Cyber Insurance for Small Business: What It Covers and Why It Matters

A generation ago, fire was the risk that kept business owners awake. Today it's an email. Business email compromise, ransomware and data theft hit thousands of Australian small businesses every year — and unlike fire, attacks are automated, relentless and indifferent to your size.

What a cyber policy actually pays for

• Incident response — 24/7 forensic IT, legal and PR support from the first phone call
• Business interruption — lost income while systems are down or being rebuilt
• Cyber extortion — ransomware negotiation and response
• Privacy breach costs — notifying customers, credit monitoring, OAIC investigations
• Social engineering fraud — funds transferred to criminals via fake invoices
• Third-party liability — claims from customers whose data was exposed

The exclusions to watch

Cheap cyber policies often exclude the most common loss: social engineering and funds transfer fraud. Others impose strict conditions around multi-factor authentication and backups — fail the condition, void the claim. This is exactly the fine print a broker is for.