Cyber insurance is a financial safety net that covers losses from cyber incidents — data breaches, ransomware attacks, business interruption, and liability claims. As cyber attacks on Indian businesses increase and the DPDP Act introduces significant penalties, cyber insurance has moved from a luxury to a necessity for businesses of all sizes.
What Cyber Insurance Covers
First-party coverage covers your direct losses: data breach response costs (forensic investigation, customer notification, credit monitoring), business interruption losses (revenue lost during downtime), data recovery and system restoration, ransomware payments and negotiation (though paying ransoms is increasingly discouraged), crisis management and PR costs, and regulatory fines and penalties (where insurable by law).
Third-party coverage covers claims from others: liability to customers whose data was breached, legal defence costs, regulatory investigation costs, media liability (defamation, copyright infringement from a compromised website), and payment card industry (PCI) fines and assessments.
What Cyber Insurance Does Not Cover
Most policies exclude: pre-existing vulnerabilities or known breaches, losses from unpatched systems (failure to maintain), intentional acts by executives, war and state-sponsored attacks (a growing grey area), infrastructure failures (power outages, ISP downtime), reputational damage beyond crisis management costs, and future lost profits from customer churn. Read exclusions carefully — they matter more than inclusions.
The Indian Cyber Insurance Market
Major Indian insurers now offer cyber insurance: ICICI Lombard, HDFC ERGO, Bajaj Allianz, Tata AIG, and New India Assurance all have cyber risk products. Global specialists like AIG, Chubb, and Zurich also operate in India. Coverage, pricing, and claims experience vary significantly. Work with an insurance broker who specialises in cyber risk to compare options.
How Premiums Are Determined
Insurers assess your risk profile: industry sector, annual revenue, data volume and sensitivity, security maturity (MFA, encryption, backup practices, employee training), claims history, and geographic exposure. Businesses with strong security controls get lower premiums. Some insurers require a security assessment before issuing a policy.
How Much Coverage Do You Need?
Consider the worst-case scenario: if your customer database were breached, how much would investigation, notification, legal costs, and business interruption total? For SMEs, policies typically range from ₹50 lakh to ₹5 crore. Factor in: regulatory penalties under the DPDP Act (up to ₹250 crore for severe violations), forensic investigation costs (₹5-25 lakh), legal fees, customer notification costs, and estimated revenue loss during recovery.
Improving Your Insurability
Insurers increasingly require minimum security controls: MFA on email and critical systems, endpoint protection, regular backups (tested), employee security training, incident response plan, and patch management process. Meeting these requirements not only qualifies you for coverage but typically reduces premiums by 15-30%. Think of security investment and insurance as complementary — one reduces the likelihood of incidents, the other cushions the financial impact.
Filing a Claim
When an incident occurs: notify your insurer immediately — most policies require notification within 24-72 hours. Document everything from the start. Engage only pre-approved vendors (many policies require using the insurer’s panel of forensic investigators, legal counsel, and PR firms). Preserve evidence. Keep detailed records of all costs — including employee hours spent on response. Delayed notification or using unapproved vendors can void your claim.
Is Cyber Insurance Right for Your Business?
If you process personal data, handle financial transactions, depend on IT systems for operations, or serve clients who require it — yes. Cyber insurance is not a substitute for security — it is the financial backstop when security fails. The question is not whether you will face a cyber incident, but whether you can absorb the financial impact when you do.
