Glossary
Cyber insurance
Also called: Cyber liability insurance
In one sentence
Insurance that helps pay for the costs of a cyberattack or data breach — investigation, recovery, notification, legal costs and sometimes lost income.
Cyber insurance covers costs that ordinary business policies often exclude: forensic investigation, restoring systems, notifying affected patients or clients, legal advice, regulatory defense, and sometimes business interruption and funds lost to fraud. Policies vary a lot — read what’s covered, the sub-limits, and the exclusions.
Getting and keeping cover now depends on your security. Application forms commonly ask whether you use MFA on email and remote access, have EDR on every device, keep protected and tested backups, patch promptly, train staff on phishing and have an incident response plan. Answering “yes” when the control isn’t really in place can put a claim at risk.
Most policies also have rules for what you do after an incident — usually calling the insurer’s hotline first and using their approved breach lawyers and forensic firms. That needs to be written into your incident response plan so nobody wipes evidence or hires the wrong firm in a panic.
Example: a medical practice renewing its policy finds a new question about immutable backups. Its backups were only on a local device, so it adds a locked cloud copy before signing — and answers truthfully. Check your own readiness with our cyber insurance readiness quiz and the cyber insurance requirements checklist.
Related terms
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- Immutable backupA backup copy that can’t be changed or deleted — by anyone, including an attacker with admin rights — until a set retention period ends.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.