What is the best cyber insurance? How to compare policies

The best cyber insurance is the policy whose cover matches your real exposure: ransomware downtime, incident response, data restoration, regulatory investigations and claims from customers. There is no single best insurer. Compare policies on what they cover and exclude, the response services included and the security controls you must keep in place to claim.

Key takeaways

• Breaches are expensive: IBM's Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million, a 12% rise on the year before.
• Compare cover first and price second. The main parts are first-party costs (your own losses), third-party liability and incident response services.
• Read the exclusions and conditions. War and state-backed attack clauses, unpatched systems and missing MFA are common reasons claims are disputed.
• Insurers ask detailed security questions before quoting. MFA, endpoint detection, tested offline backups and patching are the usual minimum.
• Insurance does not replace security controls or legal duties such as NIS2. It covers the residual risk that remains after them.
• Use a specialist broker and involve IT, legal and finance when you review the policy wording.

What does cyber insurance cover?

Most standalone cyber policies combine first-party cover, third-party cover and access to an incident response panel. The exact wording differs between insurers, so treat the table below as a checklist rather than a standard.

The UK National Cyber Security Centre's cyber insurance guidance is a useful neutral checklist. It also advises checking whether existing property or business interruption policies already include, or explicitly exclude, cyber losses.

Why does cyber insurance matter now?

Because the cost of an incident keeps rising, and most of it is downtime and recovery rather than the attack itself. The IBM Cost of a Data Breach Report 2026 reports a record global average of USD 4.99 million per breach, driven by higher detection, escalation and lost business costs.

For many mid-sized companies a loss of that size would wipe out a year's profit. Insurance transfers part of that risk. It also gives you fast access to responders who handle incidents every week, which matters in the first hours of a ransomware attack.

How do you choose the best cyber insurance?

Start with your own risk, not with a list of insurers. Work through these steps with your broker.

1. Map your crown jewels. Which systems and data would stop the business, or trigger notification duties, if lost or leaked?
2. Estimate the loss scenarios. A week of downtime, a data leak affecting all customers, a fraudulent payment. Put rough figures on each with finance.
3. Set limits and retention. Choose an overall limit and sub-limits that match those scenarios, and a deductible you can carry.
4. Check the response model. Find out who you call, how fast they respond and whether you can use your own IT partner or must use the panel.
5. Read exclusions and conditions. Look for war and state-actor exclusions, prior known incidents, unpatched vulnerabilities, failure to maintain stated controls, and infrastructure outage exclusions.
6. Compare at least three quotes. Compare like for like: the same limits, waiting periods and sub-limits.
7. Prepare for renewal. Keep evidence of your controls during the year so renewal questionnaires are quick and accurate.

Types of cyber insurers

Rather than a ranking, it helps to know the main types of provider. Ratings, capacity and appetite change every year, so check current financial strength ratings and policy wording with your broker.

• Large global carriers such as Chubb and AIG offer high limits and international programmes for multinational groups.
• Specialist cyber underwriters such as Beazley and Hiscox, both active in the Lloyd's market, have long-standing cyber products and in-house or panel breach response.
• Insurtech and managing general agents such as Coalition and At-Bay combine policies with external attack surface scanning and security alerts during the policy year.
• Nordic insurers such as If, Tryg and Länsförsäkringar offer cyber cover for local businesses, often bundled with company insurance and local-language incident support.
• Indian insurers such as Tata AIG, ICICI Lombard and HDFC ERGO sell cyber policies for businesses, and some offer cover for individuals too.

For a small business, a simple package policy with a strong response hotline may be the best fit. A larger group with a complex IT estate and customer contracts usually needs a broker-led programme with tailored wording.

What security controls do insurers require?

Underwriters now ask detailed questions before they quote, and poor answers mean higher premiums, lower limits or no offer. Expect questions on these controls:

• Multi-factor authentication for email, remote access and admin accounts
• Endpoint detection and response on servers and laptops, with someone watching the alerts
• Offline or immutable backups, with restores tested regularly
• Patch management, especially for internet-facing systems
• Privileged access management and removal of local admin rights
• Email filtering and security awareness training
• An incident response plan that has been exercised
• Security of key suppliers, including cloud and managed service providers

Answer honestly. If the questionnaire says MFA is everywhere and the investigation finds it was not, the insurer may dispute the claim. The NCSC also advises against treating the insurer's minimum controls as your target; they may not protect what matters most to you.

What drives the premium?

Premiums depend on revenue, sector, the amount and type of personal data you hold, your claims history, the limits and deductible you choose and the strength of your controls. Sectors with large amounts of sensitive data, such as healthcare and finance, and businesses that depend on online sales usually pay more. Strong, evidenced controls are the main lever you control.

How cyber insurance fits with NIS2 and GDPR

Insurance transfers financial risk; it does not transfer legal duties. Under the EU NIS2 Directive, covered organisations must manage cybersecurity risk, secure their supply chain and report significant incidents, and management bodies are accountable for this. Under GDPR, you still have to notify the authority and affected people when required.

The good news is that the work overlaps. A NIS2 gap analysis covers most of what an underwriter asks about: risk management, incident handling, access control, logging and supplier security. Löfbergs, the Karlstad coffee roaster, worked with Opsio through four phases of a NIS2 programme: a gap analysis, a prioritised roadmap, implementation of controls such as incident handling, access control, logging and monitoring, and ongoing compliance support. That kind of documented programme is also what makes an insurance questionnaire straightforward.

How Opsio helps

Opsio is not an insurer or a broker, and we do not sell policies. We help you meet and evidence the controls insurers ask for: 24/7 managed detection and response, tested cloud backup and disaster recovery, and compliance and risk assessments against NIS2 and ISO 27001. During an incident, our team can work with the responders your insurer appoints, so recovery of your cloud environment is not held up.

Frequently asked questions

Which company has the best cyber insurance?

No insurer is best for everyone. Large carriers suit multinationals that need high limits, specialist underwriters and insurtechs suit mid-sized firms that want response services and scanning, and local insurers suit smaller businesses. Compare wording, exclusions and response services through a broker.

How much does cyber insurance cost?

It depends on revenue, sector, the data you hold, the limit and deductible, claims history and your security controls. Get quotes from several insurers on the same terms to compare.

Does cyber insurance pay ransoms?

Some policies cover extortion payments where they are legal, usually with insurer consent and sanctions checks. Many organisations decide not to pay, and policies also cover recovery and downtime costs.

Are GDPR fines covered by cyber insurance?

Only where fines are insurable under local law, and that varies between countries. Most policies cover the costs of responding to a regulator even where the fine itself is not covered.

What do insurers check before offering cyber cover?

Typically MFA, endpoint detection and response, backups, patching, privileged access, email security, training, incident response planning and supplier security. Weak answers raise the premium or lead to a declined application.