Do I need cyber insurance?

Who is most exposed

Any business that uses email and holds customer information can have a cyber incident. The businesses that tend to feel it most are those where one of these is true:

• You hold personal or client data, such as identity documents, health information, tax file numbers or bank details. A breach can mean notification costs, legal advice and complaints.
• Money moves by email, such as invoices, settlements, deposits or supplier payments. A hijacked or spoofed email account can redirect a payment.
• You cannot trade without your systems, for example a practice management system, a point of sale, an online store or a booking platform.
• Clients or contracts ask for it, as some do in professional services, technology and government supply chains.

Small businesses are not too small to be a target. In its Annual Cyber Threat Report 2024–25, ASD reports an average self-reported cost of cybercrime of about $56,600 per report for small businesses, and lists email compromise and business email compromise fraud among the most commonly reported cybercrimes affecting businesses.

What a cyber policy typically covers

Policies differ between insurers, so treat this as a general picture and check your own policy wording.

Your own losses (first party)

• Incident response: IT forensics, legal advice and help managing the incident, often through a panel the insurer arranges.
• Data restoration: the cost of recovering or rebuilding data and systems.
• Business interruption: lost income while your systems are down.
• Cyber extortion: costs of responding to a ransomware or extortion demand, subject to the policy terms and the law.

Claims against you (third party)

• Privacy and network security liability: claims from customers or others affected by a breach of your systems.
• Regulatory defence: costs of responding to a regulator's investigation and, where the law allows them to be insured, some penalties.

Common exclusions

Exclusions vary, but commonly include incidents that started before the policy, failure to maintain security controls you said you had on the proposal, war and infrastructure outages, and physical damage. Losses from someone tricking your staff into paying a fake invoice are often covered only under a specific extension, if at all.

Doesn't my business pack already cover this?

Often only in a limited way. Many business packs exclude cyber losses or include a small sub-limit that does not stretch to incident response, data restoration or lost income. Some cover none of it. The only way to know is to read the policy wording, or ask your broker to show you what is and isn't covered.

What insurers ask for

Proposal forms usually ask about a handful of basic controls, and gaps can affect the price, the excess or whether you are offered cover at all:

• Multi-factor authentication on email, remote access and admin accounts.
• Regular, tested backups, with at least one copy kept offline or unchangeable.
• Prompt patching of software and operating systems.
• Email authentication (DMARC), so others cannot easily send email pretending to be you.

These overlap heavily with ASD's Essential Eight.

A quick self-check

If you answer yes to two or more of these, it is worth a conversation with a broker:

• Would losing your email or main system for a week stop you trading or invoicing?
• Do you store personal information about customers, patients, clients or staff?
• Do you pay or receive significant amounts based on emailed bank details?
• Has a client, contract or tender asked whether you hold cyber cover?
• Would you struggle to pay for IT forensics, legal advice and notifying customers out of cash flow?

If you do decide to get cover, see how much cyber insurance costs in Australia.