Duck and coverage: The insurance impact of a cyber attack

In April last year, Marks & Spencer revealed that it was battling an ongoing cyber incident that would eventually cost the company £136 million in emergency support, and wipe out 99% of its half-year pre-tax profit. Later that year, automaker Jaguar Land Rover would be hit by a similar attack that cost £196 million to fight, with disruption reverberating down its supply chain.

As well as direct loss of revenue from service disruption, these costs are driven by incident response, system recovery, and specialist crisis support across areas like PR and legal. While these examples represent the top end of the scale, experts warn that the underlying trend presents a threat for all businesses, and organisations may not be prepared for the full financial impact of a cyber attack.

“Insurance plays a really significant part in business resilience,” notes Eddie Lamb, cyber risk specialist at insurance provider Hiscox, “because oftentimes businesses will focus on the technology elements of resilience, but perhaps overlook the financial resilience.”

While some broader insurance products such as business interruption or professional indemnity cover may offer limited cyber security coverage, Lamb explains, general insurance policies typically don’t give full coverage for cyber attacks. Where these add-ons do exist, they generally offer scaled-down cover with capped benefits, leaving significant financial gaps.

With cyber security firmly established as a board-level issue, many organizations are instead choosing to take out specialist cyber insurance policies. As well as providing financial assistance to help cover lost earnings, insurers are increasingly bundling in preventative services, such as vulnerability scanning and phishing simulations, to help customers avoid claims altogether, but most policies also cover active incident response to manage the breach itself.

“If I ask a client what they're going to do if they have a fire, they tell me they'll call the fire brigade,” says Sam Cheshire, cyber practice leader at insurance broker and risk management firm Gallagher. “I often stop them and say, ‘Who's your fire brigade in the event of a cyber incident?’ If you don't have cyber insurance, then you've probably got nobody… The key aspect of the cyber insurance policy is that incident response bit that comes with it. And that's the SWAT team that will come in on Easter Sunday or Christmas Day.”

To pay or not to pay

While remediation can be expensive, one of the biggest costs of a cyber attack comes from lost revenue. When critical systems go down, every minute of lost productivity has a knock-on effect down a company’s supply chain. This is one of the reasons ransomware remains so widespread – and why many cyber policies now account for it.

“The ransomware element of the loss is covered under the policy – so that includes the payment of the ransom demand itself, which often surprises people,” says Cheshire, noting that as well as forensic and operational recovery, policies will often cover both the ransom amount itself, and the strategic handling of the extortion.

For many victims, the cost of paying the hackers off can be cheaper than trying to fight the attack, and while law enforcement agencies discourage the payment of ransoms, Cheshire says that insurers leave that up to the target.

“The insurers will effectively help you go down that route. Are you going to pay it? If so, are we going to see proof of life before we make that payment? Ultimately, the decision is made by the client, not by the insurer.”

He notes that cyber insurance has one of the highest claim payout rates in the commercial market, with major insurers paying out 98% to 99% of claims submitted. In general, policies will cover almost all immediate first-party expenses – including 24/7 incident response, digital forensics, ransom payments, legal fees, public relations, and business interruption reimbursement – up to the agreed cap.

As Cheshire explains, while policies can provide coverage for as much as £10m, few insurers will be willing to singlehandedly underwrite the extensive coverage needed by large corporations. Instead, he says, brokers will arrange deals with multiple insurers to provide additional layers of coverage totalling tens or hundreds of millions.

Premiums without penalty

Comprehensive cover is all the more important considering most experts agree that a business falling victim to an attack is a matter of when, not if. Thankfully, unlike more traditional business insurance products, claiming on a cyber insurance policy generally won’t drive up your premiums when it comes time to renew; in fact, according to Cheshire, experiencing a cyber attack can actually bring your insurance costs down in the long run.

Insurers, he explains, “want to hear the good news story” – a business that can demonstrate it has remediated the incident and reduced the likelihood of a future breach will see its premium reduced.

“I have a client in the talent acquisition sector who suffered an incident in December 2024,” he says. “When we came around to the January 2026 renewal, we managed to double the insurance indemnity, reduce the excess by £150,000, and secure the renewal at the same price as the expiring premium.”

Lamb adds that renewal premiums are not intended to be punitive. “Being victim to [an attack] is not a signal or indicator of how complacent you were with that risk. It's more an indicator of how aggressive the threat actors have become.”

This spike in aggression has driven extensive uptake of cyber insurance among larger organisations. According to both Gallagher and Hiscox, almost 100% of top-end corporate businesses have some level of cyber insurance provision. Smaller businesses, on the other hand, are comparatively underinsured when it comes to cyber security, with penetration dropping below 15% for companies under £5m in revenue.

Both experts attribute this gap to a fundamental misunderstanding of the threat landscape among smaller firms, with owners often believing that they are “too small” to be targeted. Lamb says small business owners are often focused on running the business, and may have less cash on hand to invest in areas which are not seen as immediately business-critical.

“The reality is that small businesses are just as highly targeted and just as lucrative for cyber crime,” explains Lamb. Organized crime groups are “very entrepreneurial”, he says, and automation means they can target smaller firms at scale, typically through higher-frequency, lower-value attacks such as business email compromise and payment diversion fraud.

Counting the cost

Yet, even among large enterprises, confidence in a full financial recovery is surprisingly low. A 2026 Cohesity survey of 100 UK enterprise CEOs found that only 22% believe their cyber insurance would cover both additional operational costs and lost revenue after an attack, despite estimating that an attack could cut their revenue by an average of 15%. One in five admitted their organization has never modeled the real-world cost of an attack.

Cheshire notes that the wording of a policy will dictate how coverage is calculated. Specifically, reimbursement for lost earnings can be calculated based on loss of gross revenue, or just on loss of net profit. Failure to scrutinize how indemnity is calculated can lead to major surprises after a prolonged system outage.

He also advises policyholders to check for any ‘conditions precedent’ – requirements a business must meet for a claim to be paid. The most common is multi-factor authentication, though some policies have also imposed terms around patch management and password changes. Most insurers have moved away from these clauses as the market softened over the past two years, but Cheshire warns they still crop up, particularly in older policies, and can leave businesses “tripped up at the time of claim when you probably think you have cover”.

Just as important is organizational culture. Human error is the most common cause of claims, according to Cheshire, so staff need to feel able to flag mistakes or warning signs immediately, in an environment where reporting issues is encouraged rather than punished. “The longer it's hidden for, the worse it gets.”

Even when the bill doesn't reach the hundreds of millions, the costs of incident response, service recovery and crisis comms can mount up quickly. Insurance can help provide a buffer against the worst of it, but for policies to be effective, organizations need a clear picture of their risk profile and coverage needs, and that starts with effective modeling of how their IT stack is woven through their operational environment.

Having sat on both sides of the fence, Lamb knows exactly how complicated it can be to map out an organization’s cyber risk profile – but he also knows the value it can bring.

“I used to be a cynic,” he says. “I was a CISO, I worked in engineering roles, I'm a technologist by trade… but I came to the industry to learn.” He now thinks of insurance as “one of the most valuable cyber resilience measures any business can take”, particularly with breaches becoming more and more common.

“It's not just ‘can you prevent it’, it's ‘how do you deal with it when it actually happens to your business?’” he says. “There's no perfect answer; hindsight is a beautiful thing. But did you have a plan? Did it work? How did you respond? How transparent were you about it? I think that's a far better metric than if a breach has happened.”