Cyber Insurance Specialist. Guide to Cyber Insurance 2026
Why has UK cyber insurance changed fundamentally in 2026?
For most of the last decade, cyber insurance was a discretionary purchase for UK SMEs — bought because a client demanded it, a renewal broker mentioned it, or a board member read about a high-profile breach. Premium was modest, underwriting was light-touch, and the policy sat alongside the commercial combined policy as a thinly-understood add-on. That settlement collapsed between 2022 and 2025, and 2026 is the year the new framework solidifies.
Three forces are reshaping the market simultaneously. First, claims experience: UK businesses paid out £197 million in cyber insurance claims in 2024, a 230% increase on the previous year, driven primarily by ransomware. Second, the regulatory environment: the UK ransomware payment ban covering public sector and critical national infrastructure was confirmed in July 2025 and is progressing through legislation; a mandatory incident reporting regime applies more broadly. Third, baseline security expectations: Cyber Essentials v3.3 ("Danzell") took effect 27 April 2026 with mandatory multi-factor authentication on all cloud services, tighter patch management requirements, and explicit backup resilience expectations. Insurers have aligned their underwriting standards to these baselines.
The downstream effect on UK businesses is profound. Cyber insurance applications that would have been routinely accepted three years ago are now declined at quotation. SMEs without MFA, EDR (endpoint detection and response), tested backups, or documented incident response plans either cannot get cover or get it at heavily-loaded rates. The buyers who navigate the new market well — who treat cyber insurance as a structured outcome of a documented security posture rather than a transactional purchase — are paying broadly stable premiums for substantially better cover. Those who treat it as a tick-box buy are paying more for less.
This guide is the definitive 2026 UK cyber insurance article — built around the regulatory transformation, the genuine claim-driving exposures, the cover architecture that responds, and the operational controls that make both compliance and claim defence possible. It complements our cyber insurance product page, and sits alongside our broader cyber and tech cluster including the small business cyber insurance guide, SaaS business insurance, AI consultancy insurance, and discipline-specific deep-dives on IT contractor insurance and construction cyber insurance.
Key facts at a glance
- 43% of UK businesses experienced a cyber breach or attack in 2024/25 — and 67% of medium-sized businesses and 74% of large firms. The Cyber Security Breaches Survey 2025/2026 estimates 612,000 UK businesses identified at least one breach.
- Ransomware against UK businesses doubled year-on-year — from under 0.5% to 1% of all firms in 2025, approximately 19,000 ransomware incidents. The average disruptive breach cost rose to £3,550 (excluding zero-cost reports).
- ICO enforcement on cyber has hardened materially — Capita fined £14m in October 2025 for UK GDPR security failures following a March 2023 ransomware breach, Advanced Computer Software £3.07m, 23andMe £2.31m, LastPass UK £1.23m. The maximum penalty is £17.5m or 4% of global turnover.
- Cyber Essentials v3.3 ("Danzell") commenced 27 April 2026 — MFA mandatory on all cloud services where available (failure = automatic assessment fail), 14-day patch requirements, expanded cloud scope, stronger backup resilience expectations. UK cyber insurers have aligned underwriting to these baselines.
- The UK ransomware payment ban for public sector and critical national infrastructure was confirmed July 2025 and is progressing through legislation. Private sector businesses face a mandatory notification regime before any ransom payment.
- UK cyber insurance premiums in 2026 typically run £350–£1,800 for micro businesses and £2,500–£15,000+ for mid-sized SMEs (50–250 employees) with appropriate controls. The premium for unprepared applicants — where cover can be secured at all — runs 2.5–4× the controlled baseline.
- Insurance non-disclosure under the Insurance Act 2015 is the most preventable cyber claim catastrophe — proposal form misrepresentations about MFA deployment, backup testing, patch cadence, or previous incidents allow insurers to avoid the policy entirely at claim stage.
1. What does cyber insurance actually cover? The five sections explained
UK cyber insurance in 2026 is built around five distinct cover sections, each responding to a different category of cyber loss. The mistake most SMEs make is treating cyber insurance as a single product — it isn't. It's a structured stack of cover modules, each with its own limit, deductible, sub-limit, and exclusion set. Understanding the five sections separately is the only way to know whether the policy you have actually responds to the incident you might face.
| Cover Section | What It Pays For | Typical SME Limit | Common Triggers |
|---|---|---|---|
| Incident response & forensics | DFIR firm engagement, breach coach, legal counsel, PR support, customer notification | £100k–£500k | Any suspected incident — triggers within hours |
| Ransomware & extortion | Negotiation costs, ransom payment (where lawful), system restoration, data recovery | £250k–£2m | Encryption event, data exfiltration with extortion demand |
| Business interruption | Lost profit during outage, increased cost of working, contingent BI from supplier outage | £250k–£2m+ | Operational downtime > waiting period (typically 8–24 hrs) |
| Data breach & privacy liability | Third-party claims, ICO investigation defence, regulatory fines (where insurable), credit monitoring | £500k–£2m | Personal data exposure, regulatory action, group action claim |
| Network security & media liability | Third-party damage from your network, transmission of malware, IP infringement, defamation in digital content | £500k–£2m | Network used to attack third party, content claims, IP claims |
Beyond these five core sections, four additional modules sit at the edge of standard cyber policies and need specific declaration: cyber crime / social engineering (for fraudulent transfer losses — often sub-limited at £50k–£250k, well below the actual loss); system damage and bricking (cost of replacing hardware rendered unusable — often excluded or endorsed); reputational harm (lost revenue beyond the formal BI period because customers leave); and betterment (upgrading systems beyond pre-incident state — generally excluded but partially covered by some specialist policies). These four are where the most contentious 2026 claim disputes happen.
2. How does the 2026 regulatory landscape change cyber risk for UK businesses?
UK cyber regulation in 2026 is a patchwork of overlapping frameworks. Each one drives a different aspect of the cyber insurance market — and an SME that doesn't understand them will misprice their own risk.
The UK GDPR enforcement reset
The ICO issued 28 monetary penalty notices in 2025, the highest annual total since UK GDPR came into force. The four largest cyber-related fines — Capita (£14m), Advanced Computer Software (£3.07m), 23andMe (£2.31m), and LastPass UK (£1.23m) — all related to security failures under UK GDPR Articles 5(1)(f) and 32. The pattern in each case was the same: insurers and the regulator are increasingly aligned in expecting MFA on privileged accounts, prompt response to security alerts, network segmentation, and timely patch management. Where these "fundamentals" are missing, both fines and claim disputes harden.
The ransomware payment ban and mandatory reporting regime
The Home Office confirmed in July 2025 that legislation will introduce a targeted ban on ransomware payments by all public sector bodies (NHS, councils, schools) and operators of regulated critical national infrastructure. A second strand introduces a mandatory pre-payment notification regime for the wider private sector — businesses planning to pay a ransom must notify the National Crime Agency so the government can advise on sanctions exposure and block payments to designated criminal groups. A third strand introduces mandatory ransomware incident reporting within 72 hours, followed by a more detailed account within 28 days. The implications for cyber insurance are immediate: ransom payment cover for in-scope organisations becomes inoperative; the notification regime adds procedural complexity to ransom decisions; and the reporting regime increases the volume of incidents the regulator becomes aware of.
The Cyber Security and Resilience Bill
Introduced to Parliament in November 2025 and progressing through its parliamentary stages, the Bill amends the UK Network and Information Systems Regulations 2018. It expands the regulated population to data centres, managed service providers, and load controllers, and gives the Secretary of State significant power to impose additional security requirements through secondary legislation. SMEs serving regulated entities under the Bill will face stricter due diligence and supply chain assurance — a downstream effect that flows through to cyber insurance requirements in commercial contracts.
Cyber Essentials v3.3 ("Danzell")
Cyber Essentials v3.3 took effect 27 April 2026. The five technical control themes are unchanged (Firewalls, Secure Configuration, Access Control, Malware Protection, Patch Management), but the requirements have hardened materially. MFA is now mandatory on all cloud services where available — failure is an automatic assessment fail. Patches for critical vulnerabilities must be applied within 14 days. The scope of cloud services is expanded — anything storing or processing organisational data is in scope unless demonstrably segregated. Passwordless authentication (passkeys, FIDO2) is promoted as the future direction. Most UK cyber insurers now align their underwriting questionnaires explicitly to the Cyber Essentials v3.3 control set; having the certification typically reduces premium 10–20%.
3. Risk 1: Ransomware and extortion — the dominant claim driver
Ransomware and Extortion — The 2026 Dominant Cyber Claim
Ransomware remains the dominant driver of UK cyber insurance claim severity in 2026. The 2025/2026 Cyber Security Breaches Survey identified roughly 19,000 UK businesses hit with ransom demands in the year — double the prior year. The attack model has hardened: modern ransomware is "double extortion" — attackers encrypt systems and simultaneously exfiltrate data, demanding a ransom both for the decryption key and to prevent published disclosure of stolen data. Recovery without paying the ransom is operationally possible if backups are intact and air-gapped, but the data publication threat remains. UK insurance claim values for SME ransomware in 2026 typically run £80k–£500k including response, restoration, and BI; mid-sized incidents reach £500k–£2m; the high-profile Co-op, M&S, Capita-class events run into the tens of millions.
Air-gapped or immutable backups tested at least quarterly with documented restore drill; MFA enforced on all privileged accounts, all cloud services, all remote access; endpoint detection and response (EDR) deployed across the estate with centralised alerting; network segmentation limiting lateral movement; documented and rehearsed incident response plan with named DFIR retainer; user phishing training programme with simulated phishing exercises; privileged access management (PAM) enforced — no shared admin accounts, no permanent admin rights on user accounts; patching within 14 days for critical vulnerabilities aligned to Cyber Essentials v3.3.
Cyber policy with explicit ransomware and extortion scope — including negotiation costs (specialist negotiators typically engaged via the breach coach), ransom payment (where lawful), data recovery and restoration costs, and consequential business interruption. Limit typically £250k–£2m for SMEs depending on data sensitivity and business-criticality. The mandatory notification regime under UK law introduces a procedural step before any ransom payment — your incident response plan should anticipate this. Insurers in 2026 increasingly require evidence of immutable backups before issuing or renewing cover.
4. Risk 2: Data breach and UK GDPR exposure
Data Breach and UK GDPR Liability — The Long-Tail Exposure
Data breach is the second major claim driver and the one most likely to extend a single incident into multi-year litigation. The pattern is well-established: personal data exfiltrated during a cyber incident (whether ransomware-driven, phishing-driven, or insider) triggers UK GDPR Article 33 notification to the ICO within 72 hours; the ICO investigates the security measures in place at the time of the breach (UK GDPR Articles 5(1)(f) and 32); affected data subjects may bring a group action claim through one of the data breach claim firms; commercial counterparties may bring contractual claims under their data processing agreements. The ICO fines in 2025 — Capita £14m, Advanced £3.07m, 23andMe £2.31m, LastPass UK £1.23m — were all under this framework. The maximum penalty under UK GDPR is £17.5m or 4% of global annual turnover, whichever is higher.
Documented information security management system aligned to recognised framework (ISO 27001 or equivalent); UK GDPR Article 32 risk assessment per processing activity; data processing agreements with all processors; tested incident response plan including 72-hour ICO notification trigger; documented data subject rights handling; encryption at rest and in transit for personal data; data minimisation and retention policies; documented justification for any deviation from "state of the art" security expectations. The Capita decision (October 2025) is the working benchmark for what regulators expect of larger organisations; smaller organisations are held to proportionate standards.
Cyber policy with privacy liability section covering: ICO investigation defence costs; third-party claims from affected data subjects (including group actions); credit monitoring services for affected individuals; PR and communications support. Regulatory fines themselves are technically uninsurable to the extent they're penal, but defence costs and many related liabilities are insurable. Limit typically £500k–£2m for SMEs depending on data volume and sensitivity. Special category data (health, biometric, criminal records) materially elevates the underwriting profile.
5. Risk 3: Business email compromise and social engineering loss
Business Email Compromise — The Hidden Sub-Limit Trap
Business email compromise (BEC) is now the most common SME cyber insurance claim by frequency. The pattern: attacker compromises an email account (typically through credential theft via phishing, or via session token theft), monitors email traffic for invoice or payment activity, then impersonates a supplier or executive to redirect a legitimate payment to an attacker-controlled account. Generative AI has materially improved the convincingness of these attacks — phishing emails are well-written, conversational, and contextually accurate. The Cyber Security Breaches Survey 2025/2026 confirmed phishing as the dominant attack method, affecting 85% of breached businesses. UK SME losses per BEC incident typically run £15k–£200k. The insurance trap: BEC losses are usually covered under the "cyber crime" or "social engineering" sub-limit, which on many standard policies is capped at £25k–£100k — well below the typical loss.
MFA on all email accounts (without exception); conditional access policies restricting email access to managed devices or trusted locations; documented dual-authorisation for outgoing payments above defined threshold; out-of-band verification protocol for any change of supplier bank details (verbal call to known number — never email confirmation); user training programme specifically addressing BEC patterns; mailbox rule monitoring (attackers commonly create auto-forward rules); session token protection through token binding and short session lifetimes; documented invoice fraud response procedure including bank notification.
Cyber policy with explicit cyber crime / social engineering scope, with limit matched to actual exposure. The default £25k–£100k sub-limit on many standard policies leaves most BEC losses uninsured. Specialist negotiated cover can extend sub-limit to £250k–£500k. Some BEC losses also engage crime insurance (separate product) — for businesses with significant fraudulent transfer exposure, the layered approach of cyber + crime insurance is the working structure. Many BEC losses are not recoverable through bank chargeback; the insurance layer is the only practical route to recovery.
6. Risk 4: Business interruption from cyber events
Business Interruption — The Often-Underestimated Cyber Loss
Cyber business interruption is the cover that pays for lost profit and increased cost of working during a cyber-caused outage. For most SMEs, the BI loss is comparable to or larger than the direct incident response cost. The Co-op, M&S and Harrods cyber events of Easter 2025 each generated BI losses in the tens of millions; mid-sized SME events typically generate BI losses of £50k–£500k+. The trap: every cyber BI policy contains a "waiting period" (typically 8, 12, or 24 hours) during which no BI loss is recoverable. Shorter waiting periods cost more in premium but pay out faster. The second trap: contingent business interruption — loss caused by a cyber incident at one of your critical suppliers (cloud provider, SaaS vendor, payment processor, logistics partner) — is either excluded or sub-limited on many standard policies, despite being a frequent loss driver.
Documented recovery time objectives (RTOs) per business-critical system; tested backup restore procedures with documented restore times; redundant infrastructure for critical systems where commercially proportionate; manual workaround procedures for the first 24–48 hours of any major IT outage; supplier dependency mapping with documented contingencies for critical SaaS providers; communication templates for customer and supplier notification; documented financial reserves or working capital arrangement to bridge the BI waiting period.
Cyber policy with BI section including: lost net profit during indemnity period; increased cost of working; (with specialist placement) contingent BI from supplier outage. Indemnity period typically 6–12 months. Waiting period chosen to match operational resilience — shorter waiting periods cost more but reduce uninsured loss exposure. Reputational harm BI (loss continuing after operations resume because customers have left) is a specialist extension. The most common 2026 SME cyber BI cover gap is contingent BI scope — verify it explicitly with your broker.
7. Risk 5: Supply chain and third-party cyber exposure
Supply Chain Cyber Exposure — The Capita Risk Pattern
The 2025 Capita decision illustrated the supply chain cyber risk pattern with particular clarity. Capita acted as a data processor for 325 pension schemes; a ransomware breach at the processor exposed personal data of 6.6 million individuals across its controllers. Under UK GDPR, both controllers and processors carry independent Article 32 security obligations — the ICO fined both Capita plc (controller, £8m) and Capita Pension Solutions Limited (processor, £6m) separately. For SMEs, the supply chain risk runs in both directions: as a customer of cloud, SaaS, and outsourced providers, you carry residual risk from their security failures; as a supplier to larger commercial customers, you carry direct contractual liability for security failures in your environment that affect their data.
Documented supplier due diligence — security questionnaire, SOC 2 / ISO 27001 evidence, Cyber Essentials Plus certification check; data processing agreements with all processors of personal data on your behalf; documented review of critical supplier security posture at least annually; contractual right to audit / security incident notification clauses in commercial contracts; understanding of which suppliers process personal data and which process commercial-sensitive data; backup of cloud-hosted data where commercially proportionate (cloud-to-cloud or cloud-to-on-premise); contractual indemnification provisions where commercially negotiable.
Cyber policy with explicit supply chain incident scope: contingent BI from supplier outage; third-party liability for incidents affecting your customers' data; defence costs for contractual claims from commercial counterparties. Many standard cyber policies sub-limit supply chain exposure or exclude it entirely; specialist negotiated cover typically removes these restrictions for SMEs serving B2B customers. Cyber policy should coordinate with Professional Indemnity — PI typically responds to professional negligence claims arising from a cyber incident, while cyber responds to the technical incident itself. See our professional indemnity insurance guide for the coordination principles.
8. Cyber insurance cover checker
Select your business profile below to see the cover matched to your specific cyber risk profile. For Miller & Partner's main cyber product page see cyber insurance for UK businesses.
Cyber Insurance Cover Checker
Select your business profile to see the recommended cyber insurance programme matched to the 2026 UK risk landscape
Micro Business (1-9 staff)
- ESSENTIAL Cyber Liability — incident response, ransomware, data breach, BI — limit £250k–£500k
- ESSENTIAL Cyber crime / social engineering sub-limit raised to at least £50k (BEC is the most common micro-business claim)
- ESSENTIAL Incident response retainer access (DFIR firm via breach coach) — 24/7 hotline
- RECOMMENDED Cyber Essentials Basic certification — premium reduction and contract eligibility
- RECOMMENDED Privacy liability with ICO investigation defence cost scope
- CONSIDER Business interruption with 8-hour waiting period for client-facing service businesses
- CONSIDER Director and officer cyber-related defence (small companies still face director-level cyber claims)
SME (10-49 staff)
- ESSENTIAL Cyber Liability comprehensive — incident response, ransomware, BI, privacy liability, network security — limit £500k–£1m
- ESSENTIAL Cyber crime / social engineering sub-limit raised to at least £100k–£250k
- ESSENTIAL Business interruption with contingent BI for critical SaaS supplier outage
- ESSENTIAL Privacy liability £500k–£1m with ICO investigation and group action defence scope
- ESSENTIAL Cyber Essentials certification minimum — Plus where servicing larger commercial contracts
- RECOMMENDED Reputational harm extension (loss continuing after BI resumes)
- RECOMMENDED System damage / hardware bricking cover by endorsement
- CONSIDER Crime insurance (separate product) — for BEC exposure above cyber sub-limit
Mid-Market (50-249 staff)
- CRITICAL Cover specification needs careful structuring — generic SME policies inadequate at this scale
- ESSENTIAL Cyber Liability comprehensive — limit £1m–£5m
- ESSENTIAL Business interruption £1m+ with contingent BI scope
- ESSENTIAL Privacy liability £1m–£2m with comprehensive ICO defence and group action scope
- ESSENTIAL Network security and media liability £1m+
- ESSENTIAL Cyber crime / BEC sub-limit £250k+ with specific scope review
- ESSENTIAL Cyber Essentials Plus certification
- ESSENTIAL Documented incident response plan with named DFIR retainer
- RECOMMENDED Directors and Officers cyber extension for individual director defence
- RECOMMENDED ISO 27001 certification (premium and contract benefits)
Professional Services Firm
- CRITICAL Professional services firms hold high-value client data — privacy liability is the dominant exposure
- ESSENTIAL Cyber Liability with strong privacy liability section — limit £1m–£2m
- ESSENTIAL Professional Indemnity coordination — PI and cyber must dovetail without coverage gaps
- ESSENTIAL Business interruption — billable hours lost during outage is a major exposure
- ESSENTIAL Cyber crime / client funds protection scope (where firm handles client money)
- ESSENTIAL Confidentiality / non-disclosure scope for client engagement information
- ESSENTIAL Cyber Essentials Plus + ISO 27001 for larger firms
- RECOMMENDED Group action defence scope (claims from clients whose data is exposed)
E-Commerce / Retail
- CRITICAL Payment card data exposure and platform outage drive the cover specification
- ESSENTIAL Cyber Liability comprehensive — limit £1m–£2m
- ESSENTIAL PCI DSS fines and assessments scope (separate from regulatory fines)
- ESSENTIAL Business interruption with short waiting period (4–8 hours) — online retail cannot tolerate longer
- ESSENTIAL Contingent BI for hosting platform, payment processor, logistics supplier outage
- ESSENTIAL Privacy liability £1m+ — high customer data volume drives exposure
- ESSENTIAL Bot attack / DDoS BI scope explicitly declared
- RECOMMENDED Network security and media liability — covers third-party damage from your platform
SaaS / Tech Business
- CRITICAL Tech businesses act as data processors for clients — both first-party and third-party exposure
- ESSENTIAL Cyber Liability with both first-party and third-party scope — limit £1m–£5m
- ESSENTIAL Tech E&O integration — see our SaaS business insurance guide
- ESSENTIAL Privacy liability £1m–£2m with processor scope explicitly declared
- ESSENTIAL Network security and media liability — covers downstream damage from your platform
- ESSENTIAL Business interruption with contingent BI scope (cloud infrastructure dependency)
- ESSENTIAL ISO 27001 certification (commercial contract expectation)
- RECOMMENDED Contractual liability extension for customer data processing obligations
- RECOMMENDED IP infringement scope for code and platform-borne IP claims
9. Cyber Essentials v3.3 underwriting readiness check
Cyber Essentials v3.3 ("Danzell") commenced 27 April 2026 and is now the de-facto baseline UK insurers use to assess SME cyber risk. The control set below is what insurer underwriters expect to see evidenced at proposal stage. Tick each control your business has fully implemented. Unchecked items are your priority closure list — both for compliance and for getting competitive cyber insurance terms.
Cyber Essentials v3.3 Underwriting Readiness Check
Click each control you have fully implemented. The more ticked, the better your cyber insurance proposal will be received and the lower your premium loading.
-
MFA enforced on all cloud services where available — including email, file sharing, CRM, line-of-business SaaS, and all administrative accounts (CE v3.3 auto-fail if missing)
-
MFA enforced on all remote access — VPN, RDP, jump hosts, any internet-facing administrative interface
-
Critical security patches applied within 14 days — with documented patch management process and evidence of cadence (CE v3.3 expectation)
-
Endpoint Detection and Response (EDR) deployed across all endpoints — managed and monitored, with alerting routed to a defined responder
-
Immutable or air-gapped backups — backups that ransomware cannot delete or encrypt, with documented retention policy
-
Backup restore tested at least quarterly — with documented restore drill including time-to-restore measurement
-
Privileged Access Management (PAM) — no shared admin accounts, no permanent admin rights on user accounts, separate admin credentials for administrative tasks
-
Phishing awareness training programme — with simulated phishing exercises and evidenced completion rates
-
Documented incident response plan — including named DFIR contact, breach coach details, communication templates, and 72-hour ICO notification trigger
-
Network segmentation in place — limiting lateral movement between user network, server estate, and any OT/IoT environment
-
BYOD policy documented and enforced — MDM enrolment, conditional access, software firewall, patch management for personally-owned devices accessing organisational data
-
Dual authorisation for outgoing payments above defined threshold — with out-of-band verification protocol for any change of supplier bank details
-
Cyber Essentials Basic or Plus certification — current certification evidenced at proposal stage (basic minimum, Plus for larger commercial contracts)
10. Cyber insurance risk assessor
Two factors drive UK SME cyber risk above all others: the sensitivity of the data you process and the maturity of the security controls you have in place. Use the tool below for your specific risk profile.
Cyber Insurance Risk Assessor
Select your data profile and your control maturity to see your specific cyber risk profile and indicative insurance package
11. Risk 6: The exclusions that catch buyers out at claim time
Cyber Policy Exclusions — Where Claims Get Disputed
The 2020–2025 hardening of cyber insurance produced a generation of policy exclusions that didn't exist in earlier wordings — and that catch buyers out at claim time. The most contentious in 2026 are: the war / state-backed cyber attack exclusion (introduced in response to NotPetya attribution disputes — wording varies materially between insurers, and attribution is rarely cleanly available); prior known vulnerability exclusion (loss arising from a vulnerability the insured knew about but didn't patch — this is where the Capita-pattern situations become uninsurable); infrastructure failure exclusion (failure of public internet, telecoms, or power infrastructure, even where cyber-caused); betterment exclusion (cost of upgrading systems beyond pre-incident state); contractual liability exclusion (liability assumed in customer contracts beyond what would apply at common law); and bricking exclusion (physical replacement of hardware rendered unusable).
Read the exclusion section of your policy carefully, not just the cover section; understand exactly what triggers each exclusion in your specific wording; document patch management cadence and known-vulnerability remediation timelines (defends against prior-known-vulnerability exclusion); document contractual liability exposures and ensure they sit within policy cover where commercially necessary; consider endorsement to remove or limit the most exposed exclusions; document the security controls that determine which exclusions apply at claim stage.
Exclusion-removal endorsements are negotiable on specialist placements. The most commonly removed in 2026 placements: tightening of the war exclusion to a "cyber operations during war" clarification rather than blanket state-attribution; removal of bricking exclusion; extension of betterment to recognise reasonable security improvements as part of recovery; clarification of contractual liability to include "reasonable commercial terms" rather than blanket exclusion. Each endorsement adds typically 3–8% to premium but materially improves claim certainty. The decision is risk-specific: high data sensitivity and operational dependence on technology typically justifies the endorsements; lower-exposure operators may accept the standard exclusions.
12. Risk 7: ICO investigation and director liability
ICO Investigation and Director Liability — Catastrophic Exposure
UK GDPR Article 83 provides for monetary penalties of up to £17.5m or 4% of total worldwide annual turnover, whichever is higher. In practice, ICO fines are calibrated to the size and turnover of the breached organisation — the Capita decision (October 2025) was £14m against group turnover of £2.4bn, representing roughly 0.6% of revenue. The Advanced Computer Software £3.07m fine represented approximately 1% of revenue. The trend across 2025 was the highest annual total of monetary penalty notices since UK GDPR came into force (28). Beyond the fine itself, the regulator engagement consumes 12–24 months of senior management time, generates legal defence costs typically £200k–£2m, drives group action exposure, and triggers a public Decision Notice that competitors and customers read. Directors face personal exposure under the Companies Act 2006 (directors' duties) and may face individual proceedings where their conduct contributed materially to the breach.
Documented information security governance with board-level oversight; documented Article 32 risk assessment per processing activity; documented response to any prior penetration test or audit finding (the Capita Decision Notice noted unremediated penetration test findings as an aggravating factor); documented data processing inventory under Article 30; documented data breach response capability tested through tabletop exercise; clear lines of accountability for security failures; documented justification for any deviation from "state of the art" security expectations under Article 32.
Cyber policy with privacy liability and ICO investigation defence costs. Regulatory fines themselves are technically uninsurable to the extent they're penal under UK public policy, but defence costs — routinely £200k–£2m for a contested ICO investigation — are insurable and should be covered. Directors and Officers (D&O) insurance with cyber extension provides individual director defence in personal proceedings. For larger SMEs and mid-market firms, the D&O / cyber coordination is essential — the Capita pattern shows that both controller and processor companies can be fined separately, and individual director conduct can be examined. Group action claims from affected data subjects are responded to under the cyber privacy liability section.
13. Risk 8: Insurance non-disclosure under the Insurance Act 2015
Cyber Insurance Non-Disclosure — The Most Preventable Claim Disaster
Cyber insurance proposal forms in 2026 contain detailed control questions: MFA deployment scope, backup testing cadence, EDR deployment, patch management timeframes, previous incidents, network architecture, supplier dependencies. Each answer is a contractual representation. Under the Insurance Act 2015, the insured must make a "fair presentation of the risk" — proactively disclosing every material fact the insurer would want to know. Misrepresentation or non-disclosure (even unintentional) allows the insurer to: avoid the policy entirely (treating it as never having existed); reduce the claim proportionally; or impose terms that would have applied with proper disclosure. Cyber policy disputes routinely turn on proposal form answers about MFA scope, backup testing, and prior incidents — exactly the topics most SMEs find difficult to answer with technical precision.
Complete the proposal form with the IT lead or MSP, not just the business owner; document the technical evidence for each material answer (MFA enforcement screenshot, backup test log, EDR deployment report); retain proposal correspondence and broker enquiries; review proposal answers annually at renewal — controls evolve, and last year's "yes" can become this year's "in transition"; notify the insurer mid-term of material changes (new SaaS deployment, security incident, change of MSP); document any material incident even where no claim is made — disclosure at renewal is required.
There is no insurance response to insurance non-disclosure — that's the whole point. The cover that should have responded doesn't. The only mitigation is at the proposal stage: rigorous, evidenced answers; broker discipline; renewal review. Specialist cyber broker placement makes a material difference here — generic brokers often accept proposal answers at face value, while specialist cyber brokers know exactly what each insurer's technical questions actually mean and will challenge weak answers before they become claim disputes.
14. What drives the cost of cyber insurance in 2026?
UK cyber insurance pricing in 2026 reflects the bifurcation of the market into prepared and unprepared applicants. Premiums have stabilised from the 2021–2023 ransomware shock for businesses with Cyber Essentials v3.3-aligned controls; they have hardened materially for businesses without those controls. Indicative annual premium ranges:
| Business Profile | Indicative Annual Premium 2026 |
|---|---|
| Micro business (1–9 staff, minimal personal data, basic controls) — £100k–£500k limit | £350–£1,200 |
| Micro business with controls (Cyber Essentials Basic, MFA, backups) — £500k limit | £450–£1,800 |
| SME (10–49 staff) — standard B2B data, Cyber Essentials, comprehensive £1m cover | £1,500–£5,000 |
| SME with elevated profile — B2C data, e-commerce, or professional services £1m cover | £2,500–£8,500 |
| Mid-market (50–249 staff) — £1m–£5m limit, Cyber Essentials Plus or ISO 27001 | £5,000–£25,000 |
| Mid-market high-exposure — special category data, payment cards, processor role, £5m+ cover | £15,000–£60,000+ |
| Unprepared applicant (any size) — declines or 2.5–4× the controlled baseline where placeable | Variable / declined |
The factors below drive both insurance premium and overall cyber risk management investment. The rating impact within each profile band is typically larger than the differential between profile bands — meaning an SME with poor controls can pay more than a mid-market firm with excellent controls.
| Rating Factor | Impact on Premium | What You Can Do |
|---|---|---|
| MFA deployment scope | Single biggest underwriting question — partial deployment = decline or heavy loading | Complete MFA on cloud services, remote access, admin accounts before applying |
| Backup architecture and testing | Immutable + tested = standard premium; not = heavy loading or decline | Implement immutable backups; document quarterly restore tests |
| EDR deployment | Mandatory expectation in 2026 — absence is increasingly a decline driver | Managed EDR via MSP if internal capacity limited |
| Cyber Essentials certification | Basic = 10–15% premium reduction; Plus = 15–25% | Maintain current certification; budget £384–£6,000 depending on level |
| ISO 27001 certification | Material premium reduction for mid-market — 20–30% | Commercial decision; ROI strong where larger commercial contracts in play |
| Data sensitivity and volume | Special category data, payment cards, large customer databases drive material loadings | Declare accurately; data minimisation reduces both regulatory risk and premium |
| Annual turnover and staff numbers | Primary scaling factors but secondary to control profile | Declare accurately including planned growth |
| Previous incidents | 3–5 year impact on premium; non-disclosure of any incident voids cover | Disclose every material incident including near-misses; document remedial action |
| Industry sector | Healthcare, financial services, education, legal — higher base rate | Sector-specific controls (e.g. NHS DSPT for healthcare) reduce loading |
| Limits and sub-limits selected | Headline limit £500k vs £1m typically 60–80% premium differential; sub-limit choices material | Match to actual exposure; raise BEC sub-limit even if reducing headline limit elsewhere |
| Continuity with insurer | 3+ years with same insurer typically reduces renewal premium 5–15% absent claim | Strategic continuity decision; don't chase £100 savings |
| Broker placement | Specialist cyber brokers access better terms than generic placement | Use a broker with specialist cyber underwriting experience |
15. Real cyber claims and how to manage them
Claim — Ransomware, £340,000 Total Settlement
A 28-staff UK professional services firm running a hybrid IT estate (on-premise file server, Microsoft 365, line-of-business SaaS, three remote-access servers) suffered a ransomware incident on a Sunday evening. Initial vector: a contractor's account had MFA enabled in policy but had a single bypass exception for "trusted devices" — the contractor's laptop was compromised through phishing, and the trusted-device session token was stolen. The attacker accessed the firm's environment via the contractor account, escalated privilege using a known unpatched vulnerability on a legacy file server (patched in vendor release 4 months earlier), and deployed ransomware encrypting the on-premise estate and exfiltrating approximately 14GB of client data including matter files.
The firm activated its incident response plan — DFIR firm engaged within 4 hours via the cyber insurer's breach coach hotline. The attacker demand was £180,000 in Bitcoin; following negotiation through a specialist negotiator engaged by the breach coach, no ransom was paid. Restoration from immutable backups took 11 days. Approximately 600 client matter records were affected by the exfiltration — ICO notified within 72 hours, all affected clients notified, credit monitoring offered.
Total claim settlement: incident response and forensics £58,000; restoration and IT remediation £42,000; business interruption (lost billable hours across 11-day partial outage) £165,000; legal counsel and breach coach £38,000; client notification and credit monitoring £22,000; ICO investigation defence (closed without enforcement action — firm's documentation pack was robust) £15,000. Total: £340,000.
Post-claim renewal: cyber premium increased 32%. Insurer required: complete elimination of MFA bypass exceptions; managed EDR deployment; 14-day patching SLA with documented evidence; quarterly tabletop exercise. The firm implemented these and the following renewal saw premium return to a 12% loading over baseline. The lesson: the £180,000 ransom was avoided because backups were intact and tested; the £340,000 total cost reflects what cyber events cost even when ransom is not paid. The MFA bypass exception was the proximate cause — a single policy weakness that voided a £30,000 control investment.
Claim — Business Email Compromise, £127,000 Settlement
A 12-staff UK marketing agency was hit with a BEC attack via the finance director's email account. Initial vector: phishing email impersonating Microsoft 365 with a fake login page captured credentials; the finance director's account had MFA configured but used SMS-based MFA which was intercepted via SIM-swap targeting. Once inside the mailbox, the attacker created a mailbox rule to auto-forward all invoice-related emails to an external address, monitored billing activity for two weeks, then sent a "change of bank details" email to the agency's largest client immediately before a scheduled £85,000 invoice payment.
The client paid £85,000 to the attacker-controlled account. The fraud was discovered three days later when the client emailed the agency to confirm receipt. By that time the funds had been moved through three intermediary accounts and were unrecoverable. The agency reported to Action Fraud, notified the bank (no chargeback available), and engaged legal counsel.
The agency's cyber policy had a £100,000 cyber crime / social engineering sub-limit (raised from default £25,000 at broker recommendation). Total exposure: £85,000 lost payment + £18,000 client demand to make good (commercial settlement covered both the client's risk and the agency's contractual obligation) + £15,000 forensic investigation + £9,000 legal costs. Total: £127,000. Insurance settlement: £100,000 (sub-limit cap). Uninsured loss: £27,000.
Post-claim renewal: cyber crime sub-limit raised to £250k for following year (£480 premium uplift). Insurer required: removal of SMS-based MFA in favour of authenticator app or hardware token; documented out-of-band verification for any change of supplier or client bank details; mailbox rule monitoring deployed. The lesson: the £100,000 sub-limit prevented this from being a catastrophic claim, but the gap to £127,000 was the cost of not having raised the sub-limit further at proposal. The SIM-swap attack vector is increasingly common in 2026 — SMS-based MFA is no longer considered adequate by underwriters for high-value email accounts.
Claim — Data Breach + ICO Investigation, £890,000 Total Exposure
A 65-staff UK healthcare technology business (a SaaS platform serving multiple GP practices, processing patient personal and health data as a UK GDPR processor) suffered a credential compromise via a phishing email targeting a developer with access to the production environment. The attacker accessed the platform's customer database via the developer's compromised credentials (no MFA on the developer's privileged access — an oversight identified in the firm's prior penetration test but not remediated). The attacker exfiltrated approximately 380,000 patient records including health data.
UK GDPR notification within 72 hours triggered ICO investigation. Affected GP practices (data controllers) notified affected patients. The investigation focused on UK GDPR Article 32 — specifically why MFA on privileged developer access had not been deployed despite being flagged in penetration testing six months earlier. The ICO Decision Notice (issued 14 months after the incident) found that Article 32 had been infringed and imposed a £450,000 fine. A group action by approximately 12,000 affected patients was settled at £180,000 plus £75,000 legal costs.
Total exposure: ICO fine £450,000 (uninsurable as penalty); ICO investigation defence costs £185,000 (insured); group action settlement and costs £255,000 (insured); affected patient notification and credit monitoring £62,000 (insured); business interruption and customer remediation £128,000 (insured); regulatory consultant and compliance remediation £35,000 (partially insured). Total: £1,115,000. Insurance settlement: £665,000. Uninsured loss: £450,000 (fine) + retention layer £35,000 = £485,000.
Post-claim consequences: the firm lost three of its 47 GP practice customers (commercial decisions about processor risk); cyber premium increased 95%; the firm implemented mandatory MFA on all privileged access, formal change management for penetration test remediation, and engaged a CISO-as-a-service provider. The lesson: ICO fines are uninsurable but defence costs and group action exposure are not. The unremediated penetration test finding was the regulatory aggravating factor — exactly as in the Capita decision. Processor-role businesses face heightened exposure because their security failures affect multiple controllers simultaneously.
Claims Management Steps
How to respond to a cyber incident — the steps below are critical given the multi-policy, multi-regulator, and multi-counterparty exposure typical of 2026 cyber events:
- Activate the incident response plan and call the cyber insurer's breach coach hotline immediately. Cyber policies include a 24/7 incident response hotline routing to a DFIR firm, breach coach, and legal counsel. Call within hours of incident detection — the first 24 hours determine the trajectory of the entire incident. The breach coach coordinates everything that follows.
- Contain the incident before remediation. Standard DFIR sequence: identify scope, isolate affected systems, preserve forensic evidence. Do not wipe and restore systems before evidence is captured — that destroys the forensic trail and weakens both insurance and regulatory positions.
- Make the 72-hour UK GDPR notification decision deliberately. Where personal data is affected, ICO notification within 72 hours of becoming aware is required under Article 33. The notification is a regulatory step, not an admission of breach severity. The breach coach and your DPO (where appointed) coordinate the notification.
- Engage with the ransomware payment regime carefully. If the incident involves ransom demand and your organisation is in scope of the public sector / CNI ban, payment is prohibited. For private sector businesses, the mandatory pre-payment notification regime requires NCA notification before any payment. The breach coach knows the procedural requirements.
- Manage customer, supplier, and regulator communications through one coordinated channel. Multiple uncoordinated statements create inconsistencies that haunt subsequent regulatory and litigation processes. The breach coach typically manages communications working with your PR provider and internal team.
- Preserve all documentation rigorously. Pre-incident security documentation (Cyber Essentials evidence, penetration test reports, MFA deployment records, backup test logs); incident timeline; DFIR firm reports; communications with regulators, customers, suppliers; insurer correspondence. The documentation pack is the defence across all coverage layers and regulatory engagement.
- Restore from immutable backups before considering ransom payment. Where backups are intact and tested, restoration is operationally feasible within 5–21 days for most SME estates. Ransom payment is the last resort, not the first response — and even then, paying does not guarantee data is not published.
- Conduct post-incident review and update operational documentation. Identify the proximate cause and the underlying control failure (these are often different). Implement remedial action. Update incident response plan based on lessons learned. Insurers reviewing renewal will ask what's changed since claim; regulators will require evidence of remedial action; this documentation is also defence against future enforcement.
Glossary of cyber insurance terms
- UK GDPR
- The UK General Data Protection Regulation — the retained EU GDPR as amended for the UK domestic context, supplemented by the Data Protection Act 2018. Sets the legal framework for personal data processing, including Article 32 security obligations and Article 83 penalty regime (maximum £17.5m or 4% of global turnover).
- Cyber Essentials / Cyber Essentials Plus
- UK government-backed cyber security certification administered by IASME on behalf of the NCSC. Cyber Essentials is self-assessment reviewed by an assessor (£384–£720 with VAT); Plus adds independent technical verification (£1,400–£6,000+). v3.3 ("Danzell") commenced 27 April 2026.
- MFA (Multi-Factor Authentication)
- Authentication requiring two or more independent factors (something you know, something you have, something you are). Now mandatory under Cyber Essentials v3.3 on all cloud services where available. SMS-based MFA is increasingly considered inadequate for high-value accounts due to SIM-swap risk.
- EDR (Endpoint Detection and Response)
- Security tooling that monitors endpoints (laptops, servers, mobile devices) for malicious activity, provides centralised alerting, and supports incident investigation. Effectively mandatory expectation in 2026 cyber underwriting.
- DFIR (Digital Forensics and Incident Response)
- Specialist firms engaged during cyber incidents to investigate scope, contain the threat, preserve forensic evidence, and support recovery. Cyber policies typically include 24/7 hotline access to a panel DFIR firm via the breach coach.
- Breach Coach
- A specialist lawyer (usually a partner at a UK firm) engaged as first responder during a cyber incident, coordinating DFIR, legal counsel, PR, regulator engagement, and insurance notification. The breach coach is typically embedded in cyber policy incident response coverage.
- BEC (Business Email Compromise)
- Cyber attack pattern in which the attacker compromises a business email account and uses it to redirect legitimate payments to attacker-controlled accounts. The most common SME cyber claim by frequency in 2026. Usually covered under cyber crime / social engineering sub-limit.
- Double Extortion
- Modern ransomware pattern in which attackers both encrypt systems (demanding ransom for decryption key) and exfiltrate data (demanding ransom to prevent publication). The exfiltration threat remains even where encrypted systems can be restored from backup.
- Immutable Backup
- Backup architecture in which the backup, once written, cannot be modified, deleted, or encrypted — including by ransomware that has gained administrative access. Increasingly an underwriting expectation in 2026.
- Article 32 (UK GDPR)
- The UK GDPR provision requiring controllers and processors to implement appropriate technical and organisational measures to ensure security of personal data. The primary regulatory basis for cyber-related ICO fines including Capita (£14m), Advanced Computer Software (£3.07m).
- PCI DSS
- Payment Card Industry Data Security Standard. Contractual obligation under merchant agreements for businesses processing payment card data. Breach of PCI DSS standards can generate substantial PCI fines and assessments — separate from regulatory fines, often covered under specific cyber policy sub-limit.
- Contingent Business Interruption
- Business interruption loss caused by a cyber incident at a critical supplier (cloud provider, SaaS vendor, payment processor) rather than at the insured's own infrastructure. Often excluded or sub-limited on standard cyber policies; specialist negotiated cover removes these restrictions.
- NIS Regulations 2018 / Cyber Security and Resilience Bill
- The Network and Information Systems Regulations 2018, currently being amended by the Cyber Security and Resilience Bill (introduced November 2025). Imposes security and incident reporting obligations on operators of essential services, digital service providers, and (under the Bill) data centres, managed service providers, and load controllers.
- Ransomware Payment Ban / Notification Regime
- UK legislation confirmed in July 2025 (progressing through Parliament 2026) introducing: a targeted ban on ransomware payments by public sector and regulated CNI organisations; mandatory pre-payment notification to NCA for the wider private sector; mandatory 72-hour incident reporting with detailed follow-up at 28 days.
- Information Commissioner's Office (ICO)
- The UK's independent supervisory authority for data protection, established under the Data Protection Act 2018. Issues monetary penalty notices under UK GDPR (maximum £17.5m or 4% of global turnover), Decision Notices, Enforcement Notices, and Reprimands. Issued 28 monetary penalty notices in 2025 — the highest annual total since UK GDPR commenced.
- Privileged Access Management (PAM)
- Security architecture limiting and monitoring administrative access. Principles include no shared admin accounts, no permanent admin rights on user accounts, just-in-time elevation, and separate admin credentials. Increasingly an underwriting expectation for medium and larger SMEs.
- Insurance Act 2015 — Fair Presentation
- The UK statute requiring commercial insureds to make a "fair presentation of the risk" — proactively disclosing every material fact the insurer would want to know. Non-disclosure or misrepresentation (even unintentional) allows the insurer to avoid the policy, reduce the claim proportionally, or impose alternative terms.
Frequently asked questions
UK cyber insurance is built around five distinct cover sections: incident response and forensics (DFIR engagement, breach coach, legal counsel, PR); ransomware and extortion (negotiation, ransom payment where lawful, restoration); business interruption (lost profit during outage, increased cost of working, contingent BI from supplier outage); data breach and privacy liability (third-party claims, ICO investigation defence, credit monitoring); network security and media liability (third-party damage from your network, transmission of malware, IP infringement). Beyond these, four modules sit at the edge and need specific declaration: cyber crime / BEC sub-limit; system damage / bricking; reputational harm; betterment.
Indicative 2026 annual premiums: micro businesses (1–9 staff) with basic controls £350–£1,200; with Cyber Essentials and MFA £450–£1,800; SMEs (10–49 staff) with standard B2B data and Cyber Essentials £1,500–£5,000; SMEs with elevated profile (e-commerce, professional services) £2,500–£8,500; mid-market (50–249 staff) £5,000–£25,000; mid-market high-exposure £15,000–£60,000+. Unprepared applicants face declines or 2.5–4× the controlled baseline. Pricing depends on MFA scope, backup architecture, EDR deployment, Cyber Essentials certification, data sensitivity, and claims history. See our small business cyber insurance quote guide for sector-specific pricing.
Cyber insurance is not currently a legal requirement under UK law (there is industry discussion in 2026 about potentially making it mandatory for commercial entities, but no statute yet). However, GDPR compliance, the Cyber Security and Resilience Bill, and the ransomware payment regime all create obligations that cyber insurance helps fulfil and indemnify. Commercial contracts increasingly require cyber insurance — particularly contracts with larger commercial customers, public sector tenders, and supplier panels for regulated industries. Cyber Essentials certification (which often goes hand-in-hand with cyber insurance) has been mandatory for UK government contracts handling personal data since 2014.
The two products cover different aspects of cyber-related loss and should coordinate, not duplicate. Cyber insurance covers the technical incident itself — incident response, ransomware, BI, data breach liability, network security. Professional Indemnity covers professional negligence claims arising from how your services were provided — including claims that your services contributed to a customer's cyber loss. For technology and professional services businesses, both are typically necessary. The coordination point is critical: PI should cover the professional advice/service failure; cyber should cover the technical incident. See our professional indemnity insurance guide for the coordination principles.
Position depends on whether your organisation is in scope of the public sector / critical national infrastructure ban (confirmed July 2025, progressing through legislation in 2026). If in scope (NHS, councils, schools, regulated CNI operators), ransom payments are prohibited and your cyber policy's ransom payment component becomes inoperative — the other policy sections (incident response, BI, data breach, restoration) remain active. For the wider private sector, a mandatory pre-payment notification regime to the NCA applies. Specialist cyber policies in 2026 include the procedural compliance support to navigate this — the breach coach manages the notification process. Most ransomware claims in 2026 resolve without ransom payment because backups are intact; the policy's other components do the heavy lifting.
Business email compromise (BEC) — fraudulent payment redirection following email account compromise — is the most common SME cyber claim by frequency in 2026. Cyber policies typically cover BEC losses under a "cyber crime" or "social engineering" sub-limit, which on many standard policies is capped at £25,000–£100,000. Typical UK SME BEC losses run £40k–£200k, leaving most actual losses uninsured. Specialist negotiated cover extends the sub-limit to £250k–£500k for a typical £200–£400 premium uplift. This is the single highest-ROI cyber policy improvement an SME can make. Get written broker confirmation of your sub-limit and the cover scope.
The baseline 2026 underwriting expectation aligns to Cyber Essentials v3.3 ("Danzell", commenced 27 April 2026): MFA mandatory on all cloud services where available; 14-day patching for critical vulnerabilities; secure configuration; access control with privileged access management; malware protection including EDR; firewalls. Beyond Cyber Essentials, insurers expect: immutable or air-gapped backups tested quarterly; documented incident response plan with named DFIR contact; phishing awareness training; network segmentation; dual authorisation for outgoing payments. Without MFA, EDR, and tested backups, most insurers will decline or apply heavy loadings. The control investment typically pays back within 18 months through reduced premium and reduced claim exposure.
Regulatory fines under UK GDPR are technically uninsurable to the extent they're penal (UK public policy). However, the defence costs of contesting an ICO investigation — routinely £200k–£2m for a contested investigation — are insurable and should be covered under your cyber policy's privacy liability section. Group action claims from affected data subjects (the parallel exposure to ICO investigation) are also insurable. The Capita (£14m), Advanced Computer Software (£3.07m), and 23andMe (£2.31m) fines in 2025 illustrate the regulatory exposure but also the defence cost layer that insurance can address. Specialist cyber policies in 2026 explicitly scope ICO investigation defence costs — generic cyber cover may not.
Insurance non-disclosure under the Insurance Act 2015. The pattern: SME completes cyber proposal form quickly, IT lead not consulted, "yes" answers given to MFA, backup, and patch management questions that don't survive detailed technical review. At claim stage, the insurer reviews the proposal answers against the actual environment at the time of incident, identifies discrepancies, and avoids the policy entirely. This isn't fraud; it's the normal operation of UK insurance law requiring "fair presentation of the risk". The fix at proposal stage is rigorous, evidenced answers — typically minimal cost. The retrospective cost is potentially every uninsured claim across multiple policy years. Get written broker confirmation that all material facts have been disclosed.
The single biggest premium reduction lever is documented Cyber Essentials v3.3-aligned controls: MFA complete on cloud services and remote access; managed EDR deployment; immutable backups tested quarterly; 14-day patching with evidence; documented incident response plan; PAM in place. Cyber Essentials Basic reduces premium 10–15%; Plus reduces 15–25%; ISO 27001 for mid-market reduces 20–30%. Other levers: accurate data sensitivity declaration; limits matched to actual exposure (don't over-buy headline limit while under-sub-limiting BEC); 3+ years continuity with same insurer; specialist broker placement vs generic. Avoid the trap of buying the cheapest generic cyber package — the saving is dwarfed by uninsured claim exposure.
Yes — and arguably more so than businesses with on-premise estates. Cloud service providers (Microsoft, Google, AWS) are responsible for the security of the cloud infrastructure; you remain responsible for the security of your configuration, your data, and your users — the "shared responsibility model". The vast majority of cloud-related cyber claims arise from customer-side configuration failures, weak access management, or credential compromise — not from the cloud provider's infrastructure. The cloud provider's terms of service typically exclude liability for your data loss or unavailability. Cyber insurance is what fills that gap. Contingent BI scope is important for cloud-dependent businesses — see the BI section for the specific cover requirement.
Look for brokers with specific experience in cyber insurance and the 2026 regulatory framework evidenced by: specialist articles on cyber cover, Cyber Essentials underwriting, and incident response; willingness to discuss specific exposures (ransomware payment regime, BEC sub-limits, ICO defence, contingent BI) in detail; access to Lloyd's market and specialist cyber MGAs rather than just mainstream commercial markets; FCA authorisation and documented track record. Avoid brokers offering cyber as an add-on without discussing specifics; brokers who accept proposal form answers at face value without technical challenge; brokers who can only quote one or two markets. Miller & Partner specialise in cyber and tech sector placements — see our cyber insurance product page, AI and tech product page, and broader cyber insights hub.
Instagram
LinkedIn