Does a UK Small Business Actually Need Cyber Insurance?

Cyber insurance isn't legally required in the UK the way employers' liability insurance is, but insurers now ask enough security questions upfront that getting a policy at all forces you to fix gaps you might have ignored otherwise. If you're a small business handling customer payment data, personal records, or anything covered by UK GDPR, skipping cyber cover is a gamble most owners regret after their first incident.

What insurers check before they'll quote you

Ask for a cyber quote and you'll fill in a proposal form that reads like a mini audit. Standard questions from UK insurers (Hiscox, AXA, and the cyber-specific underwriters at Lloyd's syndicates all follow a similar pattern) cover:

• Multi-factor authentication on email and remote access (RDP especially — insurers treat exposed RDP without MFA as close to an automatic decline)
• Whether you have offline or immutable backups, and how often you test restoring them
• Endpoint protection across all company devices, not just servers
• Patch management timelines for critical vulnerabilities
• Whether you've had a breach or ransomware incident in the last 3-5 years
• Employee security awareness training frequency

Answer "no" to MFA or backups and you'll either get declined, quoted at a much higher premium, or offered a policy with a ransomware sub-limit that's practically useless. This isn't an insurer being difficult — payout data across the industry has pushed underwriters to tighten requirements hard since 2021, when ransomware claims spiked.

The minimum technical baseline most policies expect

From what's asked on proposal forms across the market, treat this as your floor before applying:

• MFA on all email accounts and any remote access tooling (Microsoft 365 Conditional Access or a tool like Duo)
• Backups following a 3-2-1 pattern, with at least one copy offline or air-gapped from your main network
• A documented incident response contact — even if it's just "call this MSP number"
• Endpoint detection, not just legacy antivirus, on anything touching customer data
• Firewall rules restricting inbound RDP/SSH from the open internet

If you're a five-person consultancy running everything through Microsoft 365 and a couple of laptops, this is achievable in a weekend. If you're running legacy on-prem servers with no patching schedule, expect the underwriting process to take longer and cost more.

What the policy actually pays for

UK cyber policies typically bundle several types of cover, and it's worth knowing what each does before you assume you're protected:

• First-party costs: incident response (forensics, a firm like your breach coach), business interruption, ransom negotiation and payment (where legal), data recovery, PR/crisis comms
• Third-party liability: claims from customers or partners whose data was exposed, plus regulatory defence costs
• ICO fines: cover varies — some policies exclude regulatory fines outright since insurability of penalties is legally murky in the UK, so read this clause carefully rather than assuming it's included

A £2m business interruption limit sounds generous until you calculate what a week of downtime actually costs you in lost invoicing, staff time, and client churn. Model that number yourself before picking a limit — don't just take the broker's default recommendation.

Do you legally have to report a breach even without insurance?

Yes, and this catches small businesses out. Under UK GDPR, if a breach risks people's rights and freedoms you must notify the ICO within 72 hours, insurance or not. Cyber insurance doesn't remove that obligation — it pays for the forensics and legal support that make meeting the deadline realistic. Trying to run breach response without that support, using a junior IT contractor and a Word document, is how businesses end up self-reporting late and drawing more ICO scrutiny than the original incident warranted.

Common gaps that trip up small business owners

• Assuming a general business insurance policy covers cyber incidents — most explicitly exclude it now
• Not disclosing known vulnerabilities on the proposal form (insurers can void the policy for material non-disclosure)
• Buying the cheapest policy without checking the ransomware sub-limit, which is sometimes a fraction of the headline coverage amount
• No named incident response provider, meaning you're scrambling to find one during the actual attack

Get a broker who specializes in cyber, not a generalist who sells it as an add-on. The difference in claim experience is significant.

If you want to go deeper on the technical side of what insurers are actually checking, look at Korra Studio's Blue Team and Digital Forensics segments — they cover incident response and backup architecture in the kind of detail that makes underwriting conversations a lot less painful.