Decoding Cyber Insurance: What Policies Really Cover (and What They Don’t)
Cyber insurance can be the difference between a bad week and losing the business after a cyber attack. But policies vary a lot, and many claims run into trouble over exclusions or answers on the application form. This guide explains, in plain English, what policies usually cover, what they often don’t, and how to avoid surprises.
This is general information, not legal or insurance advice. Always read your own policy and talk to your broker.
What cyber insurance usually covers
Costs to your own business (first-party)
- Incident response: specialists to contain the attack and work out what happened
- Data and system recovery: restoring files, rebuilding systems and removing malware
- Business interruption: lost income while you can’t trade, usually after a waiting period
- Notification costs: telling affected customers and providing support such as credit monitoring
- Cyber extortion: handling ransomware demands, where the policy and the law allow
- Legal and public relations advice
Claims made against you (third-party)
- Claims from clients or partners whose data was exposed
- Defence costs for privacy investigations, and some penalties where they are legally insurable
What is often excluded or limited
- Security controls you said you had but didn’t. If the application says MFA is on everywhere and it wasn’t, the insurer may refuse or reduce the claim.
- Known, unpatched vulnerabilities left unfixed for a long time
- Payment redirection and invoice fraud, where staff are tricked into paying a fake account. This is often limited or needs extra cover.
- Incidents that started before the policy began
- Upgrades: the policy restores what you had, not better systems
- War and state-sponsored attacks, under wording that varies between insurers
- Your own lost funds, such as money stolen from your bank account, unless specifically covered
The application form matters more than you think
Insurers now ask detailed questions:
- Is MFA on email, remote access and admin accounts?
- Are backups offline or immutable, and tested?
- Are devices patched and protected by endpoint security?
- Do staff get phishing training?
Answer accurately, keep evidence, and tell your broker if things change. The ASD Essential Eight covers most of what insurers look for.
Australian rules to know
- Notifiable Data Breaches scheme: businesses covered by the Privacy Act, generally those with turnover over $3 million plus health service providers and some others, must notify the OAIC and affected people about eligible data breaches.
- Ransomware payment reporting: businesses with annual turnover over $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
How to get the most from your policy
- Read the exclusions and the definitions of “cyber event” and “business interruption”.
- Check whether invoice fraud and social engineering are covered, and up to what limit.
- Know the insurer’s incident hotline. Many require you to call them first and use their response team.
- Make the security answers on your application true, and keep them true.
- Keep a simple incident plan that says who calls the insurer, your IT provider and your broker.
Filling in a cyber insurance questionnaire?
We help Sydney businesses put the right controls in place and answer insurer questions accurately, so a claim isn’t refused over a technicality.
Or call 1300 133 770.
