Quick answer: Cyber insurance UK policies pay for the costs of a cyber attack or data breach, such as IT experts, data recovery, lost income, legal bills and claims from customers. Prices in the UK start from about £5 a month for very small businesses, but most firms pay more because the price depends on turnover, the cover limit and your security. It is not a legal requirement, but it is worth considering if you hold customer data, take online payments or rely on cloud software.
A small accountancy firm in Manchester, an online shop in London or a design studio in Leeds can all be hit by ransomware, phishing or a data breach. The 2025/26 government survey found that 43% of UK businesses had a breach or attack in the last 12 months. Yet only 10% of businesses have a specific cyber insurance policy.
This guide explains what cyber insurance covers, what it does not, how much it costs, which providers to look at and how to claim. It is written for UK small businesses, sole traders, freelancers, startups and charities.
What Is Cyber Insurance UK?
Cyber insurance is a business policy that pays for financial losses caused by cyber incidents. It also gives you access to a 24-hour helpline and experts when something goes wrong. You can buy it in three ways:
- Standalone policy: cyber is the main product you buy.
- Add-on: cyber cover added to a public liability or professional indemnity policy.
- Cyber Essentials benefit: a free, limited policy that comes with qualifying Cyber Essentials certification (explained below).
First-party vs third-party cyber cover
Most policies split cover into two parts. First-party cover pays for your own losses. Third-party cover pays when someone else makes a claim against you.
| First-party (your own losses) | Third-party (claims against you) |
| IT forensic investigation and incident response | Customer or client compensation claims |
| Data recovery and system restoration | Legal defence costs |
| Business interruption (lost income) | Regulatory investigation costs (where insurable) |
| Cyber extortion and ransomware support | Privacy, network security and media liability |
Exact cover depends on the policy wording, limits and exclusions, so always read the policy summary (IPID) before you buy.
Do UK Small Businesses Need Cyber Insurance?
It is not a legal requirement. However, it makes sense if you store customer details, take card or online payments, use cloud accounting or run an online shop. Even sole traders who send invoices by email can lose money to a fake payment request.
If you do not have it, you pay for IT help, legal advice and lost trading time yourself. Some customers and contracts also ask suppliers to hold cyber cover.
UK cyber attack and insurance statistics
The figures below come from the Cyber Security Breaches Survey 2025/26, published by the Department for Science, Innovation and Technology (DSIT) and the Home Office on 30 April 2026.
The gap is clear: many firms believe they have cyber cover through another policy, but far fewer hold a dedicated one. Our guide to business insurance UK shows where cyber fits within wider commercial cover.
What Does Cyber Insurance Cover in the UK?
Cover varies by insurer, but a typical policy may include the following.
| Cover | What it means for you |
| Data breach response | Experts find out what happened, and you pay for customer notification and support. |
| Data recovery | Costs of restoring or recreating lost data and systems. |
| Ransomware and extortion | Help to deal with the attack. Whether a ransom can be paid depends on the policy and the law, so check the wording. |
| Business interruption | Lost income while your systems are down. |
| Legal and third-party claims | Defence costs and compensation if customers or clients claim against you. |
| Cybercrime and funds transfer fraud | Losses from fake invoices or payment requests. This is often a separate add-on. |
| Public relations support | Help to manage your reputation after a breach. |
| Supply chain disruption | Losses when a supplier you depend on is hit (dependent business interruption). |
What Does Cyber Insurance Not Cover?
Every policy has exclusions. These are the most common ones found in published UK wordings:
- Known problems: attacks or incidents that happened before the policy started.
- War and cyber warfare: including state-backed attacks, depending on the wording.
- Criminal or intentional acts: by you or the business.
- Some fines and penalties: only fines that can lawfully be insured may be covered.
- Professional negligence: faulty advice or services need professional indemnity cover.
- Injury and property damage: these fall under liability policies.
- Infrastructure failure: for example, a wider power or internet outage outside your control.
Late reporting and broken policy conditions, such as not keeping backups, can also reduce or stop a payout.
Cyber Insurance vs Other Business Insurance
Other business policies usually do not respond to cyber losses, so buying the wrong one leaves a gap.
| Policy | Main protection | Covers a cyber attack? |
| Cyber insurance | Cyber attacks, data breaches, digital losses | Yes |
| Professional indemnity | Professional mistakes and faulty advice | Not usually |
| Public liability | Injury and property damage claims | No |
| Crime insurance | Theft and fraud | Often needs a cyber extension |
| Tech E&O | Technology services and professional liability | Partly, depends on wording |
Consultants, accountants and IT firms often need both. Our guide to professional indemnity insurance UK explains the advice side, and public liability insurance explains injury and property claims. Some cyber policies, such as Beazley’s, specifically exclude professional services losses.
How Much Does Cyber Insurance Cost in the UK?
There is no single standard price. A sole trader with a low turnover can find policies from a few pounds a month, while a growing company holding lots of customer data will pay more. Insurers do not publish a full rate card, so the figures below are advertised entry examples, not typical premiums.
| Provider | Advertised price | Price basis | Checked |
| Markel Direct | From £5/month | Turnover under £25,000, £50,000 cover | 30 Oct 2026 |
| PolicyBee | From £11.11/month | £100,000 cover, includes 12% IPT; example is a virtual assistant earning up to £50,000 | 25 Oct 2026 |
| Simply Business | £14.87/month | Add-on only; fewer than 10 employees and turnover under £1m; includes IPT and instalment interest | 14 Jul 2026 |
| Superscript | From £10.79/month | Basis not stated; confirm with the provider | 6 Sep 2026 |
A note on Hiscox: its advertised £7.20 a month is an average across its business insurance policies. It is not a cyber-specific price, so do not compare it with the figures above.
What affects the price?
- Annual turnover and number of employees
- Your industry and how much customer data you hold
- Whether you take card payments
- Your cover limit and excess
- Your security controls and past incidents
How to lower your premium
Turn on multi-factor authentication, keep tested backups, train staff and apply updates quickly. Cyber Essentials certification may also help, and some insurers offer discounts for recognised defences. A higher excess can lower the price, but you then pay more yourself when you claim.
Remember that UK insurance carries Insurance Premium Tax at 12%. Check whether the price you see already includes it. If you are budgeting for other running costs too, see our guide to cheapest card payment machines UK.
Cyber Insurance Requirements Insurers Ask For
Insurers ask questions about your security before they quote. Requirements differ, but these are common:
Cyber insurance security checklist
- ☑ Multi-factor authentication (MFA) on email and key systems
- ☑ Regular backups, stored away from your main network and tested
- ☑ Software updates and security patches applied promptly
- ☑ Antivirus, and endpoint detection and response (EDR) where asked
- ☑ Staff awareness training on phishing
- ☑ Strong password policy and a password manager
- ☑ A simple incident response plan
Answer every question honestly. A wrong answer on your application can lead to a rejected claim.
Cyber Essentials and Free Cyber Insurance
Cyber Essentials is a government-backed scheme run with the National Cyber Security Centre (NCSC). It checks that you have basic protections in place. The NCSC says these safeguards should be in place before you consider cyber insurance.
Yes, there is a free policy, but it is limited. If you certify your whole organisation, you may get cyber liability insurance arranged by IASME.
| Detail | Cyber Essentials-linked policy |
| Who is eligible | UK organisations with turnover under £20m |
| Certification needed | Whole organisation, not just part of it |
| Cover limit | £25,000 total liability |
| Support | 24-hour incident helpline |
| Certification cost | From £320 plus VAT, depending on size |
£25,000 is unlikely to cover a serious incident. Treat it as a useful starting benefit, not a replacement for a policy with higher limits.
Cyber Insurance Providers in the UK
We have not ranked providers as “best” or “cheapest”, because the right policy depends on your size, sector and risks. Instead, the table groups them by type so you can see how you would buy. Check each firm on the FCA Register before you buy.
| Provider | Type | How you buy | Good to know |
| Markel Direct | Direct insurer | Online quote | Low entry price for very small firms; example based on low turnover and £50,000 cover |
| PolicyBee | Digital broker | Online quote, phone support | 24/7 IT, legal and PR support; separate cybercrime add-on from £6.89/month for £50,000 |
| Simply Business | Broker platform | Online, as an add-on | Cannot be bought on its own; for firms under 10 employees and under £1m turnover |
| Superscript | Digital broker | Online quote | Aimed at startups and freelancers; confirm price basis |
| Hiscox | Insurer | Direct or broker | Cyber and data cover for small businesses; confirm cyber-specific price |
| CFC Underwriting | Specialist underwriter (MGA) | Through a broker | Provider states 24/7 incident response and no required security warranties on its SME product |
| Beazley | Specialist insurer | Through a broker | Breach response, extortion and liability cover; excludes professional services losses |
| Zurich UK | Insurer | Through a broker | Clear war and cyber-war exclusions in its wording |
Other routes include Aviva, AXA UK, Direct Line for Business, Chubb and the Lloyd’s market. Some of these sell mainly through brokers or partners, so confirm current availability on their own websites. Provider claims such as CFC’s 99.4% claims acceptance rate are provider-stated and should not be treated as an independent comparison.
Insurer, broker or MGA? An insurer carries the risk and pays claims. A broker compares and sells policies for you. An MGA (managing general agent) designs and manages cover on behalf of insurers, usually sold through brokers.
Cyber Insurance by Business Type
| Business type | Main risks | Cover to look for |
| Sole traders and freelancers | Fake invoices, phishing, stolen laptops or accounts | Low-limit policy with incident helpline and cybercrime cover |
| Startups | Cloud tools, customer data, rapid growth | Flexible cover that grows with turnover; business interruption |
| Charities | Donor and beneficiary data, email fraud | Data breach response and third-party liability. Only 5% of charities hold a specific policy |
| IT firms and MSPs | Client data, service failures | Cyber plus professional indemnity or Tech E&O |
| Law firms and accountants | Client money, sensitive records, payment fraud | Funds transfer fraud, regulatory costs, professional indemnity alongside |
| Healthcare and clinics | Patient records | Breach response, notification costs, regulatory defence |
| E-commerce | Card data, website downtime | Business interruption, payment card liability, response support |
If you run an online shop, our guide on how to start an e-commerce business covers the other setup steps, and new founders can read about new startups in London for wider context.
Cyber Insurance and GDPR Fines
UK GDPR and the Data Protection Act 2018 are enforced by the Information Commissioner’s Office (ICO). The Data (Use and Access) Act 2025 amends these rules rather than replacing them. If a breach puts people at risk, you generally have to report it to the ICO within 72 hours of becoming aware of it.
Does cyber insurance cover GDPR fines? Not automatically. Policies may pay for legal advice and regulatory investigation costs. Whether a fine itself is covered depends on the wording and on whether the fine can lawfully be insured. Markel’s wording, for example, excludes fines and penalties except under its regulatory section. Insurance does not replace compliance.
Common Cyber Insurance Claims
Ransomware and malware are the main drivers of claims. Members of the Association of British Insurers (ABI) paid £197m in UK cyber claims in 2024, and malware and ransomware made up 51% of those claims. Gallagher reports that ransomware accounted for 52% of major UK losses in 2025.
Claim costs vary widely by type. These Coalition figures come from its 2026 global claims report, so they are not UK-only:
Common claim scenarios include:
- Ransomware: systems are locked and trading stops. WTW reports ransomware incidents last 25 days on average.
- Business email compromise: a fake supplier email leads you to pay the wrong account.
- Customer data theft: triggers forensic, legal, notification and possible liability costs.
- System outage or DDoS: your website or tools go offline and you lose sales.
Many firms rely on cloud tools, which is one reason these risks spread. Our article on cloud migration services UK explains what to check when moving systems online.
How to Get a Cyber Insurance Quote in the UK
- List your risks: what data you hold, what you sell online and which systems you cannot work without.
- Choose a limit: think about the cost of being offline for a week, plus legal and IT bills. Quote options often range from £250,000 to £5m, with £1m described as common, but small firms may start lower.
- Pick standalone or add-on: add-ons are cheaper but often have lower limits and tighter eligibility.
- Gather your details: turnover, employee numbers, data types, security measures and any past incidents.
- Compare wording, not just price: check limits, excess, exclusions and incident response support.
- Check the firm: confirm it is authorised on the FCA Register, then buy.
You can buy online without a broker if you are a small, simple business. A broker can help if you handle sensitive data, have higher turnover or need specialist wording.
How to Make a Cyber Insurance Claim
Exact steps and deadlines depend on your policy, so keep the helpline number somewhere you can reach it offline.
What to do in the first 24 hours of a ransomware attack
- Disconnect affected devices from the network, but do not switch them off unless told to.
- Call your insurer’s incident helpline straight away. Late notice can affect your claim.
- Follow the response team’s instructions and do not pay anything or contact the attackers before speaking to them.
- Write down what happened and when, and keep emails, screenshots and logs.
- Check whether personal data is involved. If so, you may have to report to the ICO within 72 hours.
UK Rules and Guidance to Know
- UK GDPR and Data Protection Act 2018: legal duties on how you handle personal data.
- NCSC and Cyber Essentials: voluntary guidance and certification.
- Cyber Security and Resilience Bill: introduced in November 2025 to reform the NIS Regulations. Check its current status before relying on it.
- FCA: regulates insurers and brokers, so check the register.
- Financial Ombudsman Service: eligible customers may complain here after using the firm’s own complaints process.
Cyber insurance itself is a voluntary purchase. If you borrow to fund security improvements, our guide to a business line of credit UK explains one option, and our piece on commercial lending regulations UK shows why good risk management supports business credibility.
Conclusion: Is Cyber Insurance Worth It?
For most UK businesses that hold customer data or work online, cyber insurance UK is worth serious thought. Nearly half of businesses were hit last year, and a single ransomware or payment fraud incident can cost far more than a year’s premium. Insurance does not remove your duty to protect data, so combine it with MFA, backups and staff training.
Your next step: note your turnover, the data you hold and your security measures, then request quotes from two or three authorised providers. Compare the cover limit, excess and exclusions side by side, and speak to an FCA-authorised broker if you are unsure.
FAQs
- Is cyber insurance legally required in the UK?
No. It is a voluntary purchase, although some contracts may ask for it. - How much does cyber insurance cost in the UK?
Advertised entry prices start from about £5 to £15 a month for very small businesses. Real premiums depend on turnover, cover limit, sector and security. - What does cyber insurance cover?
Usually incident response, data recovery, business interruption, extortion support, legal costs and third-party claims. Check the wording for limits and exclusions. - Does cyber insurance cover ransomware?
Many policies cover response and losses from ransomware, but terms differ. Do not assume a ransom payment is covered. Check your policy and the law. - Does cyber insurance cover GDPR fines?
Not automatically. It may cover legal and investigation costs, but fines are covered only where they can lawfully be insured and the policy says so. - Can sole traders and freelancers get cyber insurance?
Yes. Several UK providers offer online policies for sole traders and micro-businesses. - Does normal business insurance cover cyber attacks?
Usually not. Public liability and professional indemnity policies typically do not cover cyber losses unless a cyber extension is added. - Is free cyber insurance available?
Yes, with qualifying Cyber Essentials certification for UK organisations with turnover under £20m. The limit is £25,000. - How much cover does a small business need?
Estimate the cost of a week offline plus IT, legal and notification costs. Policies often offer limits from £50,000 up to £1m or more. - Can I buy cyber insurance without a broker?
Yes, direct insurers and digital platforms sell online. A broker helps with complex or higher-risk businesses.
Author Bio
The London Report Editorial Team provides expert analysis on UK business insurance, digital risk and financial resilience, supporting informed decisions for British SMEs.
Sources
- DSIT and Home Office, Cyber Security Breaches Survey 2025/26
- NCSC, Cyber Essentials overview
- NCSC, Cyber insurance guidance
- Information Commissioner’s Office
- FCA Register
- Financial Ombudsman Service
- Association of British Insurers
Disclaimer
This article is for general information only and does not constitute legal, financial or insurance advice. Prices are provider-stated examples checked between July and October 2026 and can change. Cover depends on your policy wording, limits, exclusions and underwriting. Check current terms and eligibility, confirm any provider on the FCA Register, and seek independent professional guidance before buying cyber insurance. Contact us if information requires correction or updating.
