Cyber Insurance for Businesses
Cyber Insurance for Businesses: 7 Real-World Scenarios That Could Cost You Thousands
A single email, a fraudulent payment request or a locked computer system could disrupt your business overnight. But would your existing business insurance cover the cost?
Imagine arriving at work on Monday morning to discover you cannot access your emails, your customer records have disappeared and your accounts system is locked.
Your staff cannot do their jobs. Customers are waiting for orders. Suppliers need paying, and you have no idea how long it will take to get everything back up and running.
Now imagine discovering that the problem started with one employee opening an email that looked completely genuine.
For many business owners, cyber insurance is something they know they probably ought to look at, but it rarely feels as urgent as buildings insurance, public liability or employers’ liability. It is easy to assume that cyber attacks happen to large corporations, banks or technology companies, rather than an ordinary business operating from an office, workshop or high street premises.
The reality is that businesses of all sizes rely on technology to operate, communicate, receive payments and look after their customers. When something goes wrong, the financial consequences can extend well beyond the cost of repairing a computer.
At Greenfield Insurance Brokers, we believe business insurance should be about understanding what could go wrong and making sure you have considered the right protection before you need it. Cyber insurance deserves that same attention.
Why should businesses take cyber insurance seriously?
Cyber incidents are not just an IT problem. They can become a cash-flow problem, a customer service problem, a legal problem and, in some circumstances, a threat to the future of the business itself.
The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses had identified a cyber security breach or attack in the previous 12 months. Phishing remained the most frequently reported type of incident.
That matters because you do not necessarily need an expert hacker targeting your business personally to experience a serious problem. A convincing email, a compromised password or a criminal impersonating a trusted supplier may be enough.
There is also an important difference between having cyber security measures in place and having insurance to respond when those measures are not enough.
Antivirus software, multi-factor authentication, staff training and regular backups all play an important part in reducing risk. But they cannot guarantee that an incident will never happen.
Cyber insurance is designed to help with certain financial losses and the practical response to an insured cyber incident, depending on the policy wording.
It is not simply about paying for stolen data or replacing damaged computers. The right policy may also provide access to specialist incident-response support, legal advice, forensic IT experts and assistance with getting the business operational again.
You may already have cyber cover — but is it enough?
One of the biggest misconceptions about cyber insurance is that businesses either have it or they don’t. In reality, the position can be much more complicated.
The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 47% of businesses reported having some form of cyber insurance. However, only 10% reported having a specific cyber insurance policy, with many businesses relying on cover included within a wider insurance policy.
That raises an important question: if your business already has cyber cover, do you know exactly what it would pay for if something went wrong tomorrow?
Some commercial insurance policies offer limited protection against certain cyber incidents. But having a cyber extension is not necessarily the same as having a dedicated cyber insurance policy designed to respond to the wider financial and operational consequences of an attack.
For example, your existing policy might offer some protection for data restoration but provide no cover for fraudulent payment instructions. It might cover certain data breach costs but offer limited protection if a cyber attack prevents you from trading for a week. Or you might have access to specialist incident-response support under one policy but be unaware that you need to contact the insurer before arranging assistance.
These differences matter because the real cost of a cyber incident often extends well beyond the initial technical problem.
This is why we believe businesses should look beyond the simple question of whether they have cyber insurance. The more important question is whether the protection they have is appropriate for the risks they face.
Before renewing your business insurance, it is worth checking what cyber cover is already included, what exclusions and sub-limits apply, and whether a separate policy could provide more suitable protection.
You don’t necessarily need more insurance. You need to understand what you already have — and identify any gaps that could leave your business exposed.
Seven scenarios that show why cyber insurance matters
The following examples illustrate realistic situations that could affect businesses of different sizes. They are not claims relating to named companies, and whether an insurer would pay depends on the circumstances and the policy wording.
A fraudulent email costs a business thousands of pounds
You receive an email that appears to come from a regular supplier. It explains that the supplier has changed its bank details and asks you to update the payment information before the next invoice is settled.
The email looks genuine. The supplier’s name is correct, the invoice is expected and the payment is made as normal.
Only later do you discover that a criminal has impersonated the supplier and the money has gone into a fraudulent account.
For a small business, losing a substantial payment could cause immediate cash-flow difficulties, particularly if the genuine supplier still expects to be paid.
What insurance might help?
Cyber policies may offer social engineering, invoice manipulation or fraudulent funds transfer cover, depending on the circumstances and the specific wording. Some policies distinguish between money transferred because of deception and money stolen directly from a compromised account.
A commercial crime policy may also be relevant, depending on its terms.
What should you check? Do not assume every cyber policy covers invoice fraud or payment diversion. Check the precise definition of social engineering, the applicable limit, any excess and the conditions that must be met.
Ransomware brings your business to a standstill
A member of staff opens an attachment that appears to be a routine business document. Unbeknown to them, it allows malicious software to enter the company’s network.
By the following morning, your files are encrypted. Your customer database, accounts system and shared documents are inaccessible. A message appears demanding payment to restore access.
Even if you refuse to pay the ransom, you may need specialist IT support to investigate the attack, remove the malicious software and recover your systems.
There may also be concerns about whether customer or employee information has been accessed or stolen.
What insurance might help?
Depending on the wording, cyber insurance may cover specialist incident-response costs, forensic investigations, data restoration and certain ransomware-related expenses. Some policies may also provide access to negotiators or specialist advisers.
Any ransom payment is a separate and particularly sensitive issue. Cover is not automatic, payment may be restricted by policy terms and sanctions requirements, and an insurer’s consent may be necessary.
What should you check? Look beyond the headline ransomware limit. Consider whether the policy pays for investigation, recovery, data restoration and specialist support, and whether those costs reduce the overall limit available for other parts of the claim.
Your business cannot trade for several days
Consider a manufacturing company whose systems are compromised following a cyber attack.
Its staff cannot access production schedules, orders or stock information. Machinery may be perfectly intact, and the premises are undamaged, but the business cannot operate normally until its systems are restored.
Customers experience delays, orders are cancelled and revenue starts to fall.
The business still has wages, rent, finance payments and other overheads to meet.
This is where a cyber incident can become a much larger financial problem than the original technical issue.
What insurance might help?
Cyber business interruption cover may help with insured loss of income or additional costs incurred while the business recovers from a covered incident. The exact calculation depends on the policy wording.
However, cover may be subject to a waiting period, a maximum indemnity period and specific requirements about the cause of the interruption. Some policies may cover interruption caused by a supplier or other third party only if the relevant extension has been purchased.
What should you check? Ask how long the business could realistically survive if its systems were unavailable for several days or weeks. Check the waiting period, the indemnity period, the basis used to calculate the loss and whether interruption caused by a key external IT provider is covered.
Customer information is exposed
A professional services firm discovers that an employee’s email account has been compromised. The attacker has accessed messages containing customer details, confidential documents and personal information.
The business now needs to establish what was accessed, whether information has been copied, which individuals may be affected and what action is required.
There may be regulatory reporting considerations, legal questions, customer communications and reputational consequences.
What insurance might help?
Depending on the policy, cover may include forensic investigations, legal advice, notification expenses, credit or identity monitoring services where appropriate, and specialist public relations support.
A policy may also provide cover for certain data protection claims or regulatory investigations, subject to its terms. Fines and penalties are not automatically insured and may be uninsurable under applicable law.
What should you check? Review the policy’s data breach response arrangements, privacy liability cover, legal support and notification costs. If you hold sensitive customer information, these areas deserve particular attention.
A cyber attack affects a business you depend on
You have invested in protecting your own systems, but your business relies on an external IT provider, cloud platform, payment processor or software supplier.
That supplier suffers a cyber incident. Suddenly, you cannot access the systems you need to process orders, manage bookings or deliver services.
Your own network may not have been hacked at all, but your business is still disrupted.
This is an easily overlooked risk for businesses that rely heavily on outsourced technology.
What insurance might help?
Some cyber policies include dependent business interruption or contingent business interruption cover for losses caused by an insured incident affecting specified third-party providers.
The protection can be narrower than business owners expect. The supplier may need to be a covered provider, and the incident must meet the policy’s requirements.
What should you check? Identify the technology providers your business could not operate without. Ask whether your policy responds if one of those providers suffers an insured cyber event and whether the cover is subject to a separate limit.
A criminal impersonates your business
Imagine discovering that criminals have gained access to your email account and are sending fraudulent payment instructions to your customers.
Your customers may lose money, confidential information may be exposed, and your business must act quickly to regain control of the account and establish what has happened.
Even after the immediate issue has been resolved, customers may question whether they can trust your communications.
What insurance might help?
Cyber insurance may provide incident-response assistance, technical investigation, legal advice and certain liability or crisis-management costs, depending on the circumstances and the policy.
However, you should not assume that every loss suffered by your customers will be covered by your own policy. Liability cover, exclusions, sub-limits and the precise circumstances all matter.
What should you check? Consider whether the policy includes privacy and network security liability, appropriate legal support and help managing the response to a serious incident.
Your business faces a legal claim after a cyber incident
A cyber incident does not always end when your systems are restored.
A customer or business partner may allege that your failure to protect information or maintain network security caused them a loss. You may need legal advice, assistance responding to a claim and potentially financial support for covered defence costs or damages.
For a small business, the cost of dealing with a complex allegation can be significant even before the outcome is known.
What insurance might help?
Cyber liability cover may respond to certain claims involving data breaches, privacy violations or network security failures, subject to the wording.
It is important to distinguish this from general public liability cover. Public liability is not a substitute for specialist cyber protection, and businesses should not assume it will cover cyber-related claims.
What should you check? Look at the policy’s liability sections, defence costs, territorial scope, exclusions and any conditions relating to security standards or incident notification.
What does cyber insurance actually cover?
Cyber insurance is not a single, standardised product. Policies differ between insurers, and the cover selected should reflect the business’s activities, technology, data, suppliers and financial exposure.
When reviewing a cyber insurance policy, I would pay particular attention to the following areas.
Incident response and specialist support
When a cyber incident occurs, knowing who to contact can be just as important as the financial cover itself.
Depending on the policy, access to a specialist response team may include forensic IT experts, legal advisers and other professionals who help establish what happened, contain the incident and plan the recovery.
Check whether the policy provides a 24-hour incident-response helpline and whether you must use insurer-approved specialists.
Data and system restoration
Recovering from a cyber attack can involve restoring files, rebuilding systems and investigating corrupted or inaccessible information.
Some policies cover reasonable and necessary costs to restore or recreate data and systems following a covered event. The extent of cover and the treatment of unrecoverable data vary.
Good backups remain essential. Insurance should complement your recovery plan, not replace it.
Cyber business interruption
This section may cover insured loss of income and certain additional costs when a covered cyber incident interrupts business operations.
Check the waiting period, indemnity period, calculation of loss and whether the policy covers interruption resulting from an incident at an external service provider.
Cyber extortion and ransomware
This may include specialist support and certain costs associated with responding to an extortion demand.
Cover is subject to policy conditions and applicable law. Ransom payments should never be assumed to be covered or automatically appropriate.
Data breach and privacy liability
If personal or confidential information is compromised, a business may face investigation expenses, legal costs or claims from affected parties.
A cyber policy may provide relevant support and cover, subject to its definitions, limits and exclusions. Regulatory fines and penalties require particular care because they are not always insurable.
Social engineering and funds transfer fraud
This is one of the most important areas to examine carefully.
Criminals increasingly exploit trust and impersonation to persuade employees to transfer money or change payment details. But not every policy treats this as a covered cyber loss.
Check the exact wording, the circumstances covered, the limit and any requirements for payment verification or other security controls.
Cyber crime, privacy and network security liability
Depending on the policy, liability cover may help with certain claims arising from a cyber incident, including allegations relating to a data breach or failure of network security.
Look at defence costs as well as potential damages, and establish whether those costs are included within or paid in addition to the main limit.
Reputational support and crisis communications
A serious incident can damage confidence in a business, particularly where customers’ information has been exposed or services have been disrupted.
Some policies offer crisis communications or public relations support. The scope varies, and this should not be confused with a guarantee that lost customers or future revenue will be recovered.
Is cyber insurance worth it for a small business?
It is a question worth asking, particularly if you believe your business is too small to be a target.
Smaller businesses can have fewer resources to call on when something goes wrong. They may rely on a small number of employees, a single accounts system, an external IT provider or one key customer relationship.
If a cyber incident prevents you from invoicing customers, accessing records or delivering work, the impact may be immediate.
That does not mean every business needs the same policy or limit. A business holding sensitive personal information, processing substantial payments or relying on digital systems to trade may have very different requirements from a business with limited digital exposure.
The sensible approach is to assess what an incident could cost your particular business, then compare that exposure with the cover available.
Consider:
- How much income could you lose if you could not trade for a week?
- Could you afford specialist IT support and system recovery at short notice?
- What would happen if money was transferred following a fraudulent instruction?
- Do you hold customer, employee or commercially sensitive information?
- Could a cyber incident involving a supplier stop your operations?
- Do your contracts require you to maintain particular security or insurance arrangements?
Your answers will help determine which covers matter most and whether the limits offered are appropriate.
Does your existing business insurance cover cyber attacks?
This is one of the most important questions to ask before assuming you are protected.
Traditional commercial insurance policies are generally designed to cover specified risks, such as physical damage to property, liability for injury or damage, or other defined business exposures.
A cyber incident may cause financial loss without any physical damage to your premises or equipment. That can make the response under a traditional policy uncertain or restricted.
Some commercial policies offer limited cyber extensions, but these should not be treated as equivalent to a dedicated cyber insurance policy without checking the wording.
Equally, a cyber policy is not a blanket guarantee against every loss involving technology or fraud.
The key is to look at the actual cover, not simply the name of the policy.
A proper insurance review should identify where your existing policies may respond, where restrictions apply and whether a separate cyber policy or additional extension would address a meaningful gap.
How much cyber insurance does your business need?
There is no single limit that is right for every business.
A useful starting point is to consider the worst credible financial impact of a cyber incident. That might include business interruption, specialist response costs, data restoration, legal expenses, liability claims and any relevant fraud exposure.
You should also consider how quickly your business could recover, whether you have reliable offline backups, the sensitivity of the information you hold and how dependent you are on external systems.
Pay attention to sub-limits as well as the headline policy limit. A policy with a seemingly generous overall limit may provide much less for social engineering, ransomware or business interruption.
Premium should be considered, but it should not be the only deciding factor. A cheaper policy that excludes the scenario you are most concerned about may not provide the protection you need.
Five things to do before buying cyber insurance
You do not need to be a cyber security expert to start improving your position.
First, review access to your systems. Use multi-factor authentication where possible, particularly for email, remote access and administrator accounts.
Second, check your backups. Keep secure backups and test that your data can actually be restored. Backups accessible to an attacker may be compromised in the same incident.
Third, introduce payment verification procedures. Independently verify changes to supplier bank details using a trusted telephone number rather than contact details supplied in the request.
Fourth, make sure employees know what to do. Staff should know how to report suspicious emails and who to contact if they believe they have clicked something unsafe.
Finally, read the insurance conditions. Insurers may require particular security measures, impose conditions or restrict cover where specified safeguards are not in place. Make sure you understand what is required before an incident occurs.
Frequently Asked Questions
- What does cyber insurance cover for a business?
Cyber insurance can cover certain costs and losses arising from an insured cyber incident. Depending on the policy, this may include incident response, forensic IT investigations, data restoration, business interruption, cyber extortion, data breach liability and certain fraudulent payment losses. The exact cover, limits, exclusions and conditions vary between insurers. - Do small businesses need cyber insurance?
Small businesses should consider cyber insurance if they rely on email, online banking, customer records, digital systems or external IT providers. An incident could prevent them from trading, disrupt cash flow or expose confidential information. Whether insurance is appropriate depends on the business's individual risks and the protection already in place. - Does standard business insurance cover cyber attacks?
Not necessarily. Traditional commercial policies may contain limited cyber extensions, but they should not be assumed to provide comprehensive cyber protection. Cover depends on the wording of each policy and the nature of the incident. Businesses should review their existing insurance before deciding whether additional cover is needed. - Does cyber insurance cover ransomware?
Some cyber insurance policies cover certain costs associated with ransomware incidents, such as specialist incident response, forensic investigations and data restoration. Some may also address cyber extortion demands, subject to the wording and applicable law. Ransom payments are not automatically covered, and insurers may require prior consent. - Does cyber insurance cover invoice fraud or fraudulent bank transfers?
Some policies offer social engineering, invoice manipulation or fraudulent funds transfer cover. However, these are not interchangeable terms, and cover can depend on exactly how the fraud occurred. Businesses should check the definitions, sub-limits, exclusions and security requirements rather than assuming every fraudulent payment is covered. - Does cyber insurance cover lost income after a cyber attack?
Cyber business interruption cover may compensate for certain insured losses of income and additional costs when a covered cyber incident interrupts business operations. A waiting period, maximum indemnity period and other conditions may apply. Interruption caused by an external supplier may require a specific extension. - How much does cyber insurance cost in the UK?
The cost of cyber insurance depends on factors such as the business's turnover, industry, data held, security measures, claims history, selected limits and cover required. There is no single premium suitable for every business. Comparing the scope of cover and policy conditions is just as important as comparing prices. - Is cyber insurance worth it if my business already has antivirus software?
Cyber security software can reduce the likelihood or impact of certain attacks, but it cannot guarantee that an incident will never occur. Cyber insurance may provide financial protection and specialist response support for covered events. It should complement, rather than replace, appropriate security measures and reliable backups. - What should I look for when choosing cyber insurance?
Look closely at incident response, data restoration, business interruption, ransomware, data breach liability, social engineering and fraudulent funds transfer cover. Check policy limits, sub-limits, waiting periods, exclusions, security conditions and whether you must contact an approved response team. The right policy should reflect the risks your business actually faces.
Quick Summary
Cyber insurance is about keeping your business moving It is easy to view cyber insurance as another expense on the annual renewal list. But the more useful question is this: if your business suffered a serious cyber incident tomorrow, would you know who to call, how you would recover and how you would pay for the disruption? Cyber insurance cannot prevent every attack, and no policy will cover every possible loss. What it can do, when appropriately arranged, is provide a financial safety net and access to specialist support at a time when your business may need both. At Greenfield Insurance Brokers, we believe insurance should be about more than finding a premium. It should be about understanding your business, identifying the risks that matter and arranging cover that responds as you expect it to. If you have not reviewed cyber insurance recently, now is a good time to ask whether your existing arrangements would stand up to a real-world incident. Speak to Greenfield Insurance Brokers about reviewing your business insurance and exploring whether cyber insurance is appropriate for your business.
