Does my existing business liability policy cover a cyber attack?

Standard public liability and professional indemnity policies typically do not cover first-party cyber losses — meaning your own costs of responding to a breach, paying a ransom, or recovering data. Some may cover third-party liability if a breach of your systems leads to a client loss, but coverage is often limited and disputed. The ABI guidance on cyber insurance sets out the standard coverage gaps in general business policies.

What should I do immediately after a ransomware attack?

Do not pay the ransom until you have spoken to your insurer and a specialist cybersecurity firm — many insurers require pre-approval before ransom payments will be covered, and there are alternatives. Isolate affected systems, preserve logs, and notify your insurer under the policy's notification requirements. In the UK, a personal data breach also requires notification to the ICO within 72 hours if it is likely to affect individuals' rights and freedoms.

Is cyber insurance worth it for a sole trader or very small business?

It depends on your digital exposure. A sole trader who stores client financial data, uses cloud-based accounting software, or processes payments online has genuine cyber risk. A basic cyber policy for a sole trader can cost as little as £100–£200 per year. The cost of a single ransomware incident — lost income, IT recovery, and regulatory notification — often exceeds £10,000 even for small firms. The NCSC Small Business Guide provides free baseline advice on cyber risk management.

Industry All regions Published 2026-10-13 6 min read

Cyber insurance: why small businesses and freelancers now need to consider it

Ransomware, business email compromise, and data breach costs have grown significantly for smaller organisations. This article explains what cyber insurance covers, what it does not, and how to assess whether you need it.

Why cyber risk has reached smaller organisations

Cyber attacks were once predominantly targeted at large enterprises with valuable data stores. That has changed significantly. Automated attack tools have lowered the cost and skill barrier for criminal groups, and small businesses — which often have weaker security postures — have become disproportionately targeted.

According to the UK National Cyber Security Centre, ransomware and business email compromise (BEC) are the two most financially damaging cyber threats facing small and medium businesses today. BEC — where an attacker impersonates a supplier or colleague to redirect payments — requires no technical vulnerability: only a convincing email.

The Swiss Re Institute estimates global cyber insurance premiums have more than tripled since 2020, reflecting the growing frequency and severity of incidents across all business sizes.

What cyber insurance typically covers

Cyber policies vary considerably, but most cover a combination of first-party and third-party costs:

First-party costs

IT forensics and incident response
Data recovery and system restoration
Ransom payment (often with pre-approval)
Business interruption losses during downtime
Crisis communications and PR
Regulatory notification costs

Third-party liability

Claims from clients whose data was compromised
Regulatory fines and defence costs (where insurable)
Liability arising from network security failures
Media liability for online content

Policies also typically provide access to a 24/7 cyber incident response team — which can be more valuable than the financial cover itself, given that the first hours after an attack determine how much damage is contained.

Common exclusions

As with all insurance, the exclusions section is critical. Common cyber exclusions include:

Pre-existing vulnerabilities — known but unpatched security weaknesses at the time of policy inception
Nation-state attacks — some policies exclude attacks attributed to state-sponsored actors (war exclusion)
Infrastructure failure — loss caused by a cloud provider's outage rather than an attack on your systems
Social engineering without policy trigger — some policies require evidence of a covered event, which BEC may not meet without specific social engineering cover

Our overview of business insurance types covers where cyber sits alongside public liability and professional indemnity cover.

Practical steps before buying

Assess your digital exposure: what data you hold, where it lives, and what systems you depend on.
Check what your existing business liability or professional indemnity policies already cover — avoid double-insuring.
Implement baseline controls — multi-factor authentication, regular backups, staff training — which insurers increasingly require and which reduce your premium.
Compare policy wordings, not just premiums: a cheaper policy with a nation-state exclusion or a high sub-limit on business interruption may be unsuitable for your risk.
Check notification and incident response requirements carefully — missing a 24-hour notification requirement can void cover.

Cyber insurance FAQ

Frequently asked questions

: Standard public liability and professional indemnity policies typically do not cover first-party cyber losses — meaning your own costs of responding to a breach, paying a ransom, or recovering data. Some may cover third-party liability if a breach of your systems leads to a client loss, but coverage is often limited and disputed. The ABI guidance on cyber insurance sets out the standard coverage gaps in general business policies.
: Do not pay the ransom until you have spoken to your insurer and a specialist cybersecurity firm — many insurers require pre-approval before ransom payments will be covered, and there are alternatives. Isolate affected systems, preserve logs, and notify your insurer under the policy's notification requirements. In the UK, a personal data breach also requires notification to the ICO within 72 hours if it is likely to affect individuals' rights and freedoms.
: It depends on your digital exposure. A sole trader who stores client financial data, uses cloud-based accounting software, or processes payments online has genuine cyber risk. A basic cyber policy for a sole trader can cost as little as £100–£200 per year. The cost of a single ransomware incident — lost income, IT recovery, and regulatory notification — often exceeds £10,000 even for small firms. The NCSC Small Business Guide provides free baseline advice on cyber risk management.