Cyber insurance: understand risks and policy boundaries
Cyber insurance is not one uniform package. Private online problems and business data or liability risks need different cover. Clarify the insured area, specific events and incident coordination before comparing annual premiums.
Separate private and business protection
Private policies may cover online fraud, identity misuse, shopping or IT help. Businesses also need to consider restoration costs, interruption and third-party claims. These areas are not interchangeable. Check who is insured and whether professional activities are excluded from a private policy.
| Need | Contract question |
|---|---|
| Private online activity | Insured people, accounts and events |
| Business own loss | Restoration, interruption and extra costs |
| Business liability | Covered third-party claims and defence |
Check events rather than marketing labels
Data loss, encrypted systems and manipulated payments are different losses. Social engineering, mistaken transfers and cloud-provider outages may have separate definitions, exclusions or add-ons. Have important situations mapped explicitly to the policy. General cyber cover guarantees neither every refund nor complete data recovery.
Explain a business’s digital dependencies
State the industry, IT-user count, approximate turnover and important processes such as a webshop, production or customer records. A shutdown differs from one locked mailbox. Check waiting periods, indemnity duration, extra costs and covered external-provider risks. Do not share customer datasets or credentials.
Match security measures to obligations
Backups, multi-factor login and updated systems do not replace insurance but remain important protection. Policies can impose specific security and reporting duties. Check whether existing procedures satisfy them and which changes must be reported. A specialist can assess unknown technical points later; you need not diagnose your security yourself.
Compare premiums, limits and your own share
Compare quotes for the same risks and insured people or businesses. Beyond the annual premium, check the excess, annual maximum and sublimits. Business interruption can also involve a time-based share borne by you. A large overall limit means little if the benefit you need is much narrower.
| Cost item | What to compare? |
|---|---|
| Annual premium | Same scope and insured area |
| Excess | Money amount and any time-based share |
| Sublimits | By benefit and insurance year |
Identify the right route during an active incident
A new quote enquiry is not an emergency report and does not confirm retroactive cover. During an active incident, contact the existing insurer and qualified IT support. Coordinate reporting and paid interventions with the responsible parties. Legal notifications and preservation of evidence require separate consideration.
Enquiry checklist
Clarify private or business needs, important online services and desired risks. For a business, prepare user numbers, a turnover band and existing safeguards. Later compare events, limits, waiting periods, duties and overlaps with other policies. Keep passwords, banking details and sensitive content out of the enquiry.
From needs to a suitable contract review
First describe the area without uploading technical logs. Then discuss concrete cover and outstanding security questions with providers. Obtain written confirmation of scope, start and exclusions before taking out a contract. Prevention, incident assistance and financial compensation are distinct comparison points.
Frequently asked questions
Does insurance replace backups?
No. Safeguards remain important and can be a contractual requirement. Check the specific duties.
Does a private policy also suit my business?
Not automatically. Professional risks, interruption and business liability need a suitable business assessment.
Are fraudulent transfers always covered?
No. Check payment manipulation and social engineering against their exclusions and sublimits.
Must I assess my IT system myself?
No. Describe known procedures and safeguards. Specialists can assess technical uncertainties later.
Can an already known incident be newly insured?
Do not assume retroactive cover. Report the incident to the existing insurer and arrange help separately.
Does the enquiry need passwords or banking details?
No. Provide only the area, desired risks and known basic facts. Credentials and sensitive files are unnecessary.
