Cyber risks and insurance: what a business working online should know
When a business lives on the internet, the technical side is usually in order: the server runs, backups are made, the certificate is in place. Yet between "the server runs" and "the company is protected" there is a gap that people remember only once something has already happened.
What hosting and backups do not cover
Hosting answers for the infrastructure: the hardware, the network, the backups. If data is lost, it can be restored. But technical restoration does not settle what comes next:
- claims from customers whose orders or data were affected;
- losses to third parties caused by what the company did or failed to do;
- business downtime while everything is being put back together;
- employee mistakes that cost money rather than only time.
A backup returns the files. It does not return the week the shop was down, and it does not pay for a lawyer when a customer files a claim.
What policies exist
General liability insurance covers liability towards third parties: cases where someone else suffers a loss because of the company's activity. This is the base cover for most companies, whatever the industry.
Professional liability insurance applies to mistakes in professional services. For agencies, developers and IT consultants this is the closest fit: if a project contains an error and the client suffers a loss, the claim is directed at the service provider.
Property insurance covers the equipment and the office itself. For a company whose servers sit in colocation or in the office, that includes the hardware.
How it fits with the technical side
Insurance does not replace security, and security does not replace insurance. A policy does not lower the odds of a breach, and security measures do not lower legal liability. In practice the two work together: cybersecurity and regular backups reduce how likely an incident is, while a policy covers the consequences if it happens anyway.
One more thing worth settling before the policy: knowing where the data sits and who answers for it. If part of the systems is with one provider and part with another, the boundaries of responsibility should be clear before an incident rather than after it.
How to choose
A policy is fitted to the business model: an online shop, a SaaS product and a development agency carry different risks, so there is no off-the-shelf answer here. It is worth comparing offers from several insurers and looking not only at the cover but at the exclusions, because that is where the real differences sit.
If the question is what a particular company actually needs, company liability insurance is usually where the conversation starts, and from there it becomes clear whether professional liability cover is needed as well.