Cyber Insurance for SMEs: What Does It Cover and What Does It Cost?

Cyber insurance sounds like the answer for any business owner losing sleep over ransomware and data breaches. But what does a cyber insurance policy actually cover, what does it cost, and will the insurer really pay out when it matters? In this article we explain honestly what cyber insurance does and doesn't do for SMEs, what insurers require from you, and why technology and insurance need each other rather than replace each other.

What exactly is cyber insurance?

Cyber insurance is a business policy that covers the financial losses and recovery costs caused by cyber incidents: a hack, a data breach, ransomware, a DDoS attack or a successful phishing attempt. Unlike liability or contents insurance, it focuses specifically on digital damage and its consequences for your business and your customers.

In the Netherlands, cyber policies are offered both by major insurers and by specialist providers. The Dutch Association of Insurers (Verbond van Verzekeraars) treats cyber as a separate line of non-life insurance, and the Dutch National Cyber Security Centre (NCSC) sees cyber insurance as part of risk management, not as a substitute for security.

What does cyber insurance cover?

Exact cover differs by insurer and by policy, but most packages include these elements:

• First-party losses. Lost revenue due to business interruption, the cost of restoring systems and data, and the cost of bringing in IT specialists to get your systems running again.
• Crisis management. Legal advice, communication with customers and the press, and a forensic investigator to establish exactly what happened.
• Liability. Damage you cause to third parties, such as customers whose personal data has been leaked.
• GDPR-related costs. Investigating and reporting a data breach and, under some policies, the cost of a GDPR fine (to the extent it is legally insurable).
• Cyber extortion. Support during ransomware incidents and, in certain cases, the ransom itself, provided strict conditions are met.

A good policy covers both direct losses (your own damage) and indirect losses (claims from others). The question is which modules you need, and that is where policies differ significantly.

What doesn't cyber insurance cover?

Now for the honest part. Cyber insurance is not a silver bullet, and the exclusions often carry more weight than business owners expect.

• Acts of war and state-sponsored attacks. Damage from attacks attributable to a state actor is almost always excluded. This clause has been worded more strictly in recent years.
• Damage caused by negligence. If you haven't enabled multi-factor authentication, don't make backups, or have ignored known security updates for months, you risk the insurer rejecting your claim or reducing the payout.
• Long-term reputational damage. You won't be compensated for customers who walk away after a data breach.
• Fines that are not legally insurable. A large share of administrative fines (and in some jurisdictions GDPR fines too) fall outside the cover.
• Pre-existing incidents. A ransomware attack that is already under way when you take out the policy is not covered.

So always read the policy terms, not just the sales brochure. The value of cyber insurance lies in the details. If you don't have time for that, ask someone who knows where the catches in these policies are hidden.

What does cyber insurance cost for an SME?

Quoting a single figure for "SMEs" would be misleading, because premiums depend on your revenue, your sector, the sum insured, your level of security and the excess. What we can give you is the range.

For a small business, premiums start at roughly a few hundred euros a year. For a larger SME with a sum insured of half a million to a million euros, annual premiums quickly rise to somewhere between €1,000 and several thousand euros. The excess is usually between €250 and €1,000 per incident, and accepting a higher excess lowers your premium.

What you actually pay depends on the insurer's risk assessment. A business with demonstrable security measures gets a better premium than one with nothing to show. For SMEs it makes sense to get quotes from two or three providers, because prices vary widely. If you want a broader view of what cybersecurity itself costs, our guide on what cybersecurity costs for SMEs helps you frame the bigger picture.

What security do insurers require?

This is where it gets concrete. Insurers want to see that you have the basics in place before they sign, and the requirements get stricter every year. The most common minimum requirements are:

1. Multi-factor authentication (MFA) on all external access, email and business accounts. No MFA means no policy, or no payout when you claim.
2. Working backups with a tested recovery procedure, preferably with an offline or immutable copy. To an insurer, a backup you have never tested is not a backup.
3. Patch management that demonstrably applies security updates to systems and software in good time.
4. Awareness training for staff, often combined with phishing simulations.
5. An incident response plan that sets out who does what during an incident.
6. Baseline technical security: firewall, endpoint protection and logging, properly configured and maintained.

These requirements come straight from NCSC guidance and the policy terms of major providers. For setting up MFA securely, we have a detailed practical guide to two-factor authentication for businesses, and if you want to know how to make your staff cyber-aware, read our article on security awareness training.

Why insurance doesn't prevent a hack

This may be the most important part of this article. Cyber insurance compensates you for damage. It prevents nothing. A well-secured business is hit less often and less severely, and recovers faster. A poorly secured business is hit more often and harder, and after an incident often still pays out of its own pocket for reputational damage and lost customers.

The NCSC puts it plainly: cyber insurance is a final safeguard, not a substitute for security. Research also shows that businesses with well-configured backups are far less likely to have to pay a ransom after a ransomware attack. To see the full scope of what good protection involves, take a look at our ten-step plan to protect your business against hackers and our comprehensive cybersecurity checklist for SMEs.

When does cyber insurance make sense for your business?

Cyber insurance almost always pays off, provided it is affordable and fits your risk profile. But there are situations where a policy becomes especially valuable:

• You process personal data of customers or patients on a large scale.
• You run an online shop or platform where a single day of downtime directly costs revenue.
• You work for clients who explicitly ask for cyber insurance in their supplier assessments.
• You fall under regulations such as NIS2 or DORA and want a financial safety net for the consequences of an incident.
• You have just been through an incident and want a safety net for the future.

And there are situations where a policy adds little as long as your security isn't in order. Taking out insurance without MFA and without tested backups is treating the symptoms: you end up with a policy with so many exclusions that it won't pay out in practice.

How to approach it sensibly

Treat this as a business decision, not a quick purchase. A workable order of steps:

1. Get your security in order before you ask for a quote. MFA, backups, patching and awareness training are the cornerstones. A managed IT partner can help you get up to standard within a few weeks.
2. Assess your risk. What data do you process, how much revenue do you lose per day of downtime, what liability risks do you run, and which regulations apply to you?
3. Request quotes from several providers and present them with comparable scenarios. What do they pay out for ransomware when you have tested backups? What about a data breach involving 5,000 customer records? What if the attacker is identified as a state actor?
4. Read the policy terms, or have someone with experience of cyber policies do it for you.
5. Actively maintain your security. Today's favourable terms are worth nothing tomorrow if your security has been neglected.

For businesses that want to hand their security to a specialist on a structural basis, our cybersecurity service offers an end-to-end approach that meets the requirements of insurers as well as those of NIS2 and related legislation.

Frequently asked questions about cyber insurance for SMEs

What exactly does cyber insurance cover?

Cyber insurance typically covers your own losses from cyber incidents (lost revenue, recovery costs, forensic investigation), crisis management costs (legal advice, communication), and liability claims from third parties such as customers whose data has been leaked. Many policies also cover GDPR investigation costs and, under strict conditions, ransomware. Always read the policy terms, because the details vary widely between providers.

How much does cyber insurance cost for an SME?

Premiums start at roughly a few hundred euros a year for a small business and rise to several thousand euros for a larger SME with a sum insured of half a million to a million euros. The actual amount depends on your revenue, sector, level of security and the excess, which is usually between €250 and €1,000 per incident.

What security does an insurer require?

Most insurers require at least multi-factor authentication, tested backups with an offline copy, active patch management, awareness training for staff and an incident response plan. Without these measures a claim can be rejected or the payout reduced, even if the policy itself remains in force.

Does cyber insurance replace good security?

No. The Dutch NCSC explicitly calls cyber insurance a final safeguard, not a substitute for security. Insurance compensates you for damage; it doesn't prevent an attack. Businesses with good prevention are hit less often and less severely, and recover faster. What's more, policy terms only work if your security is demonstrably in order.

Is ransomware always covered?

Not automatically. Many policies cover ransomware incidents, but under strict conditions: demonstrably working backups, active patching, MFA and no evident negligence. The ransom itself is increasingly excluded or reimbursed only under tough conditions. A successful recovery from your own backups is both cheaper and faster.

Conclusion

Cyber insurance can be a sensible addition to your risk management, but only if you have the basics in place and understand your policy terms. Without MFA, backups, patching and awareness training, you are paying expensive premiums with little prospect of a payout. With those measures in place, the policy becomes a safety net for the damage you might still suffer despite everything.

Want help bringing your security up to standard first, or a second opinion on a cyber insurance quote? Call TRON Group on +31 85 303 5869 or take a look at our cybersecurity service. Together we'll work out which measures matter most for your business, help you meet insurers' requirements, and make sure your policy works not just on paper but in practice.