replace lost customers
  • Fix reputational damage
  • Cover everything if you ignored basic security

Insurers increasingly require:

  • MFA
  • Regular patching
  • Backups
  • Endpoint protection
  • Staff training

If you can’t prove these, they may refuse to pay out.

Insurance is a safety net, not a strategy

Think of cyber insurance like car insurance: useful when things go wrong, but it won’t stop you crashing.