Getting Cyber Insurance For The First Time

This is one of the most common and costly assumptions we encounter. General liability policies are built around physical harm and property damage, and many contain explicit exclusions for cyber events. Property insurance covers tangible assets, but corrupted or stolen data is rarely treated as insurable property under a traditional policy. We routinely review existing coverage as part of our process, so you know exactly where your gaps are before a breach forces the issue.

You will need basic details about your business operations, annual revenue and an overview of your security measures. The level of IT detail required varies depending on the size of your business, but the process is more straightforward than most people expect. We will guide you through the whole application and make sure everything is completed accurately.

Social engineering and phishing scams, where an employee is manipulated into transferring funds, sharing credentials, or handing over sensitive data to a fraudster, are among the most common and costly threats businesses face today. We treat this coverage as a priority when placing any policy, and in the vast majority of cases we are able to secure it as standard. Where we can’t, we will always be upfront with you about the gap and what your options are.

This is known as supply chain or third-party dependency risk, and it is an area that catches many businesses off guard. If a supplier you rely on suffers a cyber attack and their systems go down, the knock-on effect to your own operations can be just as damaging as a direct attack on your business. We treat this coverage as a priority when placing any policy, and in the vast majority of cases we are able to secure it as standard. Where we can’t, we will always be upfront with you about the gap and what your options are.

An MSP manages your systems; it does not absorb your liability. If customer data is compromised, even through a failure on the MSP’s side, your business can still face regulatory fines, legal claims, and significant recovery costs. We make sure the policies we recommend cover your organisation directly, and we will always encourage you to be clear on what security responsibilities your MSP has formally accepted and whether they carry their own cyber liability insurance. Knowing where their responsibility ends and yours begins is an important part of understanding your overall risk.

If you have insurance, you do not panic. The first thing you do is call the 24/7 breach response line that comes with every policy we place. From that moment, you have immediate access to a dedicated incident response team including IT forensic specialists to identify and contain the attack, legal counsel to guide you through notification and regulatory obligations, and public relations support to help manage reputational damage. We only work with underwriters who provide this around-the-clock response capability, because a breach does not wait for business hours and neither should your insurer.

NO – you are the ideal target. According to Cisco, 70% of cyber attackers deliberately target small businesses, largely because they tend to have fewer defences in place than larger enterprises. Many smaller businesses still operate with the belief that they are too small to matter, and that assumption runs directly counter to how attackers actually operate. Perhaps most alarmingly, 60% of small businesses that suffer a cyberattack close their doors within six months. Part of our role is making sure you have the right level of cover for your actual risk profile, not a scaled-down policy based on the false assumption that your size makes you invisible.

Your exposure may be lower without PII, but it is far from zero. Even if you hold no sensitive data at all, your business still depends on its systems to function. If those systems are taken down, you may not be able to trade, pay staff, or fulfil orders until they are restored. Ransomware criminals aren’t selecting targets based on the type of data they hold; they are looking for businesses that depend on their systems and will pay to get them back. When we assess your needs, we look at the full picture, not just the regulatory angle.

Understanding this distinction is essential before committing to any policy. First-party coverage pays for your own direct losses, such as restoring lost data, replacing damaged systems, and recovering income while your operations are down. Third-party coverage protects you from claims made against your business by clients, partners, or regulators following a breach. When we review policies on your behalf, we make sure both are adequately covered and that the limits on each actually reflect the scale of your business.