What Is Cyber Insurance and What Does It Cover?
Key takeaways
- Cyber insurance in India is largely a large-company market, so a small firm usually has a bigger exposure than most people in a business of your size realise.
- Cover is usually split into three buckets: restoration and business interruption, third-party liability, and incident response costs including forensics and legal advice.
- Ransomware is increasingly written with sub-limits and approval conditions, and some insurers will not pay a ransom at all where the payment is unlawful.
- The exclusion that surprises most buyers is failure to follow the policy's security requirements, so the controls listed in the schedule are a condition, not a suggestion.
- Insurance does not fund the recovery work, so backups, an incident response plan and a rehearsed restoration remain the parts that actually get the business running.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does cyber insurance cover in the Indian market?
Three main buckets, and a lot of conditions. First, the direct cost of the incident: forensic investigation, legal advice, notification and credit monitoring, and in many policies the restoration and rebuild of systems. Second, business interruption, which is the loss of revenue and the extra cost of operating while the systems are down, usually subject to a waiting period and a sub-limit. Third, third-party liability, covering claims from customers or partners whose data you held, and regulatory investigation costs where the policy allows it. Some policies also carry a ransomware sub-limit for the payment itself, with conditions such as prior approval and compliance with law enforcement guidance.
What does cyber insurance usually exclude?
Read the exclusions before the limits, because that is where policies differ most. Common exclusions are events known at the policy start, failure to maintain the security controls listed in the schedule, inadequate backups, and the consequences of a late notification. Social engineering is excluded or reduced in some policies, and so is any loss arising from a violation of law or an unauthorised payment, which matters given how many Indian losses now start with a payment approval. Deliberate or negligent acts by senior management, contractual liability for things the policy does not name, and losses arising from a failure to comply with a regulatory obligation are all excluded in most policies.
How does a ransomware claim actually run?
It is a documented, staged process, and speed matters. Notify the insurer and the broker as soon as the incident is confirmed, because most policies require prompt notice and late notification is a common ground for reducing or refusing a claim. Preserve everything: logs, images, the ransom note, the communication, the threat actor's instructions, and record every decision with its time. Do not pay a ransom without checking with law enforcement and the insurer, because a payment can be unlawful, and the insurer will usually have a view and a negotiation adviser. Then the insurer's panel or appointed investigator runs the forensic work, and the claim is assessed against the cover.
Should a small Indian company buy cyber insurance?
Weigh it against a self-funded reserve. Insurance transfers a large loss you probably cannot absorb: a payment fraud, a data breach with third-party claims, or a ransomware event that also triggers liability. It is less obviously worth it for a small firm whose worst realistic loss is a few weeks of revenue. If your contracts require insurance, or you hold a lot of customer personal data, the answer changes, because the liability tail is what hurts. Do the controls the policy would require anyway: offline backups with a tested restore, phishing-resistant MFA, a callback rule on payments and a written incident response plan. Those reduce your premium, satisfy the policy conditions and still protect the business.
| Area | Usually covered | Common exclusion or limit | What to check |
|---|---|---|---|
| Incident response | Forensics, legal advice, notification support | Costs incurred before notice, or without approval | The notice window and what counts as notice |
| Business interruption | Lost revenue and extra operating cost during downtime | Waiting period and a sub-limit | The waiting period, usually 24 to 72 hours |
| Third-party liability | Claims from customers whose data you held | Contractual liability not named in the policy | The liability sub-limit and defence costs |
| Ransomware and extortion | Sometimes a payment or a negotiation service | Sub-limits, approval conditions, lawful payment only | The sub-limit and the approval process |
| Regulatory and compliance costs | Sometimes investigation and notification costs | Fines and penalties are often excluded | Whether fines are excluded in your policy |
What are the frequently asked questions?
Get a straight answer on this
Send us your turnover, sector and data volume, and we will return a fixed-price review of what a policy should cover and exclude, plus the controls that reduce your premium.
Send us the details See pricing