What Does Cyber Insurance Actually Cover in India?
Key takeaways
- Indian cyber insurance premiums rose in 2026 after 77 ransomware attacks were recorded in the country between January and June (Cyble CRIL, via Fortune India, 23 July 2026).
- Underwriters now require MFA, tested offline backups, EDR on all endpoints and a documented incident response plan before a policy is issued.
- Most Indian policies cover investigation, legal, notification and business interruption costs, and only some cover the ransom payment itself.
- A ransomware policy commonly carries a sub-limit for the ransom and an exclusion for social engineering and invoice fraud.
- Social engineering losses of over Rs 22,800 crore in India are largely outside cyber policies, which is why finance controls matter more than the policy wording.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does an Indian cyber insurance policy actually pay for?
Four cost buckets, in rough order of size. First, business interruption: the revenue loss between the incident and the restoration of service, which is why an Ernakulam hospital losing over 800GB of patient data in March 2026 had a materially worse interruption profile than a data-only breach. Second, forensic investigation and incident response, which is where the professional fees sit. Third, legal, regulatory and data-subject notification costs, including the work required under the Digital Personal Data Protection Act, 2023. Fourth, and in a minority of policies, the ransom payment itself, usually sub-limited and usually subject to a lawfulness condition. Almost always excluded: losses caused by failure to maintain the controls the policy assumes, and losses from attacks that pre-date the policy's discovery clause window.
Why did premiums rise, and what are insurers asking for now?
Three forces. Ransomware frequency in India rose sharply, with 77 attacks between January and June 2026 and India the second most ransomware-hit country in APAC. Losses themselves grew, with 21,900 digital-arrest complaints involving over Rs 647 crore in the first eight months of 2026. And buyers' security posture became the underwriting variable. The practical consequence is that a broker's quote now moves with your controls: turning on phishing-resistant MFA, proving offline backups with a restore test, and deploying EDR with a documented coverage percentage routinely change the price band. A business that cannot evidence its controls is quoted as a worse risk than one that can.
What is usually excluded, and why does that matter for small firms?
The exclusions are where policy wording does the most work. Common exclusions across Indian policies include: social engineering and business email compromise, losses from a failure to patch, criminal fines and penalties where unlawful, and any incident traceable to non-compliance with a stated security schedule. That last clause is the dangerous one, because it converts a checklist into a condition of the contract. A firm that paid for a policy before it could evidence MFA, backups or EDR coverage may find that the very event it insured is excluded. The remedy is unglamorous: align the policy's security schedule to what you can actually evidence, and get a broker and a security assessor in the same room rather than negotiating them separately.
Should a small Kerala business buy cyber insurance at all?
It depends on whether the loss would be existential. For a firm whose revenue would not survive three months of downtime plus investigation costs, a policy with a sensible sub-limit is cheap relative to the risk. For a firm that can absorb a few weeks of disruption, the premium may be better spent on controls, because the exclusions will not pay for a missed deadline. Indians have lost over Rs 22,800 crore to telecom fraud and impersonation scams, and very little of that sits inside a cyber policy, which is a reminder to read the social engineering exclusion carefully before treating insurance as a control.
| Cost category | Usually covered? | Typical condition |
|---|---|---|
| Forensic investigation and incident response | Yes | Reasonable pre-approved rates |
| Business interruption and restoration | Yes | Depends on the security schedule |
| Legal and notification costs | Usually | DPDP Act compliance costs often capped |
| Ransom payment | Sometimes | Sub-limit, lawfulness and law-enforcement conditions |
| Social engineering and BEC losses | Rarely | Often excluded outright |
| Fines and penalties | Rarely | Excluded where unlawful |
What are the common questions about C?
Get a straight answer on this
Ask us for a fixed-price security assessment and an evidence pack you can hand straight to your insurance broker.
Send us the details See pricing