What is Cyber Insurance?

Cyber Insurance, explained

Cyber insurance policies vary widely, but common coverage includes incident response and forensic investigation, data recovery, legal costs, customer notification, regulatory fines where insurable, business interruption losses, and sometimes payments related to extortion. Some policies cover funds lost to email fraud, while others exclude it or offer it separately.

Insurers increasingly require basic security controls before offering cover, such as multi-factor authentication, tested backups, endpoint detection and response, and staff training. For example, a small accounting firm might be asked to confirm that all email accounts use multi-factor authentication during its application. Businesses should read exclusions carefully, check whether the insurer requires specific response firms, and keep in mind that insurance helps with recovery costs but does not prevent an incident or fully repair reputational damage.