Technology and Cyber Insurance for UK businesses
Cover for the cost of a cyber attack, data breach or system outage, from the first call to an incident response team to the claims and lost income that follow. Compare policies through specialist brokers who know what insurers expect from your security controls.
- Round the clock incident response team
- Lost income while systems are down
- Data breach claims and investigation costs
Reviewed October 2026 by the MyBusinessComparison.com editorial team
What is cyber insurance?
Cyber insurance pays for the cost of responding to and recovering from a cyber incident, such as ransomware, hacking, a data breach or a network outage. It usually covers expert response, data restoration, lost profit while systems are down, extortion demands, and claims and investigations brought by people whose data was exposed.
Most policies combine first party cover, for your own costs and lost income, with third party cover for claims against you. The incident response service is often the part businesses value most: a single number connects you to forensic investigators, breach solicitors and communications advisers within hours.
Technology and cyber policies go a step further for firms that build, supply or support technology, adding technology professional indemnity for claims that your software, system or service failed a client. Software, SaaS and AI businesses can see the detail on our page about insurance for technology companies.
Cyber insurance at a glance
- Suits
- Any established firm that relies on IT systems, email, payments or personal data
- First party
- Incident response, data restoration, business interruption and extortion
- Third party
- Privacy and network security claims, investigations and media liability
- Often optional
- Funds transfer fraud, social engineering and hardware replacement
- Insurers check
- Multi-factor authentication, backups, patching and staff training
- Tech firms add
- Technology professional indemnity for failures of your product or service
What does cyber insurance cover?
Policies are split into first and third party sections, each with its own limit. These are the sections most UK cyber policies offer.
Incident response
Forensic investigators to find and contain the attack, breach solicitors to manage notifications, and public relations support. Some insurers pay these costs without applying the excess.
Business interruption
Lost gross profit and extra costs when a cyber event takes systems down, after a waiting period measured in hours. Some policies extend to outages at your cloud and software suppliers.
Read more about business interruption insurance
Data and system restoration
The cost of restoring, recreating or recollecting data and rebuilding systems from backups after an attack or a damaging error.
Cyber extortion
Specialist negotiators and the response to ransomware or threats to publish stolen data, including a payment where it is lawful and the insurer has agreed it in advance.
Privacy and data liability
Claims from customers, staff and others whose personal data was lost or exposed, and the cost of notifying them and offering credit monitoring.
Investigations and penalties
Defence costs in an investigation by the Information Commissioner's Office or another regulator, and fines only where they can be insured.
Network security liability
Claims that your systems passed malware to a customer or supplier, or that a breach of your network caused them a loss.
Media liability
Claims for defamation or copyright infringement arising from your website, social media and digital marketing.
Cyber crime
Money lost through hacked accounts, fake invoices and impersonation of directors or suppliers. Usually optional and subject to a lower limit.
Read more about crime and fidelity insurance
Technology professional indemnity
For firms that supply software, IT services or connected products: claims that your product or service failed, had errors or did not perform as agreed.
Read more about cover for technology companies
Extensions worth asking about
- System failure: lost income from an outage caused by a non-malicious error, such as a failed update
- Hardware replacement: replacing laptops, servers and devices left unusable after an attack
- Reputational harm: loss of profit from customers who leave after a publicised breach
- Payment card assessments: card scheme penalties and assessments after a breach of card data, on policies that include them
- Telephone hacking: call charges run up when a phone system is compromised
Who needs cyber insurance?
Any business that would struggle to trade without its systems, or that holds personal or payment data. These are the firms where the exposure is sharpest.
Build or sell technology? Software, SaaS and AI firms need cover for their product as well as their systems. See technology company insurance.
- Professional services firms: client files, client money and email-based payments make them targets for invoice and conveyancing fraud
- Retailers and online sellers: card payments, e-commerce sites and tills that stop working in an outage
- Manufacturers: connected production lines and ordering systems where downtime halts output
- Wholesalers and distributors: warehouse management and order systems that ransomware can freeze
- Healthcare and care providers: patient records and clinical systems with little tolerance for downtime
- Recruitment agencies: large volumes of candidate identity documents and payroll data
- Hospitality groups: booking platforms, card data and guest details across several sites
- Hauliers and logistics firms: tracking, routing and dispatch systems that keep vehicles moving
- Construction companies: large stage payments that criminals try to divert with fake bank details
- Software, SaaS and AI companies: their own systems plus liability for the products they supply to clients
- Property owners and managing agents: tenant data, service charge accounts and building management systems
How much does cyber insurance cost?
Cyber premiums are set mainly by your revenue, your data and the strength of your security. Insurers look closely at these factors.
Turnover and sector
Revenue gives the scale of the business at risk, and sectors with sensitive data or heavy reliance on systems are rated higher.
Data held
The type and volume of personal, health and payment card records drive the cost of a breach, so they drive the premium.
Security controls
Multi-factor authentication, endpoint detection, patching and access management are core questions. Gaps can lead to higher terms or a decline.
Backups and recovery
Offline or isolated backups that are tested regularly reduce the cost of a ransomware attack, and insurers ask how quickly you could restore.
Limits and waiting period
The overall limit, sub-limits for cyber crime and the hours before interruption cover starts all affect the price.
Incident history
Past attacks, breaches and near misses, and what was improved afterwards, are reviewed carefully.
What cyber insurance does not cover
Cyber policies vary more than most covers, so these exclusions are worth checking line by line.
- Incidents that began, or that you knew about, before cover started
- Failure of power, internet or other infrastructure outside your control, unless the policy says otherwise
- Cyber operations carried out by or for a state, which many insurers now exclude in defined circumstances
- Losses linked to a security control, such as multi-factor authentication, that was declared but not actually in place, which can reduce or remove cover
- Upgrading systems beyond their condition before the attack, unless a betterment extension applies
- Physical damage to property, which belongs under commercial property insurance
- Patent infringement and most disputes over trade secrets
- Money lost to fraud above the cyber crime sub-limit, which may need a crime policy
Cyber insurance or technology professional indemnity?
Firms that sell technology often need both. Cyber protects your own systems and data; technology PI protects you when what you supply lets a client down.
| Feature | Cyber insurance | Technology PI |
|---|---|---|
| Main trigger | An attack, breach or outage affecting your systems | A client says your software or service failed or had errors |
| Your own losses | Yes: response costs, lost income, data restoration | No, it covers claims against you |
| Client claims | When a breach of your network harms them | When your product or service causes them a financial loss |
| Contract demands | Often required by clients who share data with you | Often required in software, IT and consultancy contracts |
| Usually suits | Every business that relies on IT or holds data | Firms that build, sell, host or support technology |
How to compare cyber insurance
Cyber proposal forms are detailed. Gathering this first gives the broker a stronger case to put to insurers.
Map your systems
Key software, cloud services, payment systems and the suppliers you rely on, and how long you could trade without each.
Describe your data
The personal, health and card records you hold, roughly how many, and where they are stored.
Document your controls
Multi-factor authentication, endpoint protection, patching, backups, staff training and any certifications.
Set your limits
Think through a realistic worst case: response costs, weeks of lost profit and claims from customers.
Compare the detail
Check waiting periods, sub-limits, state-backed attack exclusions and the response team you would call.
Talk to a cyber specialist
Tell us about your systems, data and turnover, and a specialist broker will compare cyber cover for you.
Compare cyber coverCyber insurance FAQs
How much does cyber insurance cost?
It depends on turnover, sector, the data you hold, your security controls and the limits you choose. Firms with multi-factor authentication, tested backups and patching in place get better terms. A broker can show how each control affects the quote.
Does cyber insurance pay ransomware demands?
Some policies will reimburse an extortion payment where paying is lawful and the insurer has agreed in advance. The larger value is usually in the negotiators, forensic investigators and data restoration that come with the cover.
Is cyber insurance worth it if we use cloud software?
Usually, yes. Cloud providers protect their own platform, not your accounts, your data or your lost income. Phishing, stolen logins and fake invoices still reach businesses that run everything in the cloud, and some policies cover outages at your providers.
Does cyber insurance cover invoice fraud?
Often, through an optional cyber crime or social engineering section with its own sub-limit. Larger losses, or theft by your own staff, are better handled by crime and fidelity insurance. Check that the two policies fit together.
What security do insurers expect before they offer cover?
Most insurers now ask about multi-factor authentication on email and remote access, offline or isolated backups, endpoint protection, prompt patching and staff phishing training. Missing controls can mean higher terms, lower limits or a decline.
Can a cyber attack be covered under our commercial combined policy?
Rarely in full. Property and interruption sections usually exclude cyber events or offer only a small amount of cover. A standalone cyber policy is designed for data, systems and the claims that follow a breach.
Do we need technology professional indemnity as well as cyber?
If you supply software, IT services, hosting or connected products, usually yes. Cyber covers attacks on your systems; technology PI covers claims that what you supplied failed a client. Many insurers write both on one policy.
What happens when we make a claim?
You call the insurer's incident line, and a response team starts work straight away to contain the attack, preserve evidence and advise on notifications. Lost income and other costs are then assessed and settled under the policy.
How do I get a cyber insurance quote?
Begin with the short enquiry on this page; a broker who places cyber risks then calls back. Have your turnover, the data you hold, a summary of your security controls and any past incidents ready so the broker can approach insurers straight away.
Ready to compare cyber insurance?
Incident response, lost income and data claims covered, arranged by a broker who understands what cyber insurers look for.