All businesses now have some online exposure, whether via their website, emails or payment gateways. Cyber insurance is designed to protect businesses against the financial and reputational damages arising from cyber incidents.

Incidents such as data breaches, cyber-attacks, and other cyber-related threats are generally covered within a cyber insurance policy.

Since the early 1990s, cyber insurance has evolved from basic cover for hacking and data breaches to comprehensive policies covering a wide range of cyber risks, including for both damage to a business and its customers.

As the world evolves, insurers must continually update their offerings to ensure maximum protection. The introduction of ‘active insurance’, which incorporates cyber risk scanning, is a positive step forward for insurers to understand a business’s overall risk profile better.

Stand-alone cyber insurance policies will generally provide coverage for both first-party losses (the business’s exposure) and third-party losses (their customers).

Extensions to existing policies, such as professional indemnity and management liability insurance, often only provide limited cyber coverage, such as third-party only cover.

A cyber insurance policy is a fantastic addition to a business’s insurance program to maximise its protection.

‘Static’ cyber insurance refers to traditional insurance coverage obtained via completing a proposal form, with an insurer assessing the risk based on the information within the form.

‘Active’ cyber insurance involves additional risk monitoring services such as live cyber risk scanning. These insurers also generally provide an ongoing scanning and monitoring service for their clients, which overall is a more dynamic approach to cyber risk management.

All insurers have their individual underwriting guidelines and acceptance criteria. Those who provide upfront scanning services can generally obtain a better understanding of a business’s overall cyber risk profile. Suppose negative items come up within the scan. In that case, this may limit their ability to offer coverage either partially or in full.

On the other hand, insurers that rely solely on completed submissions from clients can miss, overlook or disregard information that they could have otherwise obtained in a scan. Some insurers put greater value into a comprehensive client submission where they can underwrite it more specifically.

Each business, therefore, is different. Some ‘active’ insurance policies may be more expensive than ‘static’ insurance policies; however, for the next client, this could be the other way around.

Working with an insurance broker who really understands cyber insurance is key, as they can work with insurers that best suit your business requirements to obtain the more suitable solution for your business.

Cyber insurance policies typically cover risks such as:

• Data breaches
• Cyber extortion and/or ransomware
• Business interruption due to cyber-attacks
• Data restoration costs
• Legal fees
• Customer or regulatory notification costs
• Regulatory fines & penalties

Each cyber policy is different and uses varied language. Working with an expert will allow you to compare covers across multiple insurers best.

Third-party coverage protects against claims made by external parties affected by a cyber event due to the insured’s actions or failure to act, covering:

• Privacy Breach Liability
• Media Liability (copyright infringement, defamation, etc., from electronic content)
• Computer Virus Transmission & Hacking
• Regulatory Defence & Penalties imposed by Regulatory bodies

Webber Insurance has been working closely with SME businesses for many years to protect their cyber risk. We have access to many different insurance providers, and we have a good understanding of who should be able to assist with coverage.

As a new client, the choice is yours as a starting point. You can opt to speak with one of our brokers up front, or you can complete our cyber insurance proposal form online.

We have multiple partners who can conduct vulnerability scans for your business. These scans can be done either before or after we receive a completed proposal form.

Once we have the required information, we will submit it to our insurer partners and await their feedback. Once all information is received, it is collated and sent back to you.

Generally, then a further conversation will take place to discuss this information so that you can better understand what you will be covered for.

Coverage can then be finalised on your behalf. This process can take as little as a few hours to multiple weeks, depending on the complexity of your business.

Insurers can engage a range of specialists to assist a business in recovering from a cyber loss, including:

• Cybersecurity Specialists
• Forensic Investigators
• Legal Experts
• Crisis Management and Public Relations Firms
• Regulatory Compliance Consultants
• Identity Theft and Credit Monitoring Services
• Ransom Negotiators
• Data Recovery Specialists
• Cyber Risk Management Consultants

Cyber insurance can cover direct costs relating to a data breach, including legal fees, notification costs, and indirect costs such as business interruption. Having this cover in place helps alleviate the financial burden.

Businesses need to understand their requirements around mandatory notification of data breaches and what types of SME’s are required to notify a breach.

Yes, cyber insurance can cover ransom payments; however, it is important to note that there is no hard and fast rule. Each incident is treated on its merits by the insurer and their claims team.

There are times when a ransom cannot be paid. When insurance is not involved, business owners and/or directors need to understand these limitations, which include money laundering, hacking or terrorist group funding or breaching the Corporations Act 2001 (Cth).

Implementing cybersecurity measures is good risk management with an aim to prevent incidents from occurring.

Cyber insurance provides a financial and support safety net when an incident occurs to have the support in place to get your business back on track.

Most cyber insurers want to work with your IT team to ensure that it is a complementary approach rather than a conflicting approach.

Each insurer also has minimum cyber security measures it requires from a business prior to cover being placed. In the instance where a business fails to meet these requirements, it will be your IT team that has the responsibility to get you up to the required standard.