What is cyber insurance?
Cyber insurance is insurance that protects an organisation financially against the consequences of cyber incidents, such as recovery costs, business interruption, liability towards third parties and the cost of specialists after a data breach or ransomware attack. The policy pays for damage that occurs despite your security; it does not prevent a single attack. For industrial companies the cover for downtime matters most, because one day without production often costs more than the entire IT recovery.
Cyber insurance does not replace security measures, but provides a financial safety net when incidents do occur.
🧠 Why take out cyber insurance?
A cyber incident hits an organisation’s finances in several places at once. A standard property or general liability policy usually does not cover that damage, or covers it only ambiguously. A cyber policy bundles the cover and gives you immediate access to a network of responders.
| Reason | Explanation |
|---|---|
| Financial cover | Recovery costs, forensic investigation, third-party claims and lost revenue |
| Immediate help | A 24/7 hotline with incident response, lawyers and crisis communication |
| Legal support | Advice on data breaches, GDPR (AVG) notifications and proceedings |
| Limiting reputational damage | Cover for crisis communication and PR |
| Supply-chain requirements | Customers and clients sometimes require a cyber policy in contracts |
| Part of Risk Management | Transferring residual risk after technical and organisational measures |
Insurance is therefore a form of risk transfer: one of the four classic strategies alongside avoiding, reducing and accepting risk. Dutch and EU regulators do not require cyber insurance; NIS2 and the Dutch Cybersecurity Act mandate measures, not a policy.
📋 What is typically covered?
Policies usually consist of two parts: first-party cover (your own losses) and third-party cover (liability).
| Category | Type | Examples of cover |
|---|---|---|
| Incident response and recovery | First party | Forensic investigation, system restoration, data recovery |
| Business interruption | First party | Lost revenue or production due to system outage, after a waiting period |
| Cyber extortion | First party | Negotiation and sometimes the ransom, within limits and conditions |
| Legal costs | First party | Lawyers, notifications to data subjects and the regulator |
| Third-party claims | Third party | Claims from customers or partners after a breach or transmitted malware |
| Communication costs | First party | Crisis communication, press relations, call centre |
| Fines | Third party | Only where insurable by law; often excluded |
Note: cover varies considerably between insurers. The exact terms, limits and the waiting period before business interruption counts (often a number of hours) determine what you actually receive.
Ransom payments have been debated in the Netherlands for years. In April 2020 the Dutch Minister of Justice and Security, Ferd Grapperhaus, called on insurers to stop reimbursing ransoms while still covering the losses of victims who refuse to pay. The Dutch Association of Insurers (Verbond van Verzekeraars) responded cautiously. In 2021 the ministry studied a ban on reimbursing ransoms; the association warned that such a ban would achieve little, because insurers already push clients to try other solutions first. No ban followed. Some policies therefore still cover ransom, others do not. Paying parties on a sanctions list is prohibited in all cases.
❌ What is often not covered?
- Intent and gross negligence - for example deliberately disabled security
- Known, unpatched vulnerabilities - some policies restrict cover when a critical patch has been outstanding for a long time
- War and state-backed attacks - see the war exclusion below
- Physical damage and bodily injury - often excluded from cyber policies and at the same time excluded from property policies
- Infrastructure failure - outages at power, internet or telecom providers
- Betterment - a better system than before is at your own expense
- Reputational loss without direct financial consequence
⚔️ Why does the war exclusion matter so much?
NotPetya (2017) turned the war exclusion into the market’s biggest point of contention. Mondelez and Merck claimed their losses, but insurers invoked the exclusion for acts of war because the attack was attributed to the Russian state. Mondelez and Zurich settled in October 2022. In Merck’s case, a claim of around 1.4 billion dollars, a New Jersey court ruled in 2022 that the traditional war exclusion did not apply. The appellate court upheld that in 2023, holding that the exclusion presupposes military action. The parties settled in early January 2024, shortly before the state’s Supreme Court was due to hear the case.
The market responded with new clauses. Since 31 March 2023 Lloyd’s of London requires every standalone cyber policy to exclude state-backed cyber attacks that seriously impair a state, based on model clauses from the Lloyd’s Market Association. Always read how your policy attributes an attack and who has to prove that a state was behind it.
🏭 How does cyber insurance work in an OT environment?
Cyber insurance was designed for IT risks, whereas in OT the largest losses come from downtime and physical consequences. That leads to a few typical points of attention.
| OT risk | Possible damage / claim | Coverage question |
|---|---|---|
| Process downtime (SCADA/PLC) | Production losses, delivery penalties, customer claims | Does OT fall under “computer system” in the policy? |
| Office IT ransomware with a precautionary OT shutdown | Lost production without affected controls | Does a precautionary stop count as business interruption? |
| Data breach via edge or remote access | GDPR claims, reputational damage, liability | Usually covered under privacy liability |
| Manipulated control systems | Machine damage, environmental damage, injury | Often excluded; check the property policy |
| Loss of water or energy supply | Public and legal consequences for utilities | Liability towards customers is limited |
In the Jaguar Land Rover cyberattack of 2025, production stood still for about five weeks, while there is no public evidence that the control systems themselves were hit. According to Reuters, JLR was still negotiating a cyber policy through the broker Lockton that had not been finalised, and the company appeared not to be directly insured for the attack. The UK government then provided a guarantee for a loan of 1.5 billion pounds. The case shows why the question “does my policy cover a precautionary plant shutdown?” is essential.
There is also silent cyber: cyber risks that a property or machinery breakdown policy neither explicitly covers nor excludes. Lloyd’s has required policies to address this clearly since 2020, and in the energy and marine sectors the CL380 cyber attack exclusion clause has been common since 2003. Physical damage from a cyber attack on OT can therefore fall between two policies.
🔐 Which security requirements do insurers set?
After the ransomware wave of 2020–2021, premiums rose sharply and underwriting became stricter. Insurers now use detailed questionnaires to assess the maturity of your security. Commonly required controls:
- MFA on email, remote access and administrator accounts
- Offline or immutable backups that are restored regularly as a test
- EDR on workstations and servers
- Patch management with a fixed deadline for critical vulnerabilities
- PAM for administrator privileges
- Network segmentation between IT and OT, preferably in line with IEC 62443
- A tested Incident Response Plan and awareness training
Security by Design and demonstrable compliance with BIO or IEC 62443 strengthen your position during underwriting, although each insurer decides for itself whether that leads to a lower premium.
✅ How do you take out cyber insurance sensibly?
- Map your risk - carry out a risk assessment and a Business Impact Analysis and determine what a day of downtime costs.
- Choose the sums insured - align limit, deductible and waiting period with the outcome, not with the premium.
- Read the definitions - check whether OT, cloud and suppliers fall under “computer system”.
- Know the policy’s notification duty - report incidents immediately, separately from your duties under the Cybersecurity Act or the GDPR.
- Work with the panel - use the insurer’s incident response providers or have your own providers approved in advance.
- Exercise - include the insurer in a tabletop exercise and in your crisis communication plan.
- Embed it in governance - record who files the claim, who coordinates and how it fits with business continuity and your security policy.
📊 How big is the cyber insurance market?
| Indicator | Status |
|---|---|
| Global premium 2024 | Around 15.3 billion dollars, less than 1% of all property and casualty premium |
| Share North America | Around 69% (about 10.6 billion dollars) |
| Share Europe | Around 21% (about 3.3 billion dollars) |
| Estimate 2025 | Around 16.3 billion dollars |
| Outlook 2030 | More than double, with average growth of over 10% a year |
| Leading cause of loss | Ransomware |
Large corporations pay most of the premium. Many small and medium-sized businesses are uninsured or underinsured, even though they are often the ones without a buffer to absorb weeks of downtime.
❓ Frequently asked questions
Is cyber insurance mandatory?
Cyber insurance is not a legal requirement in the Netherlands, not even under NIS2 or the Cybersecurity Act. Customers, clients or lenders can, however, require a cyber policy in their contracts. The law mandates security measures and incident reporting, not insurance.
Does cyber insurance pay the ransom after a ransomware attack?
Some cyber insurance policies reimburse a ransom within pre-agreed limits, while others exclude it. Paying parties on a sanctions list is always prohibited. Even when the ransom is covered, restoring from your own backups remains the preferred route.
Does cyber insurance cover damage to OT and production?
Cyber insurance often covers lost production due to a system outage, but usually not physical damage to machinery or bodily injury. Check whether OT falls under the policy’s definition of “computer system” and whether a precautionary shutdown counts as business interruption. Align your cyber policy with your property and machinery breakdown policies.
How much does cyber insurance cost?
The premium for cyber insurance depends on revenue, sector, sum insured and the maturity of your security. Organisations without MFA, offline backups or EDR often pay a higher premium or are refused cover. Request quotes through a specialist broker and compare the terms above all.
Does cyber insurance pay out after a state-backed attack?
Many cyber insurance policies exclude state-backed cyber attacks, especially since Lloyd’s made that mandatory for standalone cyber policies in 2023. After NotPetya, a US court found the traditional war exclusion too narrow to apply. Always read how your policy attributes an attack to a state.
Can cyber insurance replace security?
Cyber insurance cannot replace security, because insurers require baseline controls before they offer cover at all. Moreover, a policy pays money, but it does not restore lost customer trust, data or time. Treat insurance as the last layer after prevention, detection and recovery.
📌 In summary
Cyber insurance is not a replacement for security but a strategic safety net for residual risk. Choose your cover based on what downtime costs you, read the exclusions for war, physical damage and OT critically, and embed the policy in your governance, incident response and business continuity.