Cyber attacks are no longersomething that only happens to large corporations. Australian small businessesare increasingly targeted — often because they are seen as easier targets withfewer protections in place. When an attack does happen, the financial andoperational consequences can be severe.

Cyber insurance is one importantlayer of protection. But not all policies are equal — and a policy that lookscomprehensive on the surface can leave significant gaps when it matters most.

This guide will help youunderstand what cyber insurance is, what a good policy should cover, what thecommon pitfalls are, and how to have an informed conversation with yourinsurance broker.

What is Cyber Insurance and Why Does it Matter?

Cyber insurance is a specialisedtype of business insurance designed to protect your business from the financialfallout of a cyber incident — such as a data breach, ransomware attack, orbusiness email compromise.

Unlike general business insurance,which typically covers physical assets and liability, cyber insurance isdesigned specifically for digital risks. It can cover everything from the costof forensic investigation to legal fees, regulatory fines, ransom payments, andlost revenue while your systems are down.

Why small businesses are at risk

Many small business owners assumecyber criminals only target large organisations. The reality is the opposite.Small businesses are frequently targeted precisely because they are perceivedas easier to compromise.

‍

See ASD Annual Cyber Report 2024-25

Your legal obligations

Australian businesses that handle personal information have legal obligations under the Privacy Act 1988, including the Notifiable Data Breaches (NDB) scheme. If your business holds personal information and suffers a data breach that is likely to cause serious harm to affected individuals, you are legally required to:

• Notify the Office of the Australian Information Commissioner (OAIC)
• Notify the individuals whose information was affected
• Take action to contain and remediate the breach

Failing to meet these obligations — or failing to respond quickly enough — can result in significant regulatory penalties. The Privacy and Other Legislation Amendment Act 2024 has increased penalties for serious or repeated breaches.

Cyber insurance can help cover the costs of notifications, legal advice, and regulatory response — but only if you have the right cover in place.

What a Good Policy Should Cover

Cyber policies vary significantlybetween insurers. A comprehensive policy should include both first-party cover(protecting your own business) and third-party cover (protecting you fromclaims made against your business by others).

First-party cover — your own losses

Third-party cover — claims against you

Common Exclusions and Coverage Gaps

Understanding what is NOT coveredis just as important as understanding what is. Here are the most commonexclusions and gaps to watch for.

Common cyber insurance exclusions

• Acts of war and nation-state attacks — Most policies include a war exclusion that insurers have increasingly used to deny claims from nation-state cyber attacks. The scope varies significantly between insurers. Ask your broker directly how it is defined in your policy.
• Intentional acts — Losses caused intentionally by you, your employees, or directors are typically excluded. Employee theft may be covered under a separate crime policy.
• Previously known incidents — If you knew about a vulnerability or breach before the policy started, it will likely be excluded. This is why retroactive dates matter.
• Unencrypted data — Some policies reduce or deny cover for breaches involving data that was not encrypted, on the basis that reasonable precautions were not in place.
• Reputational damage and future lost profits — Many policies exclude long-term reputational harm or projected future losses beyond the immediate incident.
• Social engineering fraud — Business email compromise and invoice fraud are sometimes excluded from cyber policies and treated as a separate crime insurance matter. Confirm this with your broker.
• Physical damage — Cyber insurance covers digital and financial losses, not physical damage to hardware or injury resulting from a cyber event.

‍

Coverage gaps to be aware of

The emerging threat of AI-driven attacks

Artificial intelligence is rapidly changing the nature of cyber threats facing small businesses. Attackers are now using AI tools to automate and scale attacks that previously required significant time and skill. This has three practical implications for your insurance coverage.

Security Controls Insurers Require

Obtaining cyber insurance is not simply a matter of paying a premium. Insurers now actively assess your cybersecurity posture before offering cover — and many include security warranties in the policy itself. If those warranted controls are not in place at the time of a claim, the insurer may decline to pay.

The following are the baseline controls most Australian cyber insurers currently require or expect.

The baseline controls most insurers expect

• Multi-Factor Authentication (MFA) — Required on email, remote access, cloud services, and privileged accounts. This is the single highest-impact control insurers look for.
• Endpoint Detection and Response (EDR) — Active monitoring and threat response on all endpoints. Basic antivirus alone is typically insufficient for modern underwriting requirements.
• Regular, tested backups — Backups should be automated, stored offline or off-site, and tested regularly to confirm they can actually be restored. Insurers want evidence that backups work, not just that they exist.
• Email security — SPF, DKIM, and DMARC authentication configured on your domain to reduce phishing and spoofing risk.
• Patch management — A documented process for applying software and security updates within a reasonable timeframe.
• Security awareness training — Staff training at least annually, including phishing simulations. Human error remains the leading cause of cyber incidents.
• Incident response plan — A documented, accessible plan for what to do when an incident occurs. Insurers view this as evidence of organisational maturity.

‍

The stronger your security posture, the better your premium outcome. Businesses with independently verified controls consistently achieve more favourable policy terms and lower premiums than those relying on self-reported questionnaire responses alone.

Questions to Ask Your Insurance Broker

Before signing any cyber policy, use these questions to pressure-test your coverage. A good broker should be able to answer all of them clearly and in writing.

Coverage structure

• Does this policy cover both first-party and third-party incidents?
• What are the sub-limits for ransomware, business interruption, and regulatory defence? How do they compare to the overall policy limit?
• Is social engineering and business email compromise covered, or is that a separate policy?
• How is the war/nation-state exclusion defined, and which events would it apply to?

Policy terms and conditions

• What is the retroactive date, and does it cover incidents that occurred before the policy period but were discovered during it?
• What are my notification obligations after an incident? What is the exact deadline for notifying the insurer?
• What security controls are warranted under this policy? What happens to my claim if one of those controls was not in place at the time of the incident?
• Does my general business insurance or professional indemnity policy include or exclude cyber events? Are there any gaps between the two?

AI-driven threats

• Does this policy explicitly cover losses arising from AI-generated phishing, deepfake fraud, or voice and video impersonation attacks?
• Is business email compromise cover broad enough to include AI-assisted social engineering, or is it limited to traditional email fraud scenarios?
• How does the policy define a covered cyber event — and could an AI-automated attack be excluded under any existing clause?
• Is the policy reviewed or updated regularly to keep pace with emerging AI threat vectors, and how will you notify me if coverage terms change at renewal?

Claims and incident response

• What does the claims process look like from first notification to resolution?
• Does the insurer have a pre-approved panel of forensic, legal, and PR firms? Am I required to use them?
• Can you walk me through a claim scenario — what would I need to do, who would I call, and what would be covered?
• Are there any circumstances under which a claim could be denied even if the incident appears to be covered?

Renewals

• How does the claims process and premium change after I make a claim?
• How far in advance should I begin the renewal process, and what documentation will I need to provide?

What to Do When an Incident Happens

Having insurance is only valuable if you know how to use it. When a cyber incident occurs, the actions you take in the first hours are critical — both for containing the damage and for preserving your ability to make a claim.

Do not pay a ransom without insurer approval

If you receive a ransomware demand, contact your insurer before taking any action. Making a payment without authorisation from your insurer may void your ransom cover. Your insurer will typically have access to specialist negotiators and can guide the response.

Being prepared before an incident is far less stressful than trying to find out your obligations while under attack. Keep your insurer's emergency contact number, your IT provider's contact, and your policy number accessible offline.

Quick-Reference Checklist