Personal Insurance
Business Insurance
Industry
Cyber insurance is for any business that holds customer records, takes payments online or simply cannot trade when its systems go down. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must tell affected people and the regulator about an eligible breach, and that work costs money long before anyone talks about a ransom. Fortis Risk Solutions compares cyber wordings where insurers differ most, such as payment redirection fraud, the waiting period on lost income and the security controls a policy requires. If an incident happens, we help you report it to the insurer quickly and manage the claim. Expect to be asked about backups and multi-factor login. Call 03 7046 3766 or send an enquiry.
What Cyber Insurance Covers
Cyber insurance protects your business against the financial loss, legal liability and operational disruption that follow a cyber attack, data breach, ransomware incident or system failure.
Australian businesses of every size now depend on digital systems, cloud platforms and online payments, so cyber risk is no longer a concern for large corporations alone. A well-structured cyber policy funds the response to an incident and protects cash flow, reputation and regulatory standing while systems are restored.
If you store customer data, take payments online or rely on IT systems to trade, cyber insurance belongs alongside your core business insurance. It also complements management liability insurance, because directors can be held accountable for how a breach is handled. It sits within our business insurance range at Fortis Risk Solutions.
Cyber Insurance: Cover Sections and Benefits
What Cyber Insurance does not cover
Cyber insurance responds to incidents, not to the state of your systems before one. Most policies exclude losses that come from problems you already knew about or from basic controls that were never in place. Common exclusions include:
- Breaches that began before the policy started, or incidents you knew about and did not disclose
- Losses caused by software that was out of support or patches that were left uninstalled after a warning
- Fines and penalties where the law does not allow them to be insured
- Bodily injury and property damage, which belong to public liability or property cover
- Loss of future contracts or reputation beyond the defined business interruption period
- Funds transfer fraud where the policy has no social engineering extension
- Infrastructure failure outside your control, such as a telecommunications outage, unless specifically included
FRS reads the exclusions against how your business actually operates, so a gap such as an unpatched server or an outsourced IT provider is dealt with before renewal rather than at claim time.
How Cyber Insurance premiums are set
Insurers price cyber insurance on the questions they ask in the proposal, and the answers matter more than turnover alone. The main factors are:
- The volume and type of personal or payment data you hold, and whether cardholder data is stored or only processed
- Multi-factor authentication on email and remote access, which many insurers now treat as a minimum condition
- Backup practice: how often, whether copies are kept offline, and whether restores have been tested
- Industry and exposure, such as healthcare records, legal files or online payments
- Claims history and any prior incident, including near misses
- The limit of liability and the excess chosen
- Whether staff receive phishing awareness training
Answering these accurately is the fastest way to a fair premium. FRS prepares the proposal with you so the security position is stated correctly and the insurer has no grounds to dispute a claim later.
How to claim on Cyber Insurance
Speed decides the outcome of a cyber claim. Most policies give you access to an incident response team, and the clock on notification obligations starts when you become aware of a breach. The FRS claims process:
- Notify: Call FRS, or the insurer’s incident response line outside business hours, as soon as you suspect a breach, before restoring systems where you safely can
- Preserve evidence: Preserve evidence: logs, affected devices and the phishing email if there was one
- Do not pay or negotiate: Do not pay a ransom or contact the attacker without the insurer’s response team involved
- We lodge and manage: FRS lodges the claim, briefs the insurer’s forensic and legal panel and keeps the notification timeline on track
- Document the costs: Costs for restoration, notification and lost income are documented and submitted
- Settle and review: Settlement is negotiated and the security lessons are written into the next renewal
The steps and contact details are also set out on our make a claim page.
Cyber Insurance compared with Professional Indemnity
| Question | Cyber Insurance | Professional Indemnity |
|---|---|---|
| What triggers it | A breach, attack or system failure in your own systems | A client claims your advice or service caused them loss |
| Who it pays | Your own response costs, lost income and third-party claims from the breach | Compensation and defence costs for the client’s loss |
| Who buys it | Any business holding data or trading online | Firms that give advice, design or manage projects |
| Sits with | Business pack and management liability | Public liability and management liability |
Advice firms usually hold both. A breach that exposes client files can trigger the cyber policy for the response and the professional indemnity policy if a client then sues over the advice or the confidentiality breach.
Cyber Insurance - Client Case Studies
Cases from the Fortis Risk Solutions broking team. Client names have been removed.
Client case: Client Financial Information Sent to the Wrong Person
The client situation: An administration staff member at a financial planning firm accidentally emails a client’s financial documents to another client. The documents contain confidential personal and financial information, creating a potential privacy breach.
How the policy responded: The firm’s Cyber Insurance policy helped cover the costs of responding to the data breach, including investigating the incident, obtaining specialist legal and privacy advice, and managing any required notifications. Where covered, the policy may also respond to third-party claims arising from the accidental disclosure.
How Fortis Risk Solutions helps: Most small firms think cyber cover is about hackers. We explain the breach response section in plain terms and put the client in touch with the insurer’s response team when something goes wrong.
Client case: Stolen Laptop Creates a Data Breach
The client situation: An employee’s business laptop is stolen while travelling. The device contains locally stored client files and confidential information.
How the policy may respond: Cyber Insurance may assist with investigating whether information has been compromised, breach response, legal advice and required notifications, depending on the policy terms and security controls in place.
How Fortis Risk Solutions helps: Insurers ask about encryption and device security before they offer terms. We go through those questions with the client first, so the cover holds when it is needed.
Client case: Cyberattack Disrupts a Consultancy
The client situation: A consultancy suffered a cyberattack that locked staff out of its systems and client files, preventing the business from operating normally for several days.
How the policy responded: The Cyber Insurance policy helped cover the costs of investigating and containing the incident, restoring affected systems and recovering data. The policy also assisted with insured business interruption losses while the consultancy worked to return to normal operations.
How Fortis Risk Solutions helps: We make sure a cyber policy includes business interruption, because the days a firm cannot work usually cost more than the repair.
Every policy is different and the outcome of a claim depends on its terms. As your broker, Fortis Risk Solutions compares insurers and policy wording before you buy, and lodges and manages the claim for you when something happens. Talk to us about your own cover.
Cyber Insurance FAQs
Yes. Small and medium-sized businesses are frequent targets because they rarely have dedicated IT security staff. An incident can mean days of downtime, a ransom demand and, for many businesses, notification obligations under Australia's Notifiable Data Breaches scheme, whatever the size of the company.
Yes, provided the policy specifically includes cyber fraud or funds transfer loss cover. Not every policy does, which is why we check the wording rather than the headline premium.
Cyber policies differ widely in what triggers a claim, which costs are covered and how the incident response is managed. As your broker, FRS helps you disclose your systems and data accurately, structure limits that match your exposure, compare specialist cyber insurers and coordinate the response if an incident occurs. Firms that give advice should also check how this cover sits beside their professional indemnity insurance.
Cyber policies differ more than most covers, so compare the sections rather than the headline limit. Incident response comes first: what help the insurer provides when systems go down, and which costs it pays. Business interruption after an attack is the next test. Social engineering fraud, where staff are tricked into paying a fake invoice, is often sub-limited or excluded unless added. Talk to us about which wordings fit the way your business uses its systems.
Related reading
Related pages
Related industry pages: Financial Services Insurance, Professional Services Insurance, Health and Care Services Insurance
Talk to a broker about Cyber Insurance
Call 03 7046 3766 on weekdays between 9:30am and 6pm, email admin@fortisrisksolutions.com.au, or send an enquiry and a broker from our Box Hill or Hawthorn office will come back to you about cyber insurance. Tell us what the business does and what the lease or contract asks for, and we take it from there.