Cyber insurance is designed to help a business respond to and recover from cyber events such as ransomware, data breaches and business email compromise. Quality cover can include specialist incident response, forensic investigation, legal and notification costs, data restoration, lost revenue during digital interruption and liability to third parties, subject to underwriting, terms, conditions, exclusions and the policy wording.
A cyber event is an operational risk, not just an IT problem. When systems go down, revenue can stop, data may be exposed and the business may suffer reputational or brand damage. The business can also carry response and notification obligations while all of it is happening. Cyber insurance is designed to help fund the response, support lost revenue during digital interruption and respond to third-party and regulatory exposure, subject to policy terms. DKG reviews how your business could be affected before recommending and placing the appropriate and quality cyber cover.
Why it matters
The real problem is not just being hacked. A business that cannot access its systems, its data or its money may be unable to trade, which can have an immediate impact on cash flow and business continuity. Any business that takes payments, holds customer or employee data, depends on systems to operate or sits in someone else’s supply chain carries this exposure. Cyber attacks are increasingly automated and indiscriminate rather than targeted by business size. Outsourcing your IT does not necessarily outsource your legal responsibilities for data or protect you from the financial consequences of an interruption.
For mid-market and corporate businesses, the exposure compounds through larger interruption values, contractual requirements to hold cover and board scrutiny of cyber hygiene and resilience. Insurance is not a substitute for controls. Insurers now generally require baseline measures such as multi-factor authentication and tested backups before they will consider offering terms at all.
What are the benefits?
Generally, and subject to the policy wording, appropriately selected cyber cover can provide:
- Prompt access to experienced specialist incident responders, forensic investigators and legal advisers from the first hours of an event, where the policy provides access to a response panel or equivalent service.
- Support for the costs a cyber event generates, including investigation, notification, data restoration and recovery, subject to policy terms.
- Cover designed to support lost revenue during digital interruption of an insured’s own systems and, where included, systems operated by suppliers or providers it depends on, subject to waiting period, indemnity period and other policy requirements.
- A response to third-party claims and regulatory investigation costs where insurable and covered by the policy wording.
- A structured review of the crime and cyber boundary, so funds transfer fraud and social engineering losses have a deliberate home rather than an assumed one.
- Independent advice on limits, sub-limits and retentions measured against how your business earns revenue, the systems it depends on and the data it holds.
What can it cover?
Cover can include, subject to policy wording:
- Incident response costs: forensics, legal advice, crisis communication and notification support.
- Data restoration and system recovery costs after a malicious event.
- Business interruption cover for lost revenue during digital downtime, typically after a waiting period measured in hours and within the policy’s own indemnity period.
- Cyber extortion response, where lawful and included.
- Privacy and security liability to third parties whose data or systems are affected.
- Regulatory investigation costs, and fines and penalties only where insurable at law.
- Contingent business interruption for critical third-party platforms and providers, where the wording extends to them. Dependent business cover varies widely between policies and is not included in all cyber products.
- Fraudulent funds transfer and social engineering losses, which may be sub-limited, optional or placed in a crime policy instead. This is one of the most common gaps in the market and needs deliberate design.
What usually isn’t covered?
Exclusions and limitations vary between policies, but commonly include, subject to policy wording:
- Incidents and circumstances known before the policy started.
- Failure of power, telecommunications or other infrastructure and utilities.
- Betterment: upgrading systems beyond their pre-event state.
- Losses connected to unencrypted portable media or failure to maintain the controls stated in the proposal.
- Dishonesty of principals, in various forms across wordings.
- Fines and penalties that are not legally insurable.
- War and state-sponsored attack exclusions, which vary between insurers and remain an active area of market change. An experienced liability broker can help explain these provisions and seek appropriate refinements where the market allows.
- Bodily injury and property damage arising from cyber events, which sit between markets and should never be assumed covered either way.
- Other limitations and exclusions may apply depending on the insurer, policy wording and the nature of the risk.
How DKG supports you
DKG does not start with a product. We start by establishing how a cyber event could interrupt your business. We review your general cyber hygiene or maturity, systems dependency and what stops when systems go down, the volume and type of personal information you hold, your critical third-party platforms, your control baseline in general terms and any contractual requirements to hold cover. We also test proposal answers with your IT function before they are provided to the insurer, because control attestations can form part of the insurance contract and inaccurate or aspirational answers can create problems at claim time.
We then structure and place the programme: first-party and third-party limits measured against interruption values and records held rather than premium budget alone; waiting periods and indemnity periods considered deliberately; sub-limits surfaced rather than discovered at claim time; and the crime and cyber boundary reviewed so social engineering and funds transfer losses are addressed in the appropriate policy. Where system failure or contingent business interruption extensions are important to your operations, we seek to ensure the recommended policy includes the relevant extension, where available and appropriate.
When we place or renew your cover, we provide practical advice ahead of time on document security, preparing for a notification and accessing the incident response team quickly. When an event occurs, early notification matters. We help you identify when suspicious activity may need to be notified rather than waiting for certainty, engage the insurer’s response arrangements correctly and advocate on your behalf through to resolution, with the insurer and the policy wording determining the outcome. As your systems, providers and data profile change, we review the cover against them.
To discuss cyber incident response, data breach and digital interruption risks, contact Carien Ahdar via email or phone on 1800 252 926.
At DKG Insurance Brokers, we understand that each customer’s needs are different. We take the time to assess your individual risk requirements and recommend a solution suited to your circumstances. Please reach out to one of our experienced brokers to discuss your requirements.
Related services
Professional Indemnity Insurance
Management Liability (including Boardroom Liability) Insurance
Financial and Professional Liability Insurance
Business Interruption Insurance
Digital Asset Insurance
Important note: The information provided is general advice only and has been prepared without taking into account your objectives, financial situation or needs. When making decisions about cyber insurance, please consider the Product Disclosure Statement.
In FY2024–25, ASD’s ACSC received over 42,500 calls to the Australian Cyber Security Hotline, a 16% increase from the previous year. ASD’s ACSC also responded to over 1,200 cyber security incidents, an 11% increase. During FY2024–25, ASD’s ACSC notified entities more than 1,700 times of potentially malicious cyber activity – an 83% increase from last year – highlighting the ongoing need for vigilance and action to mitigate against persistent threats.
In FY2024–25, ASD’s ACSC received over 42,500 calls to the Australian Cyber Security Hotline, a 16% increase from the previous year. ASD’s ACSC also responded to over 1,200 cyber security incidents, an 11% increase. During FY2024–25, ASD’s ACSC notified entities more than 1,700 times of potentially malicious cyber activity – an 83% increase from last year – highlighting the ongoing need for vigilance and action to mitigate against persistent threats.
Why Choose DKG Insurance Brokers?
Reach out to Carien Ahdar via email or call 1800 252 926 to learn how we tailor cyber insurance to your operational, regulatory and risk management requirements.
Choosing DKG Insurance Brokers means partnering with a brokerage treating a cyber event as an operational risk, not an IT problem. Our team works across industries to structure cover aligned to how your business earns revenue, the data you hold and the systems you depend on to trade.
We work closely with specialist insurers, including Lloyd’s markets and other A-rated underwriters, to arrange protection for exposures including data breach, business interruption during digital downtime, ransomware, cyber crime, privacy liability and regulatory investigation.
As privacy and data protection obligations change, Australian businesses need cyber cover both commercially practical and fit for purpose. Our approach focuses on identifying coverage gaps, negotiating appropriate policy terms and closing the crime and cyber boundary so social engineering losses have one deliberate home.
Whether you are buying cyber cover for the first time, meeting a client or tender requirement, or reviewing an existing programme, DKG Insurance Brokers structures cover reflecting how your business would actually be interrupted.
In FY2024–25, ASD’s ACSC received over 42,500 calls to the Australian Cyber Security Hotline, a 16% increase from the previous year. ASD’s ACSC also responded to over 1,200 cyber security incidents, an 11% increase. During FY2024–25, ASD’s ACSC notified entities more than 1,700 times of potentially malicious cyber activity – an 83% increase from last year – highlighting the ongoing need for vigilance and action to mitigate against persistent threats.