Cyber Insurance for UK Small Businesses Explained

Cyber insurance can pay for the specialists, lost income and legal costs that follow a cyber attack. It cannot stop an attack happening, and a policy is only as reliable as the answers you gave when you bought it. This guide explains what UK cyber policies typically cover and exclude, what insurers ask about, and how to prepare.

Omega IT is not an insurer or broker, and this is general information, not insurance advice. Speak to a broker or insurer about cover for your business, and always read the policy wording itself.

The short answer

A cyber insurance policy helps a business respond to and recover from a cyber incident. According to the Association of British Insurers (ABI) and PwC's UK Cyber Insurance Market Assessment (August 2026), ransomware and extortion cover is now a standard market feature, and policies commonly include incident response, IT restoration and business interruption cover.

Few UK businesses have a dedicated policy. The government's Cyber Security Breaches Survey 2025/2026 (CSBS) found only 10% of businesses had a specific cyber insurance policy, although 47% said they were insured against cyber risks in some way.

Insurers also expect the basics. The same ABI and PwC report says insurers' growing appetite to offer cover is conditional on minimum standards, in particular multi-factor authentication (MFA), immutable backups and incident response planning. And if your turnover is under £20m and you certify your whole organisation to Cyber Essentials, you may be entitled to a basic cyber liability policy through IASME, covered below.

What cyber insurance typically covers

The ABI and PwC report lists the covers commonly found in UK policies:

• Incident response, legal and forensic costs: specialists to investigate what happened and advise you.
• IT restoration: the cost of restoring systems and data.
• Business interruption: income lost while you can't trade normally.
• Cyber extortion and ransomware: now standard, including cover for the ransom payment itself "where legally permissible", in the report's words.
• Crisis management and PR: help communicating with customers and the press.
• Social engineering: losses from people being tricked, which the report says is "often sub-limited", meaning a lower limit applies than to the rest of the policy.
• Third-party liability: network security and privacy liability claims from others affected by an incident.
• Regulatory defence: the cost of dealing with a regulator's investigation.

Whether to pay a ransom at all is a separate question, covered in our ransomware attack response guide.

Claims are getting bigger. The report cites ABI data showing 642% growth in the value of the average claims settlement between 2017 and 2025. In 2024, insurers taking part in the ABI's data collection paid out £197 million on cyber claims, a 230% increase on 2023. Malware and ransomware accounted for 51% of claims, up from 32% the year before. Those ABI figures cover participating insurers only, not the whole market.

What it usually doesn't cover

The same report lists common exclusions:

• War and state-backed attacks. Check exactly how your policy defines them.
• Bodily injury.
• Infrastructure failure. Again, the definition in your wording matters.
• Property damage.
• Betterment: upgrades that leave you better off than before the incident, rather than like-for-like restoration.

Look closely at fraud. Cyber insurance guidance from the National Cyber Security Centre (NCSC), published in 2020, warns that "some insurance policies will not cover monies lost through business email compromise fraud", where criminals impersonate a supplier or colleague by email to redirect a payment. Where social engineering cover is included, it is often sub-limited. Our guide to phishing and invoice fraud explains how these scams work and the payment checks that stop them.

What insurers will ask you

Expect a proposal form: the insurer's questionnaire about your business and its security. The ABI's Good Practice Guidance on cyber resilience and its August 2026 announcement set out the measures it recommends:

• MFA: the guidance says "phishing-resistant forms of MFA are strongly preferred", naming authenticator apps, passkeys and biometric authentication. The NCSC is stricter: it regards app codes and push approvals as phishable, so passkeys are the stronger choice where available. Our MFA guide and our guide to password managers and passkeys cover the rollout.
• Backups: reliable offline backups, with immutable backups named in the market assessment. A backup is only reliable if you have tested restoring it.
• Endpoint protection: the guidance says anything beyond a handful of devices will likely need an endpoint protection platform (EPP) or endpoint detection and response (EDR) tool.
• Patching: the guidance notes that Cyber Essentials requires critical vulnerabilities to be patched within 14 days of being identified.
• The rest: an incident response plan, staff training, logging and monitoring, encryption and checks on your suppliers.

The NCSC also notes that some insurers offer discounts to organisations that already have recognised cyber security defences.

How many UK businesses have it

The Cyber Security Breaches Survey 2025/2026, published in April 2026, gives the clearest picture:

• 47% of businesses reported being insured against cyber risks in some way, up from 43% in 2023/2024 and 45% in 2024/2025.
• Only 10% had a specific cyber security insurance policy, rising to 24% of medium and 32% of large businesses.
• Small (55%) and medium (61%) businesses were more likely than businesses overall to have some form of cover.
• 22% did not know whether they had any form of cyber insurance.

The barriers the survey identified included lack of awareness of cyber insurance (39%) and it not being a budgetary priority (34%). The gap between "some form" of cover and a specific policy matters: cyber cover bolted onto another policy may not include the incident response and business interruption elements described above. If you are not sure what you have, ask your broker.

The insurance that comes with Cyber Essentials

According to IASME, a UK-domiciled organisation with a turnover under £20m that achieves self-assessed Cyber Essentials certification covering the whole organisation is entitled to cyber liability insurance. The conditions are that the entire organisation is certified, it is domiciled in the UK or the Crown Dependencies, its annual turnover is under £20m, and it opts in.

The policy has a £25,000 total limit of indemnity. It is underwritten by American International Group UK Limited and administered via Sutcliffe & Co Insurance Brokers. IASME lists cover for liability, event management (such as legal, IT, data recovery and notification expenses), extortion threats, regulatory investigations and fines where insurable by law, and business and network interruption.

Know its limits. There is a £1,000 excess (£5,000 for claims arising from activities in the USA or Canada) and a six-hour network interruption retention, and it excludes money stolen by electronic means or cyber fraud. You must install and maintain automatically provided updates for critical business software. Cover starts from certification, lasts 12 months and "cannot be renewed on its own". Compare that £25,000 limit with your own estimate of what a serious incident would cost your business.

Our Cyber Essentials self-assessment guide explains how to prepare for certification.

Filling in the proposal form honestly

The NCSC is blunt: "If you're claiming that security measures are in place when they're not, the insurer may not be obliged to pay any claims." Before you complete a proposal form:

• Involve whoever runs your IT. Questions about MFA, backups and patching need precise answers, so ask your IT provider or IT lead to check them.
• Answer for the whole business. MFA on email is not the same as MFA on every cloud service and remote access route. Cyber Essentials now requires MFA on all cloud services where it is available, and IASME says organisations that don't use it will automatically fail.
• Gather evidence. Reports or screenshots showing MFA coverage, backup jobs and restore tests, patch status and endpoint protection make your answers easier to stand behind.
• Don't guess. If a question is unclear, ask the broker or insurer what it means.
• Keep a copy of what you submitted, and check whether the policy requires you to tell the insurer about changes during the year.

The NCSC notes that most cyber policies are reassessed every 12 months, so treat the form as an annual health check on your security.

Reading the policy before you need it

A policy you have never read is little help at 2am during an incident. Check:

• Exclusions: how the wording defines war, state-backed attacks, infrastructure failure and betterment.
• Sub-limits: lower limits for social engineering and fraud, and whether business email compromise is covered at all.
• Excess and waiting periods: what you pay towards a claim and how long an outage must last before business interruption cover starts.
• Incident response arrangements: whether you must call the insurer's helpline or use its approved panel of responders, and whether your own IT provider can work alongside them.
• Notification: how quickly you must tell the insurer, and who in your business can do it.
• Conditions: anything you must keep doing for cover to apply, such as the IASME policy's requirement to install updates.

Put the insurer's incident contact details in your incident response plan and share them with your IT provider. If your provider is medium or large, the Cyber Security and Resilience Bill, which is not yet law, would require it to tell you about breaches likely to affect you once the relevant rules are in force.

Insurance is not a security plan

"Cyber insurance will not instantly solve all of your cyber security issues," the NCSC warns, and it recommends having fundamental safeguards in place, such as those certified by Cyber Essentials. A policy can pay for recovery; it cannot stop the attack or give back the time your team and customers lose.

The controls insurers ask about are the same ones that make a claim less likely, yet the CSBS found only 47% of businesses require two-factor authentication and only 25% have a formal incident response plan. Start with MFA on every cloud service, tested backups (see disaster recovery and business continuity for SMEs), endpoint protection, prompt patching, removing leavers' access (our starters, movers and leavers checklist helps) and a written incident response plan. Then use insurance for the risk that remains.

How Omega IT can help

Omega IT is a UK IT support company and is Cyber Essentials Plus certified, but it is not an insurer or broker, so for the cover itself please speak to a broker or insurer. For the controls insurers ask about, from MFA to backups and endpoint protection, talk to our team about cyber security or managed IT support, or request a free, no-obligation quote.

Sources

• ABI and PwC: UK Cyber Insurance Market Assessment (August 2026)
• ABI: Good Practice Guidance on cyber resilience (August 2026)
• ABI: New ABI publications outline path to stronger cyber resilience (19 August 2026)
• ABI: Nearly £200 million paid in cyber claims to help UK businesses recover (10 November 2025)
• NCSC: Cyber insurance guidance (6 August 2020)
• NCSC: Passkeys are more secure than traditional ways to log in (23 April 2026)
• IASME: Cyber Liability Insurance
• IASME: Important update: changes to Cyber Essentials for April 2026 (12 February 2026)
• GOV.UK: Cyber security breaches survey 2025/2026 (30 April 2026)

General guidance, accurate to October 2026. Diagrams by Omega IT.