Cyber insurance can help a business recover from an attack, but only if the policy fits and the answers on the proposal form are accurate. Here is what cover usually includes, what insurers ask and how good IT helps.
Cyber insurance has moved from a niche product to something many small businesses are asked about by clients, lenders and their own brokers. Yet it is often misunderstood. Some businesses assume their existing policies already cover cyber incidents; others buy a policy without realising it comes with security conditions they do not meet.
The UK Government's Cyber Security Breaches Survey 2025/26 found that almost half of businesses (47%) reported being insured against cyber security risks in some way, but only 10% had a specific cyber security insurance policy, and 22% did not know whether they had any cyber cover at all. This guide explains what cyber insurance typically includes, what insurers ask and how your IT setup affects both premiums and claims. It is general information rather than insurance advice, so always discuss your own needs with a qualified broker.
Policies vary, but cyber insurance for small businesses is usually built around two types of cover.
Some policies also offer cover for funds lost to social engineering or invoice fraud, but this is often an optional extension with a lower limit, so check carefully if payment fraud is a concern. Our guide to invoice fraud and business email compromise explains that risk.
The small print matters. Exclusions and conditions differ between insurers, but these are common areas to check with your broker.
Proposal forms have become far more detailed in recent years. Insurers want evidence that the basics are in place, because they reduce the chance of a successful attack and the size of any claim. Typical questions include:
| Topic | What insurers typically want to know |
|---|---|
| Multi factor authentication | Is MFA enforced on email, remote access and admin accounts? |
| Backups | How often you back up, whether a copy is offline or separate from your network, and whether restores are tested |
| Patching | How quickly security updates are applied, and whether any unsupported software is still in use |
| Endpoint protection | Whether you use antivirus or EDR on all devices, and who monitors it |
| Email security | Filtering, and processes for verifying payment requests and bank detail changes |
| Remote access | How staff connect from home and whether remote desktop is exposed to the internet |
| Admin accounts | Whether admin rights are limited and separate from everyday accounts |
| Training | Whether staff receive regular security awareness training |
| Incident planning | Whether you have a written plan for responding to an attack |
For an explanation of the difference between antivirus and EDR, which comes up often on these forms, see our guide to what EDR is.
Under the Insurance Act 2015, businesses have a duty to make a fair presentation of the risk to the insurer. In plain terms, your answers on the proposal form need to be accurate. If you answer "yes" to "Is MFA enabled for all users?" when it is actually only on some accounts, and an attacker gets in through one without it, that could put your claim at risk.
The person filling in the form is often a director or office manager who has to guess at technical questions. A better approach is to go through the form with your IT provider, who can confirm what is genuinely in place and point out anything that needs fixing before you sign. Keep a copy of the answers you gave, and revisit them if your IT changes during the year.
Insurers price risk. A business that can show strong controls is generally a better risk than one that cannot, which can make cover easier to obtain and, in some cases, more affordable. More importantly, good controls make it less likely you will ever need to claim, and more likely that a claim will be paid if you do.
A practical checklist before your next renewal:
Cyber Fits does not sell or recommend insurance, but we can help businesses in Sunderland and across the North East understand the technical questions on cyber insurance forms and put the right controls in place. If your renewal is coming up, a free IT review is a good way to check where you stand, and our cyber security page explains how we can help close any gaps.
Sometimes, but often only in a limited way. Some general business policies include small amounts of cyber cover or exclude it entirely. A specific cyber insurance policy usually provides much broader protection. Ask your broker exactly what your current policies include.
Common questions cover multi factor authentication, backups, how quickly updates are applied, endpoint protection such as EDR, email security, remote access, admin accounts, staff training and incident planning.
Yes. Claims can be reduced or refused if the incident falls under an exclusion, if the insurer was not notified promptly, or if the information given on the proposal form was inaccurate. Answering the form carefully with your IT provider reduces that risk.
Cyber Essentials covers many of the same basic controls insurers ask about, such as updates, malware protection, access control and multi factor authentication, so it can help you answer proposal forms with confidence. How each insurer treats it varies, so check with your broker.
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.
Cyber security
If ransomware hits your business, the first hour shapes everything that follows. This guide covers what to do straight away, who to call, your reporting duties and how to stop it happening again.
Cyber security
Traditional antivirus looks for known threats. EDR watches what is happening on each device and can stop an attack in progress. Here is how antivirus, EDR, MDR and XDR differ and what a small business really needs.
Cyber security
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
Book a free, no obligation IT review. We will look at your setup, tell you honestly what needs attention and give you a clear fixed monthly price.
