Cyber Insurance
Cyber insurance covers the costs of a digital incident: ransomware, data breach, business interruption from a system outage, and the regulatory fallout that follows. For any business that stores customer data or depends on digital systems, it's become as essential as property cover.
We place cyber cover with insurers who actively underwrite the class, not legacy policies that silently exclude modern attack vectors. The right policy pays the ransom, funds the forensic investigation, and handles the regulator.
Cover
What this typically covers
Hour 0Data breach response
The first call you make. Someone works out what was taken, how they got in, and whether they are still inside. Almost nobody has this skill on staff, and hiring it in the middle of an incident, at whatever rate is quoted that night, is what makes the first day so expensive.
Forensic investigation, legal advice, regulator notification, and customer notification costs.
Hours 0 to 72Ransomware & extortion
If your systems are locked and someone is asking for money, this covers the negotiator, and the payment itself where the law allows it. The negotiator matters more than the money: they know what this particular group has done to people who paid.
Ransom payments (where legal), negotiation services, and restoration costs after an attack.
Day 1 onwardBusiness interruption
The trading you lose while nothing works. It also answers when the outage is not yours. A supplier you depend on goes dark, and you cannot trade either. That extension is the one most policies leave out.
Lost revenue while systems are down, including dependent business interruption when a supplier is hit.
Week 1 to 4Data restoration
Rebuilding the records themselves. Property cover replaces the hardware; this replaces the years of data that lived on it, and pays for the work of putting it back.
Cost of rebuilding data, systems, and digital assets after an attack or system corruption.
Month 1 onwardThird-party liability
The people whose information you were holding when it was taken. They can come after you for it, and the defence costs usually arrive long before any finding does.
Claims from customers, suppliers, or partners whose data or systems were affected by a breach originating with you.
Month 6 onwardRegulatory penalties
The Information Regulator's response, which arrives last and takes the longest. POPIA requires you to notify as soon as reasonably possible after you discover a compromise, and how quickly you did that shapes what follows. Some penalties are insurable and some are not; that turns on the law, not on the policy.
POPIA, GDPR, and other regulator-imposed penalties where insurable by law.
Limits
What this will not cover
The patch you did not apply
Most wordings expect reasonable security: supported software, patching within a stated window, multi-factor authentication on remote access. A breach through a vulnerability that was published and patched months earlier is where insurers argue hardest.
Anything you already knew about
A cyber policy answers for incidents discovered during the period. An intrusion that began before cover started, or one already known to you when you took the policy out, is not a new event.
Your own hardware
Replacing the physical machines is property cover, not this. Cyber pays for the data, the response, and the lost trading; the laptop belongs on another schedule.
Fines the law will not let anyone insure
Where a penalty is uninsurable as a matter of public policy, no wording can pay it. This varies by jurisdiction and it is worth knowing which side of the line a given exposure falls on before you need to.
Claim
When you claim
Call the incident line before you touch the system
Insurers run a 24-hour response panel, and the sequence matters: rebuilding a server or wiping a laptop destroys the forensic evidence the claim is proved on, and can breach the policy's own conditions.
POPIA runs on its own clock
A breach of personal information has to be reported to the Information Regulator and to the people affected, and the timing is set by the Act rather than by your insurer. The policy pays for that process and puts specialists on it, but the obligation stays yours.
Interruption is measured out of the books
The trading loss from an outage is calculated, not estimated, and most wordings only start counting after a waiting period measured in hours. Keep the timeline: when it started, when it was found, when each system came back.
Questions
Frequently asked questions
Size is not what attackers select on. Reachable systems and payable ransoms are. The smaller the business, the less likely it is to have the cash and the people to handle a breach alone, and that capacity is most of what this policy actually buys.
Where extortion cover is in place and payment is lawful, it can respond, but the negotiation and the decision run through the insurer's incident panel. Paying first and telling the insurer afterwards is the reliable way to lose the claim.
Notification to the Information Regulator and to the people affected, in the form and within the timing the Act sets. The policy funds that process and puts specialists on it, and the obligation stays yours regardless of who is doing the work.
Their professional indemnity answers if they were negligent, up to their limit, after an argument about fault. It is not cover for your interruption, your notification costs, or your own regulatory exposure.