I spend a lot of time with small and mid-sized businesses that either don’t have cyber insurance at all or have a policy they’ve never really read.
Both situations create the same problem: false confidence.
Cyber insurance is useful. I recommend it often. But I also see owners assume it works like a blanket safety net for “anything cyber.” It doesn’t.
The cleanest way to think about it is this:
Cyber insurance is a financial backstop, not a security control.
It helps absorb losses after something gets through. It does not replace MFA, backups, EDR, patching, or basic approval controls around money movement.
What catches smaller businesses hardest is usually not the obvious stuff like ransomware language. It’s the gap between the headline policy limit and the actual sub-limits attached to common loss scenarios.
The biggest one: social engineering / BEC coverage.
I’ve seen companies believe they had a $500k cyber policy, only to learn that a fraudulent wire transfer triggered a much smaller social engineering sub-limit. Sometimes dramatically smaller. That matters because business email compromise is still one of the most common and expensive real-world events I see discussed with clients and brokers.
So when someone says, “We have cyber insurance,” my next question is usually:
What’s the social engineering sub-limit?
If they don’t know, they don’t really know what they bought.
A few other points I always tell clients to verify before they sign anything:
- Whether ransomware recovery costs are actually included
- Whether business interruption is covered, and what starts the clock
- Whether regulatory fines/response costs apply to their industry
- What security controls are required to keep coverage valid
- What exclusions could be used against them after an incident
That last one matters more than most people realize.
If the application says you have MFA on critical accounts, tested backups, endpoint protection, and a patching process, that needs to be true in practice — not just “mostly true.” When claims get large, carriers look closely. If your controls don’t match your application, you can end up arguing over coverage at exactly the worst possible time.
This is also why I push clients to treat cyber insurance as part of a broader risk program, not a checkbox purchase.
The same controls that reduce the chance of an incident often help with premiums too:
MFA, email protection, tested backups, endpoint visibility, user training, and a basic incident response plan.
That’s not marketing fluff. Carriers increasingly underwrite against those controls because attackers keep exploiting the same weak points.
My practical advice is simple: buy the policy, but buy it with your eyes open.
Don’t just ask for the annual premium. Ask where the sharp edges are. Ask what events are carved out. Ask what the insurer expects you to maintain. And if wire fraud or BEC would materially hurt your business, dig into that sub-limit until you’re satisfied you understand it.
A policy is only helpful if it responds the way you think it will when a bad week turns into a claim.
That’s the part too many businesses learn too late.