Decoding Cyber Insurance: What Policies Really Cover (and What They Don’t)

Zac Tassone

Published 15 July 2025 · Updated 22 October 2026

Cyber insurance can be the difference between a bad week and losing the business after a cyber attack. But policies vary a lot, and many claims run into trouble over exclusions or answers on the application form. This guide explains, in plain English, what policies usually cover, what they often don’t, and how to avoid surprises.

This is general information, not legal or insurance advice. Always read your own policy and talk to your broker.

What cyber insurance usually covers

Costs to your own business (first-party)

• Incident response: specialists to contain the attack and work out what happened
• Data and system recovery: restoring files, rebuilding systems and removing malware
• Business interruption: lost income while you can’t trade, usually after a waiting period
• Notification costs: telling affected customers and providing support such as credit monitoring
• Cyber extortion: handling ransomware demands, where the policy and the law allow
• Legal and public relations advice

Claims made against you (third-party)

• Claims from clients or partners whose data was exposed
• Defence costs for privacy investigations, and some penalties where they are legally insurable

What is often excluded or limited

• Security controls you said you had but didn’t. If the application says MFA is on everywhere and it wasn’t, the insurer may refuse or reduce the claim.
• Known, unpatched vulnerabilities left unfixed for a long time
• Payment redirection and invoice fraud, where staff are tricked into paying a fake account. This is often limited or needs extra cover.
• Incidents that started before the policy began
• Upgrades: the policy restores what you had, not better systems
• War and state-sponsored attacks, under wording that varies between insurers
• Your own lost funds, such as money stolen from your bank account, unless specifically covered

The application form matters more than you think

Insurers now ask detailed questions:

• Is MFA on email, remote access and admin accounts?
• Are backups offline or immutable, and tested?
• Are devices patched and protected by endpoint security?
• Do staff get phishing training?

Answer accurately, keep evidence, and tell your broker if things change. The ASD Essential Eight covers most of what insurers look for.

Australian rules to know

• Notifiable Data Breaches scheme: businesses covered by the Privacy Act, generally those with turnover over $3 million plus health service providers and some others, must notify the OAIC and affected people about eligible data breaches.
• Ransomware payment reporting: businesses with annual turnover over $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.

How to get the most from your policy

1. Read the exclusions and the definitions of “cyber event” and “business interruption”.
2. Check whether invoice fraud and social engineering are covered, and up to what limit.
3. Know the insurer’s incident hotline. Many require you to call them first and use their response team.
4. Make the security answers on your application true, and keep them true.
5. Keep a simple incident plan that says who calls the insurer, your IT provider and your broker.

Is cyber already covered by your other policies?

Many business owners assume their business pack or public liability policy covers a cyber attack. Usually it does not, or only to a very limited degree. Some management liability policies include a small amount of cyber cover, and some banks offer limited fraud protection, but neither normally pays for incident response, data recovery or lost income. Ask your broker to show you, in writing, which policy would respond to a ransomware attack, a hacked mailbox and a fake invoice paid by mistake.

What happens when you make a claim

1. Call the insurer’s incident hotline first. Most policies expect you to notify them straight away, and some only cover costs from their approved response providers.
2. The insurer appoints specialists. This usually includes incident response, forensic investigators and sometimes lawyers to manage breach notification.
3. Preserve the evidence. Don’t wipe or rebuild affected computers until the investigators say so. Evidence often decides how the claim is assessed.
4. Work with your IT provider. Your provider restores systems and data, ideally from tested backups, in coordination with the insurer’s team.
5. Business interruption is calculated. Lost income is assessed after the waiting period in your policy, so good financial records make this faster.

Documents worth keeping ready

Insurers and investigators ask for evidence, and it is much easier to produce it before an incident than during one. Keep these up to date:

• A report showing MFA is enabled for all users and admin accounts
• Records of backup tests and successful restores
• Patch and update reports for computers and servers
• A list of your devices, systems and key software
• Staff security awareness training records
• Your incident response plan, with contact details for your IT provider, broker and insurer

Common questions

Does cyber insurance pay ransoms?

Some policies cover extortion costs where the law allows, but paying a ransom does not guarantee you get your data back or that stolen data is deleted. Larger businesses must also report ransomware payments to the Australian Signals Directorate. Most insurers would much rather you recover from backups, which is another reason to test them regularly.

Is cyber insurance worth it for a small business?

That depends on how much your business relies on its systems and data. A simple test is to estimate what a week without email, files and accounting software would cost you, plus the cost of notifying clients. Even if you decide against a policy, working through an insurer’s application is a useful check of your security.

Will having a managed IT provider lower my premium?

Premiums are set by insurers, so there is no guarantee. What a good provider can do is put the controls insurers ask about in place, keep them running and give you the evidence to answer the questions accurately, which makes cover easier to get and claims less likely to be disputed.

Insurer asking about your security controls? Our managed IT security services put MFA, backups and Essential Eight controls in place and document them.