What Cyber Insurance Covers and What It Doesn't

Cyber insurance is a strange product. It's sold as a safety net, but whether it actually catches you depends on fine print most business owners have never read, and on promises you made about your security when you filled in the application form. Get either wrong and the net has a hole exactly where you land.

This isn't financial advice, and every policy is different, so read yours with your broker. But here's how these policies generally work, where they tend to fall short, and the Australian rules that now affect them.

Why it's worth thinking about at all

Start with the size of the bill. In the ASD's latest annual cyber threat report, the average self-reported cost of cybercrime was about $56,600 per report for small businesses, $97,200 for medium businesses and $202,700 for large ones. Those are averages; a serious ransomware incident can cost far more once you add downtime.

Now do the sum a small business actually faces. Say you turn over $3 million a year with ten staff. A week offline costs you roughly 2 per cent of annual revenue, about $58,000, before anyone has paid for forensic investigators, lawyers, notification letters or rebuilt servers. For many small businesses, that's the difference between a bad quarter and closing. Insurance exists to turn that cliff into a bump.

What cyber insurance typically covers

Most policies are split into two halves.

First-party cover: your own costs

• Incident response. Forensic investigators to work out what happened, legal advice, and often access to a 24/7 breach response hotline. This is arguably the most valuable part, because it gets experts on the phone in the first hours.
• Business interruption. Lost profit while systems are down, usually after a waiting period of several hours.
• Data restoration. The cost of recovering or recreating data and rebuilding systems.
• Notification and support. Contacting affected customers, credit monitoring or identity support, and call centres.
• Cyber extortion. Negotiation, and in some policies the ransom itself, where it's lawful to pay.
• Reputation management. Public relations help after a public incident.

Third-party cover: claims against you

• Privacy and network liability. Defence costs and damages if customers, partners or others claim your breach harmed them.
• Regulatory investigations. Costs of responding to a regulator such as the OAIC.
• Media liability. Claims arising from content you publish online, in some policies.

What policies commonly exclude or limit

This is where claims go wrong. Exclusions vary, but these come up again and again.

1. Not doing what you said you'd do

Application forms ask direct questions. Do you enforce MFA on email and remote access? Do you back up offline and test restores? Do you patch critical vulnerabilities promptly? Answering "yes" when the honest answer was "mostly" is a serious problem. If an investigation after a breach shows MFA wasn't on the account that got compromised, the insurer may argue misrepresentation and reduce or deny the claim.

The fix is simple and dull: make sure every security statement on the form is true, and keep evidence. A cyber security assessment before renewal gives you both.

2. Social engineering and payment fraud

Many business owners assume "cyber" covers a staff member being tricked into paying a fake invoice. Often it doesn't, or only up to a small sublimit, because the staff member authorised the transfer themselves. Business email compromise is one of the most common cybercrimes in Australia, so check exactly how your policy treats it, and whether it needs an extra endorsement. Our articles on deepfake CEO scams and conveyancing payment fraud show why it matters.

3. War and state-backed attacks

Since 31 March 2023, Lloyd's of London has required standalone cyber policies written in its market to exclude losses from certain state-backed cyber attacks. The wording varies, and attribution is notoriously messy, but it means a "nation-state" attack isn't automatically covered.

4. Upgrades, or "betterment"

Policies generally pay to restore systems to how they were, not to improve them. If the server that got encrypted was ten years old, don't expect the insurer to fund a modern replacement.

5. Problems you already knew about

Incidents that started before the policy began, or that you were aware of and didn't disclose, are typically excluded. An attacker who got in last year and triggers ransomware next month may fall into this gap.

6. Fines and penalties

Some fines and penalties can't legally be insured, and many policies exclude them or cover them only where the law allows. The Privacy Act's maximum penalty for serious interferences with privacy is now the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, so check this clause rather than assume.

7. Hardware and lost value

Physical damage, the cost of your own staff's overtime, future lost customers and a drop in business value are often limited or excluded.

Australian rules that now affect a claim

Two newer obligations sit alongside any policy.

Ransomware payment reporting. Since 30 May 2025, under the Cyber Security Act 2024, businesses with annual turnover over $3 million must report a ransomware or cyber extortion payment to the ASD within 72 hours. That applies even if your insurer or a negotiator makes the payment on your behalf.

Sanctions. Australia has imposed cyber sanctions on individuals linked to major attacks, including a Russian national over the Medibank breach. Paying a sanctioned person can be a criminal offence, so an insurer won't fund a ransom until that's been checked.

And separately from insurance, if personal information is involved, the OAIC's Notifiable Data Breaches scheme may require you to notify affected people and the regulator. Our guide to what to do after a breach notice covers the other side of that.

How to choose a policy, and make it pay out

• Use a broker who knows cyber. Ask them to walk you through the exclusions and sublimits, not just the headline limit.
• Check the social engineering cover. If you pay suppliers by bank transfer, this probably matters more than anything else.
• Know the claim process before you need it. Most policies require you to notify the insurer quickly and use their approved incident response firms. Calling your own forensic team first can affect what's covered.
• Make the security answers true. MFA everywhere, tested backups, patching, endpoint protection. The Essential Eight is the natural Australian benchmark, and most underwriting questions map to it.
• Keep evidence. Screenshots of MFA policies, backup test reports and patch compliance dashboards make renewal faster and claims smoother.

Here's the slightly awkward truth. The businesses that find cyber insurance easiest to buy, and cheapest, are the ones least likely to need it, because insurers price on how well you're protected. It's a bit like a lender who only wants to lend to people with money. Still, that works in your favour: the same controls that lower your premium lower your risk. Our managed IT and managed backup services are built to tick those boxes honestly, and we're happy to help clients fill in the security section of an application.

Frequently asked questions

Does cyber insurance cover ransomware?

Most policies cover ransomware response costs such as forensics, data restoration and business interruption, and some cover the ransom where payment is lawful. Cover can be reduced if the insurer finds you didn't maintain the security controls you declared, such as MFA or backups.

Does cyber insurance cover business email compromise?

Not always. Fraudulent payments authorised by your own staff are often excluded or covered only to a small sublimit under social engineering or funds transfer fraud cover. Check your policy wording and ask your broker specifically.

Is cyber insurance worth it for a small business in Australia?

For many it is, particularly for the incident response support and business interruption cover. Weigh the premium against a week or more of lost revenue plus investigation and recovery costs, and make sure the exclusions fit how your business actually operates.

Do I have to report a ransomware payment in Australia?

Yes, if your business turned over more than $3 million in the previous financial year or is a critical infrastructure entity. The payment must be reported to the ASD within 72 hours under the Cyber Security Act 2024, even if a third party paid on your behalf.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Renewing your cyber policy and not sure every "yes" on the form is true? Ask us for a pre-renewal security check — we'll tell you where you stand and what to fix first.