Minority Owned BusinessWomen Owned
Blue Tree Technology®
SCHEDULE YOUR FREE 15-MINUTE DISCOVERY CALLSupport CenterSupport: 816-994-8282Sales: 816-256-2595

Compliance, insurance & audit evidence

Is Cyber Insurance Worth It, and Will It Actually Pay?

Published · Last reviewed · Next review due:

For many small firms, yes, cyber insurance can be worth having, because a serious incident can bring costs a small business can't easily absorb: forensic investigation, legal advice, client notification and lost work time. But it isn't a substitute for security, and it doesn't cover everything. Whether a claim pays depends on the policy wording and on whether your application answers were accurate. If the application says you use MFA everywhere and you don't, you could have a serious problem when you file a claim. Insurance is worth buying carefully, not as a shortcut. And even when a claim is valid, the money can take months to arrive, so ask whether your business could keep running in the meantime.

What cyber insurance is for

Cyber policies vary a lot. Depending on the policy, coverage may include some of the following:

  • Incident response and forensic investigation
  • Legal guidance and notification costs
  • Business interruption
  • Data restoration
  • Liability claims from affected clients or third parties
  • Certain types of fraud, sometimes as a separate or limited coverage

We're an IT provider, not an insurance broker, so what your particular policy covers is a question for your broker and the policy documents.

Why claims can disappoint

  • Exclusions and sublimits. A policy may cap or exclude certain losses, such as some kinds of payment fraud.
  • Inaccurate applications. Applications ask about MFA, backups, patching, training and more. An answer that wasn't true when you signed can give the insurer grounds to dispute or deny a claim.
  • Notification rules. Many policies require prompt notice and use of approved vendors. Calling your own contacts first can create problems.
  • Controls that drift. You may have used MFA when you applied, but if exceptions crept in later, the answer may no longer be accurate.

Your application is a promise you have to keep

Think of the application the way you would a health insurance application, where leaving out a pre-existing condition can cause trouble later. If you say you do something, you need to actually do it, and you need to be able to prove it.

Say your application says you train your employees on cybersecurity. If a cyber event happens and you can't show that the training took place, your chances of a full payout go down. If an application says you do something you don't, the insurer may refuse to pay at all.

Insurers have also become much stricter, because they've paid out a lot of claims in recent years. If there is a legitimate reason to limit or deny a claim, expect them to use it. The best protection is simple: follow what you agreed to in the application, and keep evidence that you did. Doing that puts you in a much better position if you ever need to file a claim.

Reach out to your IT provider and verify that they are actually providing what your application says you have. In some cases, matching the application will mean paying for additional services. That's better to learn before a claim than during one.

Payouts can take months

Even a clean claim can take a long time to resolve. It may be three to six months before the money shows up. Ask yourself whether your business has the cash to keep operating, pay staff and recover for that long without the insurance funds. If not, that's worth planning for now, before an incident, not during one.

How to make the policy worth what you pay

  1. Answer the application with evidence. For every "yes," know where the proof is: an MFA report, confirmation that backups completed successfully, or a training log. Our guide to IT evidence for auditors and insurers covers this.
  2. Have your IT provider review the technical questions before you sign, so the answers match reality.
  3. Read the incident steps in advance. Know who to call first and which vendors the policy requires.
  4. Ask your broker about fraud coverage specifically if you move money or handle client funds.
  5. Recheck at renewal. Your systems and the insurer's questions both change.

Insurance and IT support work together

An MSP doesn't replace insurance, and insurance doesn't replace security. The insurer may expect certain controls to be in place. Your IT provider can help put them in place and document them. Your broker helps you choose coverage that fits your risk. Questions like who is responsible if an MSP fails to protect your business are worth discussing with all three.

At Blue Tree Technology®, we build our plans around what cyber insurance requires, and every plan includes cyber training, so there's a record that it's happening. We also help our clients fill out their applications correctly. We don't sign them.

FAQ

Do small businesses really need cyber insurance?

It depends on what an incident would cost you and whether you could absorb it. Talk with a broker. Some clients and contracts also require it.

How long does a cyber insurance claim take to pay?

It can take months, and sometimes three to six or longer depending on the claim. Plan for how your business would keep running until the money arrives.

Will insurance pay if we get hacked through an employee's mistake?

Possibly, depending on the policy. Human error is common, but exclusions and accurate application answers still matter.

Does having insurance mean we can skip backups or MFA?

No. Insurers commonly ask about those controls, and they're what limits the damage in the first place.

Still have a question?

Ask Little Sprout for general information. To check whether your IT setup matches what your insurance application says, schedule a free 15-minute discovery call.

Back to the Knowledge Hub

More in this topic

Discuss your business technology needs

Review your priorities with Blue Tree Technology®.

Schedule a discovery call