In brief. Cyber insurance responds in stages when a company suffers a cyberattack —it is also sold on the market as cyber risk insurance—: first the incident response and then two blocks of cover. First-party losses (incident management, data and systems restoration, loss of profit from interruption and cyber extortion) and third-party liability (claims arising from a data breach, legal defence and, where insurable, administrative fines). It is needed by any organisation that processes data or relies on IT systems. Its scope and exclusions are governed by each policy.
What is cyber insurance?
Cyber insurance exists because every company that invoices, produces or provides a service now depends on its IT systems and on the data it manages. When those systems go down —through ransomware, a leak or a fraud— activity stops and legal liability appears immediately. Cyber insurance for companies is the instrument that transfers much of that economic impact to the insurance market.
One terminological point is worth clearing up from the outset: the same cover is also sold as cyber risk insurance, "cyber cover" or "insurance against cyberattacks". They are not different products, but commercial names for the same line.
Unlike traditional property insurance, cyber cover does not respond solely to material harm. Its value lies in bringing together, within a single programme, the technical response to the incident, business continuity and the legal defence against the claims that follow. It is as much a crisis-management insurance as an indemnity one.
Does your company critically depend on its systems? Request a review of your cyber exposure with no obligation and we will assess which programme fits your activity.
Which covers are triggered after a cyberattack or ransomware, and in what order?
The covers in a cyber policy are easiest to understand by following the order in which an incident usually unfolds. The exact sequence, notice periods and channels are set by each policy.
1. Notice and incident response. This is the first part to be triggered, often within the first hours:
- Incident management: forensic analysis to determine the origin and scope, legal assistance and crisis communication to preserve reputation, on the terms provided in the policy.
- Containment: the response team helps isolate the affected systems and preserve the evidence.
2. First-party losses. These cover the harm suffered directly by the insured company:
- Data and systems restoration: the cost of recovering, rebuilding or decontaminating the affected information and infrastructure.
- Loss of profit from business interruption: the lost earnings during the period in which activity is halted by the incident.
- Cyber extortion and ransomware: management of the extortion incident, under the conditions set out below.
3. Notifications and third-party liability. This comes in when the incident reaches beyond the company:
- Notification of those affected and of the supervisory authority, where required.
- Claims arising from a data breach: compensation to clients, suppliers or third parties whose personal or confidential data has been compromised.
- Legal defence: the cost of lawyers and proceedings against civil claims and administrative files.
- Administrative fines: handling and, where legally insurable, cover for the fines imposed by the data protection authority.
In every case, the exact scope of each cover, its limits and sub-limits are governed by the terms of each policy and company. Not all insurers offer the same covers or with the same breadth. This is precisely where comparing the market makes the difference; you will see it in detail in our cover areas for large accounts.
| Section | What usually falls in | What usually falls out |
|---|---|---|
| First-party loss | Restoring data and systems · business interruption loss · cyber extortion and ransomware · incident management, with forensics and legal assistance | Incidents exploiting known vulnerabilities that were left unpatched |
| Third-party liability | Data breach claims · legal defence · administrative fines where they are legally insurable | Wilful acts by the insured · cyber warfare and state action · reputational harm with no express cover |
The scope of each section and each exclusion is governed by the terms of the policy.
How does the policy respond to ransomware?
Ransomware is the scenario that best shows how cyber insurance works, because it triggers almost all of its covers at once. In practice, the response usually follows this path:
- Notification. The company reports the incident to the insurer through the channels and within the periods set by its policy.
- Response team. The insurer makes available crisis-management and forensic specialists, who assess the extent of the encryption and any data exfiltration.
- Containment and restoration. Systems are isolated and restored from backups where feasible; the restoration and loss-of-profit covers pay, within their limits, for the cost and the downtime.
- Decision on technical and legal grounds. If the incident has exposed personal data, notifications to the authority and to those affected are assessed.
On the ransom, a single point: no policy turns it into an automatic payment —it requires prior authorisation, is subject to limits and to legal restrictions, and no policy covers an unlawful payment—. We set this out in the FAQs on our cyber cover page. The value of the cover lies above all in the professional management of the incident. The exact scope depends on each policy and jurisdiction.
Have you assessed your exposure to ransomware? Let us discuss your situation. We compare the market for you before recommending a structure.
The threats that drive companies to buy cover
Cyber cover is not arranged in the abstract: it responds to a map of concrete and growing threats. The four that most frequently drive the decision are:
- Ransomware: encryption of the company's systems in exchange for a ransom, with total paralysis of activity until recovery.
- Data breach or leak: exposure or theft of personal or confidential data, with the ensuing duty to notify and the possible claims of those affected.
- CEO fraud (BEC): impersonation of an executive or supplier to induce fraudulent transfers, a rising form of social engineering.
- Business interruption: the failure of systems —the company's own or those of a technology supplier— that halts operations and generates lost earnings.
Reference bodies such as INCIBE in Spain and the European agency ENISA have been pointing out, in their periodic reports, the upward trend of these incidents and their growing sophistication, both in frequency and in impact on the business fabric. We do not handle specific figures here because they vary each year and each report; the relevant message is structural: exposure is growing, not shrinking.
What does it not cover? Common exclusions
Like any insurance, cyber cover has limits. Knowing them in advance avoids false expectations at the worst moment. Among the most common exclusions are:
- Unpatched systems or known, uncorrected vulnerabilities: if the incident exploits a security weakness the company was aware of and failed to address, cover may be affected.
- Wilful acts of the insured itself: fraud or intentional conduct by the company or its senior staff falls outside the cover.
- Cyber warfare and acts of State: attacks attributable to warlike operations or to States are usually excluded, although the treatment of these clauses —and their nuances— is the subject of intense evolution in the market.
- Reputational harm without specific cover: loss of brand value is only covered to the extent that the policy includes an express crisis-management and communication cover.
The detail of each exclusion is governed by the terms of each policy. Reading the wording with technical judgement —and negotiating the removal or qualification of certain exclusions— is part of an independent broker's work.
YMYL note. There is no standard cyber policy nor identical cover across companies. The real scope depends on the specific wording and on your company's profile. We assess your case before recommending a route.
Which companies are most exposed?
Any organisation that processes personal data or relies on IT systems to operate is exposed; that is, almost all of them. There are, however, profiles with a particularly high exposure:
- E-commerce and digital retail: they manage large volumes of client data and payment methods.
- Healthcare and clinics: they process special-category data and are a frequent target of ransomware.
- Industry with OT environments: the convergence of information and operational technology exposes production chains.
- Technology and software: their service is the system itself, and an incident affects both their own operations and their clients'; we cover this in insurance for technology companies.
- Professional services: firms, engineering practices and consultancies hold confidential third-party information.
- Multinationals and large accounts: because of their attack surface and their cross-border liability.
It is worth noting that cyber insurance is not mandatory by law as a general rule. What has changed the framework is the NIS2 Directive (EU 2022/2555), which raises cybersecurity requirements for entities considered essential and important in certain sectors. NIS2 does not impose arranging insurance, but it does reinforce management's liability and risk-management obligations, a context in which cyber cover fits naturally.
That liability of directors and officers connects with another line: a poorly managed cyber incident can lead to claims against senior managers, covered by D&O insurance. And the duty to notify a leak is governed by data protection law, which we address in our guide on data breaches and the GDPR.
The role of an independent broker
Cyber is probably the line where covers, exclusions and each insurer's appetite vary the most. Two policies with the same name can offer very different protection. This is where an independent broker adds value: it does not sell a specific product but compares the market for you, negotiates the wording and sizes the limits according to your real exposure.
We work under the client's mandate, with access to the whole market —including London and Lloyd's, very active in cyber— and with defence at your side in the event of a claim. How we structure this programme is explained on our page on cyber insurance for companies.
Does your company lack a cyber programme or doubt how far it reaches? Request an analysis of your exposure. We compare the market for you.
Frequently asked questions
Is cyber insurance mandatory? The law does not require it as a general rule. The regulatory framework —data protection and cybersecurity— raises companies' liability, but does not require them to take out a policy. In practice it is arranged as a risk-management tool, not by legal obligation. The exact scope is governed by each policy.
What is the difference between cyber insurance and a general liability policy? A general liability policy is designed for bodily injury and property damage to third parties; IT incidents are usually excluded or referred to another line, and it does not cover the company's own losses. Cyber insurance brings together incident response, first-party losses and third-party claims in a single programme. How each case is treated depends on the wording of each policy; we look at this in common exclusions in a liability policy.
What should the company do in the first hours so as not to jeopardise cover? Notify the insurer through the channels and within the periods set by its policy, follow the response team's instructions and preserve the evidence of the incident. That notice should not be confused with the 72-hour period in Article 33 of the GDPR, which applies to notification to the supervisory authority, not to the insurer. We develop this in our guide on data breaches and the GDPR.
Do only large companies need it? No. Any company that processes personal data or relies on IT systems is exposed to a cyberattack. What changes with size and sector is how the programme is sized: limits, sub-limits and covers are adjusted to each company's exposure profile.
Sources and regulations
- Regulation (EU) 2016/679 (GDPR) — General Data Protection Regulation; Article 33 (notification of breaches to the supervisory authority).
- Spain's Organic Law 3/2018 of 5 December (LOPDGDD) — protection of personal data and safeguarding of digital rights.
- Spanish Data Protection Agency (AEPD) — supervisory authority for data protection.
- Directive (EU) 2022/2555 (NIS2) — measures for a high common level of cybersecurity across the Union.
- National Cybersecurity Institute (INCIBE) — technical reference and threat analysis.
New Brokers is an independent insurance broker registered with the DGSFP under code J0140. This content is for guidance only and does not constitute binding advice; cover, guarantees and terms are governed by each policy and company. We work under the client's mandate, with access to the whole market —including Lloyd's— and defence in the event of a claim.
Do you need to protect your company against a cyberattack? Request an analysis of your cyber exposure. We compare the market for you.
