Cyber insurance for SMEs: when it pays and when it does not

Cyber insurance covers the costs of responding to a cyberattack: forensic investigation, data-recovery services, notification obligations under GDPR, legal fees, business-interruption losses, and in some cases ransom payments. Ten years ago it was a cheap tick-box policy. After a cycle of ransomware payouts and tightened underwriting, 2026 cyber insurance is expensive, exclusion-heavy, and worth deciding deliberately for an SME.

What is typically covered

First-party costs: forensic investigation, data restoration, business interruption, PR/crisis communications, notification to affected individuals under GDPR, legal advice. Third-party costs: regulatory fines (where insurable), customer claims, defending lawsuits.

What is typically excluded in 2026 policies

State-sponsored attacks (the "war exclusion" has broadened significantly after NotPetya litigation). Known-but-unpatched vulnerabilities (if you knew about Log4Shell and did not patch, your claim is denied). Ransom payments to sanctioned entities (even inadvertently). Social-engineering losses (CEO wire-fraud scams) unless specifically endorsed.

Underwriting requirements

MFA on all admin accounts (not just email). Backups that are tested and stored offline/immutable. Patch-management policy with evidence of recent patches. Employee security training with evidence of annual completion. For higher coverage limits: EDR (endpoint detection and response), SOC monitoring, documented incident-response plan.

What a policy costs in 2026

For a 20-person professional services firm with €2M revenue: €4,000-€12,000/year for €1M-€2M coverage, with deductibles of €10,000-€25,000. Prices have doubled or tripled since 2022.

When to buy

You hold meaningful amounts of personal data (patient records, financial data, large customer databases). You have revenue that would be materially damaged by a few days of operational interruption. You have contracts (B2B, enterprise, public sector) that require you to carry cyber coverage as a vendor condition.

When to skip

Very small firms (1-5 people) with limited data holdings — the policy premium often exceeds the realistic loss. Firms where you cannot meet the underwriting controls — you will pay for a policy that will be denied at claim time. Firms where self-funded recovery (strong backups + established IR relationships) is more cost-effective than the premium.

The quiet alternative

Invest the premium money into controls that reduce the probability of incidents — MFA rollout, backup verification, employee training, EDR. For many small businesses this is a better ROI than the insurance itself, and it also unlocks lower premiums if you do buy later.