Author
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
Cyber insurance is a policy that covers the financial impact of an incident: response and recovery, business interruption and third-party claims. It is worth it for almost any company that depends on its systems, but it only works if the basics are already in place: insurers require them both to issue the policy and to pay the claim.
Cybercrime is already an industry: according to Cybersecurity Ventures, it costs the world more than 10 trillion dollars a year. And according to the Hiscox Cyber Readiness 2024 report, 53% of small businesses suffered at least one incident in the last year.
| Cover | What it usually includes |
|---|---|
| Incident response | Forensics, containment, data recovery and legal advice from the first moment |
| Business interruption | The income you lose while the business is stopped |
| Third-party liability | Claims from customers or partners if their data is leaked |
| Crisis management | Communication with customers, notifications and public relations |
| Extortion and ransomware | Negotiation and, only where the law allows it, the ransom |
| Regulatory fines | In some policies, and only where the law allows them to be insured |
Incidents caused by gross negligence or by lacking the basic measures you declared.
Payment fraud (CEO fraud, bank account changes) unless that specific cover was bought.
Security improvements after the incident, unless agreed.
Attacks considered an "act of war", which many policies exclude.
Incidents that had already started before the policy was taken out.
That is why you need to read the exclusions and definitions, not only the summary of cover.
Before issuing the policy, the insurer usually sends a security questionnaire. It typically asks about:
Multi-factor authentication (MFA) on email, remote access and administrator accounts.
EDR on computers and servers, ideally monitored 24/7.
Isolated or immutable backups and restore tests.
Up-to-date patching and vulnerability management.
Staff training against phishing.
An incident response plan with contacts and owners.
Answer truthfully: if what you declared does not match reality, the insurer may reject the claim.
There is no single price. The premium mainly depends on:
The company's sector and turnover.
The type and volume of data you handle (personal, health, payment).
The security measures you have and can prove.
Previous incidents.
The limit of indemnity and the excess you choose.
In practice, improving your controls is the most direct way to get better terms.
Tell the insurer as soon as possible, as the policy requires.
Do not pay or negotiate a ransom without their approval and without advice.
Preserve the evidence: do not wipe or reinstall the affected devices.
Consider mandatory notifications, such as notifying the data protection authority within 72 hours if personal data is affected.
Almost always, if it is understood for what it is: the last layer. Insurance offsets the financial blow, but it does not prevent reputational damage or business downtime. Prevention, detection and working backups come first; the policy comes after.
Ciberseguridad720 does not sell insurance, but we help companies meet insurers' requirements: managed EDR with a 24/7 SOC/MDR, backups, MFA, vulnerability assessments and a response plan. If you are about to buy or renew a policy, start with our free diagnostic.
Keep exploring the same topic with more practical reads already available in the blog.
Published Jan 21, 2026 · 5 min read
When a cyber incident hits, the first priority is not perfection. It is containment, communication, and evidence preservation.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
Published Jan 21, 2026 · 4 min read
Phishing, ransomware, CEO fraud, supply chain attacks and social engineering: the five threats putting Spanish SMEs' business continuity at risk and how to prepare.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
Published Aug 18, 2026 · 8 min read
Antivirus blocks what it already knows. EDR watches behaviour, isolates the device and keeps the trail of the attack. We explain the difference with a table and when to make the jump.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720