A fraudulent payment request sent from a trusted supplier’s email address can move thousands of pounds or euros before anyone spots the warning signs. A ransomware attack can stop staff accessing customer records, accounting systems and shared files for days. This small business cyber insurance guide explains where insurance can help, where it cannot, and how to choose cover that supports a realistic recovery plan.
For SMEs, cyber insurance is not a substitute for managed security, reliable backups or trained staff. It is a financial safety net for the costs and disruption that can follow an incident. The policy only works as intended when the information given to the insurer is accurate and the security controls promised during the application remain in place.
What cyber insurance can cover
Cyber insurance policies vary significantly, but they commonly combine first-party costs – the costs your own business incurs – with third-party liability arising from a breach or system failure.
First-party cover may pay for specialist incident response, forensic investigation, legal advice, customer notification and credit monitoring where appropriate. Depending on the policy, it can also contribute towards data restoration, business interruption losses, crisis communications and cyber extortion response. These are the expenses that can build quickly while the business is trying to get operational again.
Third-party cover can help when a customer, supplier or other party alleges that your business failed to protect information or systems. It may cover legal defence costs, settlements and certain regulatory investigation costs, subject to the terms, limits and applicable law. For an Irish business handling personal data, the ability to access specialist legal and breach-response support can be as valuable as the financial payment itself.
Do not assume every loss connected with a cyber incident is covered. A policy is a contract with defined triggers, sub-limits and exclusions. The detail matters far more than a headline such as “comprehensive cyber cover”.
A small business cyber insurance guide to policy limits
The right level of cover depends on how your business operates, not simply on turnover or headcount. A ten-person firm that processes customer payment details, relies on cloud systems all day and has contractual obligations to clients may face greater exposure than a larger business with limited digital records.
Start by considering the costs of a serious interruption. How much gross profit could be lost if core systems were unavailable for five working days? Would staff still need to be paid? Could you continue serving customers manually, or would operations stop completely? Then consider the likely cost of external experts, data recovery, legal support and customer communication.
Pay close attention to the business interruption waiting period. This is the period of disruption you must absorb before the policy begins paying for lost income. Also check whether the policy covers an outage at a key cloud, software or managed service provider. If your business depends on Microsoft 365, a line-of-business application, online bookings or hosted telephony, contingent business interruption cover may be relevant.
Sub-limits deserve the same scrutiny. A policy may have a healthy overall limit but a much smaller amount available for ransomware response, social engineering fraud, notification costs or regulatory defence. Ask your broker or insurer to explain these figures in plain terms and compare them against your likely exposure.
Understand the exclusions before you need to claim
Cyber policies are designed to respond to specific events, not every technology problem. General wear and tear, pre-existing issues, planned system upgrades and losses caused by poor commercial decisions will not usually be insured. There may also be exclusions related to war, sanctions, deliberate acts, contractual liabilities or failures by suppliers.
Social engineering and invoice fraud require particular attention. A criminal may impersonate a director, supplier or customer and persuade an employee to change bank details or authorise a payment. Some policies provide cover, but the protection may be limited and conditional on following defined payment-verification procedures. A verbal callback to a known telephone number, dual approval for high-value payments and clear supplier-change controls are practical safeguards.
Fines and penalties are another area where assumptions can be costly. Whether a policy can cover a regulatory fine may depend on the circumstances and whether cover is legally permitted. It is safer to focus on the response costs a policy can provide, while maintaining strong data protection and security practices to reduce the chance of enforcement action.
Security controls insurers increasingly expect
Insurers assess cyber risk much more closely than they once did. Applications often ask direct questions about multi-factor authentication, backups, patching, endpoint protection and payment controls. Inaccurate answers can jeopardise a claim, while a control that is switched on for the application and later neglected may create a serious problem.
Most SMEs should be able to demonstrate the following controls:
- Multi-factor authentication for email, remote access, cloud administration and other critical systems.
- Managed patching for operating systems, applications, firewalls and network equipment.
- Endpoint security that is actively monitored, rather than simply installed and forgotten.
- Tested, protected backups that can restore critical data and systems after ransomware or accidental deletion.
- Restricted administrator access, with separate privileged accounts and prompt removal of access when staff leave.
- Staff awareness training and a clear process for reporting suspicious emails, calls and payment requests.
The exact requirements depend on the insurer and the business. A retailer with card payments, a professional services firm with confidential client files and a manufacturer with connected operational technology will have different priorities. However, multi-factor authentication and recoverable backups are now baseline expectations for most organisations.
Build insurance into your incident response plan
When an attack is underway, time is expensive. Staff may be tempted to reset accounts, delete suspicious files or restore systems immediately. Those actions can be necessary, but they can also destroy evidence or conflict with the insurer’s preferred incident-response process.
Keep the policy details, emergency contact number and claims procedure available away from your main systems. Identify who can notify the insurer and who has authority to make decisions during an incident. Your plan should also set out how staff report suspected phishing, who contacts key customers and suppliers, and how the business will communicate if email or phones are unavailable.
If the policy includes access to an incident-response panel, use it promptly. Cyber insurers often appoint forensic specialists, solicitors and communications advisers who understand the claims process. Bringing in unapproved external suppliers before notifying the insurer may affect whether their costs are reimbursed, except where urgent action is needed to prevent immediate harm.
A tested recovery plan makes this process far less stressful. Restore tests reveal whether backups are complete, whether systems can be recovered within an acceptable period and whether staff know their roles. Insurance can fund elements of recovery, but it cannot recreate data that was never backed up or replace decisions that were not prepared in advance.
Questions to ask before buying or renewing
Before signing a policy, ask what events trigger cover, which security controls are conditions of cover, and whether supplier outages are included. Confirm the limits and sub-limits for ransomware, fraud, business interruption and professional fees. Ask how the insurer calculates business interruption losses, how long the waiting period is, and whether the policy covers the full period needed to restore normal trading.
It is also worth asking what support is available outside normal working hours. An incident at 7pm on a Friday should not become a weekend of uncertainty because no one knows who to call. For Dublin SMEs with limited internal IT resources, a managed IT partner can help maintain the controls insurers expect, document the environment and coordinate technical recovery alongside the insurer’s response team.
Host-It sees cyber resilience as a combination of prevention, recovery and clear accountability. Cyber insurance belongs in that combination, alongside managed security, reliable backups and practical staff procedures.
The best time to read the small print is when systems are working, staff are calm and you still have choices. Put the right controls in place, test how you would recover, and choose insurance that supports the way your business actually runs.
