I was asked a good question recently:
“If our IT and cyber security is strong, do we really need cyber insurance?”
It’s a fair challenge and one I hear quite a lot.
Short answer?
They do different jobs.
What good cyber security actually does
When it’s done properly, cyber security reduces risk.
It helps stop things like:
- phishing emails getting through
- ransomware taking hold
- accounts being compromised
- systems going down unexpectedly
If you’ve got things like MFA, patching, endpoint protection, email filtering and proper backups in place, you’re already ahead of most.
But even then… it’s not perfect.
You’re still dealing with people clicking links, suppliers getting breached, credentials being reused and attackers who are organised and patient.
Risk goes down. It doesn’t disappear.
Where cyber insurance fits in
Cyber insurance isn’t there to stop an attack.
It’s there for what happens after.
That might include:
- business interruption (you can’t trade)
- data recovery and forensic investigation
- legal costs and regulatory fines
- notification costs if personal data is involved
- reputational damage and PR support
This is the part many businesses underestimate.
It’s not just “getting back online”. It’s everything that comes with it.
What we’re hearing from the insurance side
This isn’t just a cyber security view.
Claire Thompson, Director at Acrisure Yorkshire, summed it up well:
“Cyber risks now outweigh any other risks to most businesses and yet, take up of cyber insurance is still not as high as it should be.
The common misconceptions that the IT company provides adequate protection or that data is stored in the cloud so it’s safe are reasons I hear all too often for declining to take out cover.
It’s great to see Kevin’s take on this and rightly so that both IT security and risk management all have an essential role to play in protecting your business and neither should be relied upon in isolation.”
That lines up exactly with what we see day-to-day.
“Our IT company would cover us”
This is probably the biggest misconception.
Even the best IT or cyber provider is there to prevent and respond, not to absorb financial loss.
They won’t be covering:
- lost revenue
- legal claims
- compensation
- regulatory action
That’s not how those agreements work.
It’s like saying:
“I’m a careful driver, so I don’t need insurance.”
You might be.
But you don’t control everything else on the road.
“Our data is in the cloud, so we’re safe”
Another one that comes up a lot and Claire called this out as well.
Cloud platforms like Microsoft 365 or Google Workspace are resilient.
That doesn’t mean your data is protected from:
- accidental deletion
- malicious insiders
- account compromise
- ransomware syncing encrypted files
The responsibility model matters here.
The platform stays online. Your data is still your responsibility.
The Cyber Essentials angle (and the bit many people miss)
One thing that often surprises people:
When you achieve Cyber Essentials certification, it includes £25,000 of cyber insurance as part of the package.
That’s a clear signal.
Even at a recognised baseline level of security, insurance is still baked in.
It’s not either/or – it’s both.
Insurers are getting stricter (and more technical)
Cyber insurance has changed quite a bit over the last few years.
Insurers are now asking detailed questions around:
- MFA coverage
- patching
- endpoint protection and monitoring
- backup design and testing
- access controls
If those controls aren’t in place, claims can be challenged.
We’re also seeing more recognition of structured standards.
Frameworks like SMB1001, particularly at Silver level and above, are starting to carry weight because they show:
- consistency
- evidence
- ongoing management of risk
It’s not just about having tools anymore. It’s about being able to demonstrate control.
A more honest way to look at it
Instead of asking:
“Do we need cyber insurance?”
A better question is:
“If something serious happened tomorrow, could we absorb it?”
Think:
- days or weeks of downtime
- loss of data
- clients unable to access services
- regulatory scrutiny
- cost of recovery
Some businesses can weather that.
Most can’t.
Where I land on it
I don’t see cyber insurance as optional for most organisations.
But I also don’t see it as a substitute for proper security.
The strongest position is:
- solid, layered cyber security
- backed up by insurance that reflects your actual risk
One reduces the likelihood.
The other protects you when things don’t go to plan.
Claire’s point is worth repeating in simple terms:
Cyber security and cyber insurance are both essential.
Neither should be relied on in isolation.
