Security experts warn cyber insurance ‘should not be treated as a get-out-of-jail-free card’

Just one in five UK business leaders believe their cyber insurance will provide adequate protection in the event of a breach, according to new research from Cohesity.

In a survey conducted by the firm, only 22% of respondents believe cyber insurance policies will cover the costs and revenue losses associated with a cyber attack.

Cohesity said the survey highlights growing anxiety among business leaders given the heightened threats enterprises face. Concerns over losses in the wake of an attack are also growing, the survey noted.

CEOs estimate that a cyber attack could cut their organization’s revenue by 15.17% on average.

These figures are a ballpark estimate, however. One in five reveal that their business has “never undertaken business impact modelling to understand the potential cost of an attack”.

Without modelling, Cohesity warned that enterprises might never know the true scale of their potential insurance shortfalls, and this could come back to bite them.

Fraser Hutchison, VP UKI at Cohesity, said the study shows cyber insurance “should not be treated as a get-out-of-jail-free card”.

“As the threat landscape becomes increasingly complex, organizations cannot treat an insurance policy as a substitute for resilience,” he said.

“Organizations need to understand exactly what their policies will and will not cover, model the potential impact of different attack scenarios and prepare for losses that may fall outside their policies.”

Cyber insurance in the spotlight

Cyber insurance is now viewed as a critical fallback for enterprises due to rising global security threats, yet research from the UK government’s Cyber Security Breaches survey found half of firms across the country have no policy at all.

Awareness is rising, however. Analysis from the Association of British Insurers (ABI) in November last year showed 17% more policies were taken out across 2025 than in the year prior.

Speaking at the time, Jonathan Fong, head of general insurance policy at the ABI, said cyber insurance is “more than just a financial safety net” and now forms a key component of broader resilience strategies.

“The right policy not only supports businesses in the aftermath of an incident, but can also help prevent attacks through access to expert advice, threat monitoring, and incident response planning,” he said.

That study from ABI found cyber insurance payouts skyrocketed in 2025, with £197 million paid out across the year.

ABI pointed to Marks & Spencer (M&S), which recovered £100 million from insurers after a devastating attack disrupted operations in April 2025.

Knowing your policy

Cohesity urged UK business leaders to improve their understanding of cyber insurance policies, including what they’re entitled to in the event of a cyber attack.

First and foremost, firms need to understand their full financial exposure, modeling the “direct and indirect consequences of different attack scenarios”.

This includes potential revenue losses, downtime, remediation costs, customer attrition, reputational damage, and lost productivity. All these metrics are crucial when measuring the broader impact of an attack.

Similarly, understanding what insurers will and will not cover is vital. According to Cohesity, business leaders “need clarity” on areas such as policy limits, exclusions, and conditions, as well as the losses the organization itself needs to absorb.

Focus on resilience

According to Hutchison, the best approach for enterprises is to bolster cyber resilience capabilities to avoid any difficult conversations in the event of an attack.

“Cyber insurance can mitigate some of the financial risk, but the only way to truly bounce back from a cyber attack is by embedding genuine resilience into operations,” he said.

Hutchison added that enterprises need to identify systems and data that are critical to keeping the lights on in the event of a breach.

Elsewhere, assigning “clear responsibility” for recovery decisions is vital, as is regular testing to establish whether critical services can be restored in a timely fashion.

Improving cyber resilience also has a tangible impact on the cost of cyber insurance, research shows.

As ITPro previously reported, research from Sophos found enterprises that improved security capabilities were able to push down cyber insurance coverage rates.

A whopping 97% of respondents told the security firm that they had invested in cyber resilience with the explicit goal of improving insurance rates.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.