Cyber Insurance: What It Covers and What It Wants

GreyNoise reported this month that a single threat actor used AI agents to compromise PaperCut print servers at 395 organisations in 48 countries, roughly half of them schools. The vulnerabilities had been patched weeks earlier. Huntress telemetry suggests around 47% of tracked PaperCut installations were still running unpatched versions. Insurers read reports like that too, which is why the cyber insurance application has quietly turned into a controls audit.

What a policy typically pays for

Wordings differ and the wording is what governs, so treat this as a map rather than a promise. Most policies split into costs you incur and claims others bring against you.

The section businesses underestimate is the first one. Most of the value in a claim arrives in the opening 48 hours, in the form of people who have handled this before telling you what to do. A small business without that support tends to make expensive decisions quickly, and the response bill often exceeds the ransom.

The controls that decide your premium

Underwriting for small business cyber has moved from revenue-and-sector to evidence-of-controls. The recurring questions are worth knowing before the form arrives.

Multi-factor authentication. On email and remote access at minimum, enforced rather than available. This is the single most common gate, and a no here can end the conversation with some insurers.

Patching cadence. How quickly you apply security updates, particularly to anything internet-facing. The PaperCut campaign is the illustration: patch available August 28, mass exploitation of the unpatched through September. The discipline behind answering this honestly is in vulnerability management without a security team.

Backups that are offline or immutable, and tested. Insurers ask when you last performed a restore, not whether backups run. An untested backup is a hope.

Endpoint detection coverage. What proportion of your machines are covered, including the laptop the bookkeeper works from at home.

Privileged account management. Who holds domain admin, and whether those accounts are separate from daily-use ones. In the PaperCut campaign the attacker reached domain admin at only 12 of 395 organisations, which is the difference between a bad week and a catastrophic one.

An incident response plan. Increasingly asked for, and increasingly asked to be evidenced rather than asserted.

Answer the questionnaire honestly

Coverage disputes usually turn on two things: whether your application described your controls accurately, and whether the policy carries a condition requiring you to maintain them.

Claiming a 30-day patching cadence you do not follow creates a worse problem than the delay itself. The same applies to MFA that is enabled for most staff, backups that run but have never been restored, and endpoint coverage that omits three machines nobody thought about. Answer as the business actually operates, take the rate that comes with it, and fix the gaps you want to fix on your own timeline. None of this is legal or insurance advice, and the wording of your specific policy governs.

Where AI is entering the conversation

Two directions, and both are early enough that answers vary by insurer.

On the application. Questions about which AI tools staff use, whether company or customer data goes into them, and whether you have a written AI policy. The tool inventory that supports an honest answer is the same one described in an AI governance framework for a small business.

On the coverage. A cyber policy is generally built around unauthorised access and data breach. An AI system that sends a wrong quote, gives poor advice, or makes a decision that harms someone sits closer to professional liability or errors and omissions. Some insurers have started adding AI-specific wording, both to extend and to exclude. We looked at that gap in does insurance cover AI mistakes.

The question worth putting to your broker in writing is which of your existing policies would respond to an AI error, and getting the answer before an incident rather than during one.

Insurance is not a control

A policy pays for consequences. It does not prevent the incident, and it does not restore the customer relationship damaged by the notification letter. Businesses occasionally treat coverage as a substitute for the controls the insurer asked about, which is the one reading of this that leaves you worse off, since the controls are what stop the claim from being needed.

It also does not guarantee a clean outcome even when you did the work. Well-run organisations get breached through a supplier or a zero-day, which we wrote about in you did everything right and got breached anyway. That is precisely the case insurance exists for, and it is a narrower case than most buyers assume.

Before your next renewal

Pull last year's application and read your own answers. Check whether each is still true, and whether it was true when you wrote it. Then pick the one control you cannot honestly claim and close that gap, because it is the same gap a client questionnaire will ask about next quarter.

Frequently Asked Questions