“We’re too small to be a target.” It’s the most common thing small business owners say about cyber risk — and it’s the assumption attackers count on. Most attacks today are automated: bots scan for weak passwords, unpatched systems and exposed email accounts without caring whose business is behind them. When one lands, the disruption — locked files, a compromised email account, a fraudulent payment instruction — can cost more than many SMEs can comfortably absorb.
Cyber insurance exists to absorb part of that financial shock. But it is one of the most misunderstood covers on the market, so before you buy (or renew), here is what it actually does.
What cyber insurance typically covers
Incident response. Access to specialists — forensics, legal, PR — who help you contain a breach and meet your obligations, including notification duties under Malaysia’s PDPA.
Data and system restoration. The cost of recovering data and rebuilding systems after an attack.
Business interruption. Income lost while your operations are down because of a covered cyber event.
Third-party liability. Claims from customers or partners whose data was exposed through your systems.
Cyber extortion. Response costs around ransomware events, subject to the policy’s terms and local law.
Many policies also offer optional extensions — social engineering and payment fraud cover is a common one, and worth asking about if your team handles supplier payments by email instruction.
What it usually does not cover
Neglected basics. If you told the insurer you use multi-factor authentication and tested backups but didn’t, a claim can be reduced or denied.
Known prior incidents. Problems you already knew about before taking the policy.
Betterment. Insurers restore you to where you were — they don’t fund the new, upgraded IT environment you always wanted.
Uninsurable penalties. Some fines and penalties can’t legally be insured.
Your readiness decides your premium — and your payout
Insurers price cyber policies on questions that will look familiar: Do you use multi-factor authentication? Are your backups tested and kept separate from your network? Are systems patched? Who can authorise payments? Strong answers earn better premiums and terms. Weak or inaccurate answers do the opposite — and an inaccurate answer is the fastest way to turn a claim into a dispute.
That’s why we say readiness comes before insurance, not after. The controls that make you insurable are the same ones that make an incident less likely in the first place.
Where to start
Take ten minutes to understand your current posture. Our free Cyber Readiness Self-Check walks you through the same questions an insurer will ask — and shows you where the gaps are before they show up in a proposal form or, worse, a claim.
Start with the self-check on our home page, or get in touch — we’ll review your answers with you and explain what they mean for cover and cost.
This article is general information, not advice. Policies differ — always confirm the terms of a specific policy with a licensed professional.