What this covers
Cyber insurance responds to the costs and disruption that follow a cyber incident — from a data breach involving customer information to ransomware locking you out of your own systems. It's designed to support your business through the incident itself and the fallout that follows.
Who should consider it
Every business should consider its exposure to cyber risk. Cyber incidents can affect any organisation that uses email, online banking, cloud systems, digital records, connected devices or third-party technology providers — the scale and type of cover that's relevant depends on how your business operates and how disruptive an incident could be.
What it may cover
Costs to investigate and respond to a breach
Business interruption while systems are restored
Notification costs where affected parties must be informed
Liability arising from a breach of customer or third-party data
Cyber extortion and ransomware response costs
Examples of situations that may lead to a claim
A ransomware attack locks staff out of core systems for several days
A phishing incident results in unauthorised transfer of funds
A data breach exposes customer records, triggering notification obligations
A supplier's system failure disrupts your own operations
Important considerations
No two Cyber insurance policies are the same. Some coverage areas — such as social engineering losses — are optional add-ons rather than automatic inclusions, and elements like business interruption cover and indemnity periods can vary between insurers. This is exactly the kind of detail we work through with you, so your policy actually matches how your business operates.
Questions We Get Asked
1. Should every business consider Cyber insurance?
Yes. A cyber incident can affect businesses of any size that use email, digital systems, online payments, customer data or third-party technology providers — whether Cyber insurance is appropriate, and what cover may be relevant, depends on how your business actually operates.
2. What's commonly excluded from Cyber insurance?
Exclusions vary by insurer, but can include losses from an incident already known about before cover started, and losses linked to a failure to maintain basic security measures agreed as a condition of cover. It's worth checking the specific exclusions that apply to your policy.
3. If I pay a ransomware demand, do I need to report it?
Yes, in many cases. Australian businesses with annual turnover of $3 million or more have a legal obligation to report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours, regardless of what your policy covers. ASD also advises against paying ransom demands.