What Impacts Cyber Insurance Pricing
Cyber insurance pricing reflects both your business profile and how you manage cyber risk. In our latest conversation, Duncan Sutcliffe of Sutcliffe & Co Insurance Brokers explained how security controls can influence the premium you pay, the insurers willing to quote and the application process.
Your business sets the baseline
Insurers typically start with your sector, turnover, employee numbers and the volume of data records you hold. These help them assess the scale of a potential incident.
They may also ask what proportion of turnover comes from North American customers, where litigation following an incident can be particularly costly. Your website domain can matter too: some insurers carry out external scans to understand your online exposure.
Security controls influence price and eligibility
Insurers also consider how you protect the organisation, with consideration for multi-factor authentication (MFA), endpoint security, backups and evidence that backups are tested. Staff training and incident-response arrangements also help insurers understand how you manage risk.
MFA adds an extra check when someone signs in, beyond a password. This should be a priority for SMEs, with some insurers declining to quote without it.
Larger organisations and those in higher-risk sectors can face more detailed questions about technical controls and governance. Stronger arrangements may improve access to cover as well as influence pricing.
Cyber Essentials can support your application
Some insurers offer a discount for Cyber Essentials certification. Others ask about the same technical controls individually. Certification can also simplify an application where insurers accept it as evidence of those controls.
A discount is not universal or guaranteed. The value lies in implementing and maintaining the protections, with certification providing evidence of a defined security baseline.
How much difference can controls make?
As an example of how cyber insurance costs can vary, a two-person architectural practice was offered cover at approximately £150 by one insurer, subject to particular technical controls. Another insurer offered cover with fewer control requirements at approximately £800.
This illustrates why security requirements matter when comparing quotations. Ask your broker to explain differences in cover, exclusions, excesses and conditions alongside the premium.
Accurate answers matter throughout the policy
Answering application questions truthfully is critical when taking out cover. Saying you hold certification or have controls that are absent can have serious consequences when claiming.
There is also a difference between deliberate misrepresentation and an isolated operational oversight. However, how an insurer treats a gap depends on the circumstances and policy wording. Keep controls working, retain supporting evidence and check uncertainties with your broker.
Prepare before your next renewal
Start by reviewing MFA coverage, firewall configuration and tested backups. Check that staff know how to report an incident and that your application accurately reflects your business.
Security investment should reduce disruption and protect your data while supporting appropriate insurance cover. A lower premium can be an additional benefit.
Factory Internet offers a free, 30-minute Cyber Essentials consultation to help you understand your starting point and prioritise practical improvements. Speak to your insurance broker about how those improvements could affect your policy.
