Cyber Insurance
Cover for hacks, data breaches and online fraud
- Compare quotes from specialist UK providers
- Your own losses and claims from others
- One short form for your business
Cyber cover pays for the fallout from a hack, data breach or online fraud: your own losses, plus claims from people whose data was affected. It’s a live risk, as 43% of UK businesses reported a cyber breach or attack in the previous 12 months (Cyber Security Breaches Survey 2025).
Policies differ more than most business covers, so this page focuses on what to check.
Does your business need cyber cover? A quick check
If you answer yes to two or more of these, cyber cover is worth pricing.
| Ask yourself | Why it matters |
|---|---|
| Do you hold customers’ personal data? | A breach can bring claims and a duty to report to the ICO |
| Do you take card payments online? | Payment systems are a common target |
| Do staff approve payments by email? | Fake invoice and payment scams usually start with an email |
| Would you stop trading if one system failed? | Lost income while you recover can outweigh the repair bill |
| Do clients ask about your cyber security? | Some clients, including large firms checking their supply chains, ask suppliers for Cyber Essentials (GOV.UK) |
What cyber insurance covers, and what it often doesn’t
Cover splits into your own losses and claims from other people. The NCSC says to understand in detail what a policy excludes, as well as what it covers. Some policies won’t pay for money lost through business email compromise fraud (NCSC). Other gaps vary by policy.
| Usually covered | Often not covered |
|---|---|
| Theft of funds and data after a cyber event | Claims from your own staff or contractors over their data |
| Damage to software, data and other digital assets | Claims brought in North America, which some UK policies exclude |
| Investigation and legal defence costs | Upgrades to systems that were out of date before the attack |
| Compensation to people affected by a breach | Losses you knew about before the policy started |
| Specialist help to manage the incident | Fake invoice fraud, unless the policy adds it |
Phishing: the attack most firms actually see
Phishing is by far the most common cyber attack. Among UK businesses that identified a breach or attack, 85% experienced phishing, according to the 2025 survey.
Simple habits cut the risk and can help when you apply for cover:
- turn on two-step login for email, banking and accounting tools
- call a known number to check any change to a supplier’s bank details
- keep devices and software up to date
- back up data somewhere an attacker can’t reach
After a data breach: the 72-hour rule
If personal data is breached, the clock starts quickly. The ICO says that if a risk to people is likely, you must tell it as soon as possible and, where feasible, within 72 hours. If the risk is high, you must also tell the people affected (ICO).
This is where a cyber policy’s incident line earns its keep. Specialists can help you work out what happened, who to tell and how to get systems running again.
Cyber Essentials and the cost of cover
Cyber Essentials is the government-backed minimum standard, built on five technical controls (NCSC). GOV.UK says organisations with those controls in place make 92% fewer insurance claims (GOV.UK).
Insurers may ask whether you hold it. Even if you don’t certify, the controls make a sound checklist before you quote.
What you need before you get a quote
- Your turnover and number of staff
- Roughly how many customer records you hold
- Whether you take payments online and how
- Your backups, two-step login and update routine
- Any Cyber Essentials certificate
- Any cyber incidents in the last five years
Compare cyber cover with Tiger.co.uk
One short form goes to specialist UK providers, who come back with quotes. Tiger.co.uk is a trading style of Big Cat Ventures Ltd, which introduces you to Seopa Ltd. Seopa runs the quote system and is authorised and regulated by the Financial Conduct Authority (FRN 313860).
Related covers: professional indemnity insurance for mistakes in your work, and directors’ and officers’ insurance if you sit on a company board. See every option on our business insurance hub.
What does cyber insurance cover for a small business?
Two kinds of loss. First-party cover pays your own costs, such as stolen funds, lost data and damage to digital assets. Third-party cover pays claims from others, including investigation and defence costs and compensation to people affected. Most policies also include help from incident specialists.
How much could a cyber attack cost a small business?
It varies widely. In the government’s 2025 survey, among businesses that experienced cyber crime (excluding phishing), the mean cost was £990, or £1,970 counting only those who reported a cost (DSIT). Lost trading time and claims from customers can push the total higher.
Is cyber insurance a legal requirement?
No. The cover GOV.UK says is compulsory for employers is employers’ liability (GOV.UK). Some clients and contracts do ask suppliers to hold cyber cover or a Cyber Essentials certificate, so check your contracts.
Does cyber insurance cover ransomware?
Many policies include cyber extortion and the cost of restoring systems after a ransomware attack, but wording differs. Some pay only the clean-up, so check how each policy treats extortion and whether the insurer must agree any response first.
Do I need Cyber Essentials to get cyber cover?
Not always, but insurers may ask about it. Certification can bring cover of its own: GOV.UK says Cyber Essentials comes with free cyber insurance if your business turnover is less than £20 million (GOV.UK). Check whether that cover’s limits are enough for you.
Am I covered if a member of staff pays a fake invoice?
Only if the policy includes social engineering or funds transfer fraud, which is often a separate section with a lower limit. Ask about it directly, as phishing emails asking for payment are a common route in.
Ready to compare? Get cyber insurance quotes through Tiger.co.uk. Check the territory, the fraud section and the excess before you buy.
Fact-checked by Ian Wilson, Managing Director at Tiger.co.uk. 20+ years in price comparison; MEng, Queen’s University Belfast.