Is Your Business Protected Against Cyber Threats?

Most commercial combined and general liability policies exclude losses arising from cyber events as standard.

Where cover exists at all, it’s usually bolted on as an extension rather than built in. It comes with its own limitations and conditions that have to be met before it responds.

Why does this matter for SMEs?

There’s a common assumption that cyber incidents happen to large, high-profile organisations.

But that’s not what we see.

43% of businesses experience a cyber breach or attack (46% for small business and 42% for micro business) – UK Government Cyber Security Breaches Survey 2025/26.

Attacks can start from a simple human error

When leaders picture a cyber incident, they often picture a hacker breaking into their system. But more often, it starts with someone being let in – human error.

Your finance team receives an Invoice that looks the same as the last 50 (same supplier, format & tone).

They issue the payment and think nothing of it.

Later, the supplier calls asking where their payment is. By this point, the money has already moved twice more to somewhere it won’t come back from.

No system was breached. No malware was involved.

What can happen next?

Most incidents trace back to a handful of threat types that make up the bulk of UK cyber insurance claims:

• Phishing and business email compromise – where a fraudulent email impersonates a known supplier or colleague to steal credentials or redirect a payment;
• Ransomware – which encrypts your systems and data until a ransom is paid;
• Data breaches – usually through an unpatched vulnerability or a weak password rather than a sophisticated attack;
• Invoice and payment fraud – where manipulated bank details redirect a genuine payment to an attacker.

None of these require a large or sophisticated attacker, which is exactly why they’re so common.

The National Cyber Security Centre (NCSC) publishes free, practical guidance on recognising and defending against each of them at ncsc.gov.uk.

What happens in the first 24 hours?

When you have a cyber-attack, you need to know who you’re going to call.

Because the value of a specialist support shows up straight away.

People who can tell you what to do, and just as importantly, what not to do. The things you think might help, that you do in an initial frenzy, could actually make it worse.

The right insurance policy will provide you with access to experts via a 24-hour, 365-day response line.

It will also fund forensic investigation into how it happened and what’s been compromised, guidance on whether regulators need notifying, and the notification itself.

How long does the impact last?

Recompiling lost data or paying a ransom to get it back (where it’s economically justified and lawful), is not the end of the risk to you.

Every day systems are down, is a day of orders that can’t be fulfilled, and those orders might not come back on their own.

A cyber attack can damage the confidence of customer and partners. And it takes time for that to come back.

Your insurance should be built to cover both the cost of recompiling data or paying a ransom, and for lost sales during the attack and the reputational harm that follows it.

Who should be thinking about this?

Any business that stores customer or employee data digitally, relies on digital systems for day-to-day operations, or makes and receives payments based on invoices and instructions sent digitally — which in practice is almost every growing business trading today.

The cost of cyber insurance is a fraction of the cost of a single uninsured incident.

Want to understand your cyber exposure? Get in touch and book a Cover Review.