4 Things to Check Before Buying Cyber Insurance

Cyber insurance policies can look similar on the quote screen. They may all say they cover data breaches, ransomware, and phishing. But the details matter. A cheaper policy may have lower sublimits, narrower fraud cover, stricter security conditions, or less incident response support. The goal is not just to buy "cyber insurance." It is to choose a policy that matches the way your business actually uses email, payments, customer data, cloud systems, and digital tools.

Do not buy cyber insurance because the quote says "cyber." Check how the policy responds to the events your business is most likely to face.

At a Glance

• Two policies with the same headline limit can respond very differently at claim time.
• Start by matching the policy to your business: if you send invoices by email, check business email compromise, invoice redirection, and funds transfer fraud first.
• Check sublimits. A $1M policy with a $50K social engineering sublimit pays $50K for a BEC claim, not $1M.
• Check whether cyber business interruption is included and what waiting period applies.
• Check the security controls the insurer expects. A mismatch between your application and reality can affect claims.
• Ask how the claims process works before you need it.

What Should You Look for in a Cyber Insurance Policy?

Start with your business model, not the policy brochure.

Many businesses compare premiums before checking whether the policy responds to the incident they are most likely to face. If your business sends invoices by email, BEC and funds transfer fraud may matter more than a broad cyber liability headline. If you run an online store, payment systems and website downtime may be more important.

What Are Sublimits in Cyber Insurance and Why Do They Matter?

The policy limit is not always what you get for every claim type. A policy may show $1 million in cover, but certain events may have lower sublimits. These can apply to ransomware, BEC, social engineering, funds transfer fraud, data restoration, or business interruption.

If your business is most exposed to fake invoice scams, the funds transfer fraud sublimit may be the most important number in the policy. If the sublimit is $50,000 on a $1M policy, the insurer pays $50,000 for that claim type, not $1 million.

Before buying, check the overall limit, sublimits for ransomware and BEC, any waiting period for business interruption, the excess, and whether optional sections need to be added.

Does Your Cyber Policy Cover Ransomware, BEC, and Business Interruption?

These three claim types are where most policies differ.

Business email compromise: Not all policies treat BEC the same way. Some cover certain funds transfer losses. Some only cover response costs. Some require callback verification or dual approval before a claim is valid. Some distinguish between a hacked system and a voluntary transfer made after deception. Check this section carefully, because business email compromise is a common cyber risk for Australian businesses.

Ransomware: A policy may cover incident response, negotiation, system restoration, and business interruption. But coverage for the ransom payment itself varies. There may be strict conditions: insurer approval, vendor requirements, and sanctions considerations. Some reporting business entities may need to report ransomware or cyber extortion payments within 72 hours under the Cyber Security Act 2024.

Business interruption: If email, POS, bookings, or cloud systems go down, the business may lose income while still paying wages and rent. Check whether cyber BI is included, what waiting period applies (typically 8 to 24 hours), and whether it covers your systems only or also third-party platforms you rely on.

What Security Controls Do Cyber Insurers Check on Your Application?

Cyber insurance applications ask about your security posture: MFA, backups, patching, endpoint protection, staff training, and payment verification. The application should describe the business as it operates today, not how you plan to operate after buying the policy. If you say the business uses MFA and it does not, the insurer may dispute a claim.

This is where cyber claims can become difficult. For a full list of what underwriters check, see cyber insurance requirements in Australia.

Also check the exclusions section. Common exclusions include: known incidents or vulnerabilities before the policy started; failure to maintain security controls declared in the application; some social engineering scenarios; utility or telecommunications outages unrelated to a cyber event; war or state-backed cyber activity; and fines where they are not legally insurable.

How Does the Cyber Insurance Claims Process Work?

A cyber incident is stressful. The claims process should not be a mystery when the business is already under pressure. Before buying, ask: Who do you contact first? Is there 24/7 breach response support? How quickly must the insurer be notified? Do you need approval before appointing IT vendors or negotiators? What evidence is needed for a BEC or funds transfer fraud claim?

Cyber claims move fast. A ransomware incident, hacked email, or fake payment can require decisions within hours. The policy should make the first step clear.

How upcover Can Help

upcover arranges Cyber and Technology Insurance for eligible Australian businesses with selected insurers and underwriters. Depending on the policy, cover may include customer data breach, cyber extortion, ransomware and business interruption, phishing and funds transfer fraud, malicious insider incidents, breach response, and technology-related claims.

Depending on your occupation, revenue, and data exposure, you may be able to compare options, choose a limit, and access a Certificate of Currency on policy confirmation. For more on what cyber insurance covers, see What Is a Cyber Insurance Policy?. For pricing, see How Much Does Cyber Insurance Cost?. For cover levels, see How Much Cyber Insurance Do I Need?.

upcover Pty Ltd ABN 17 628 197 437 is a Corporate Authorised Representative (CAR 1299211) of Experience Insurance Services Pty Ltd ABN 41 657 596 506, AFSL 539078.

FAQ

What should I check before buying cyber insurance?

Match the policy to your business. Check sublimits for BEC, ransomware, and business interruption. Check the security controls the insurer expects. Ask how the claims process works. Do not compare on price alone.

What is a cyber insurance sublimit?

A lower cap on a specific claim type within the overall policy limit. A $1M policy may have a $50K sublimit for social engineering, meaning BEC claims are capped at $50K.

Does cyber insurance cover business email compromise?

Many policies cover BEC, but often with a sublimit and verification conditions. Check whether the policy covers invoice redirection, social engineering, and funds transfer fraud, not just "cyber crime" in general.

What happens if my application does not match my actual security controls?

The insurer may dispute the claim or reduce the payout. If the application says MFA is in place and it is not, the policy may not respond as expected.

What should I ask about the cyber claims process?

Ask who to contact first, whether 24/7 breach response is available, how quickly incidents must be reported, whether insurer approval is needed before appointing vendors, and what evidence is required for business email compromise or funds transfer fraud.

‍

_{The information in this article is general in nature and provided for informational purposes only. It does not constitute personal insurance, legal, or cyber security advice. Cyber insurance coverage, limits, sublimits, and exclusions vary by insurer and policy wording. Before purchasing or relying on an insurance product, consider the relevant Product Disclosure Statements, Target Market Determination, policy wording, and Financial Services Guide. upcover Pty Ltd ABN 17 628 197 437 is a Corporate Authorised Representative (CAR 1299211) of Experience Insurance Services Pty Ltd ABN 41 657 596 506, AFSL 539078. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}