Cyber insurance: When SMEs are left to pay
4 min read
A cyber attack can interrupt operations and lead to data recovery costs. Cyber insurance can cover such consequences if they are included in the contract. For small and medium-sized enterprises, the insured events, limits of cover and obligations in the event of a claim therefore matter. The information provided in the application also deserves careful scrutiny.
Key points at a glance
- The contract determines the cover. A policy may include costs for forensic investigations, business interruption, data recovery and liability claims.
- Check exclusions and limits. Excesses, compensation limits and provisions on state-sponsored attacks affect which costs remain with the company.
- Answer application questions carefully. Incorrect information can have consequences for the contract and any insurance payment. The insurer’s rights depend on the statutory conditions being met.
What losses a policy can cover
What is cyber insurance? It is an insurance contract covering agreed consequences of certain IT security incidents. The events and costs covered are set out in the insurance certificate, terms and endorsements.
The non-binding model terms of the German Insurance Association distinguish between several components. These include costs for investigating an incident, liability cover and the policyholder’s own losses from business interruption and data recovery. The model provides guidance. A specific offer may differ from it.
Management should examine the company’s own dependencies: Which applications must be available for operations? Which data must be restored? What would be the consequences of an external service provider’s failure? These questions can help determine whether an offer covers the relevant scenarios.
Where cover and support end
The sum insured alone does not show how much will be reimbursed following an incident. Companies should also check excesses, separate limits for individual benefits and the conditions for compensation in the offer. For business interruption, relevant factors include which disruptions are insured and the period for which the contract provides cover.
Exclusions deserve the same attention. Provisions on war or state-sponsored cyber attacks can vary between contracts. If a service provider is attacked, companies should also check whether its failure is included in the agreed cover. No general statement applies to all insurers.
For support services, what matters is how the company can reach the insurer and what assistance has been promised. Before engaging their own specialists, companies should clarify what coordination the contract requires and which costs may be covered.
The possible consequences of incorrect application details
Before a contract is concluded, insurers ask about circumstances material to their decision. This can concern the IT security measures in place. Management and IT should review the answers together and document the basis for them.
Under the German Insurance Contract Act, incorrect or incomplete information can, under certain conditions, give the insurer rights such as withdrawal from, termination of or adjustment to the contract. Among other things, this depends on fault and the other statutory conditions. An error therefore does not automatically entitle the insurer to refuse every payment.
Agreed security and notification obligations can also be relevant after the contract has been concluded. Companies should record who monitors the requirements, who reports an incident and which documents the insurer needs.
Assessing offers against your own risks
To compare offers, management, IT and, where appropriate, an insurance adviser should review the same scenarios. These include an encrypted system, restoration from backups and the failure of a business-critical application. Each offer can then be assessed to establish which costs are covered and which remain with the company.
Alongside the premium, the agreed cover, excess and support stipulated in the contract all matter. A general calculation of how many years it takes for a policy to pay for itself cannot replace this assessment. Whether the cover suits the company depends on its risks and the specific offer.
Frequently asked questions
Does cyber insurance cover every business interruption?
That depends on the contract. Companies should check which causes and systems are covered and which compensation limits apply.
Does incorrect information in the application always lead to a loss of cover?
No. The possible consequences depend on the circumstances and the statutory conditions. These include whether the duty of disclosure was breached through fault.
What should companies check when it comes to support services?
The decisive factors are the services promised, the reporting channel and the conditions under which costs for external specialists will be covered.
Read more on MyBusinessFuture
MyBusinessFutureData governance in SMEs: A practical look at the new DGGMyBusinessFutureOut of the US Cloud: WhatMyBusinessFutureAI in Accounting: Automation for SMEsMore from the MBF Media Network
SecurityTodayCyber insurance 2026: What companies need to know before taking out a policySecurityTodayRansomware 2026: Incident response in the first 60 minutesImage source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
