For UK SMEs with tight cashflow, the best cyber insurance excess is usually the lowest amount you can pay at once. It must not delay payroll, suppliers or incident response.
Choose an excess your bank balance can absorb
Choose an excess from cash left after essential payments. Do not use the headline balance after a strong sales week.
Use your lowest normal cash balance
Use the lowest cleared bank balance from the last six months. Then subtract payroll, PAYE, VAT, rent, loan repayments and critical suppliers.
A company may hold £12,000 but have only £2,500 free. This can happen when £6,000 payroll and £3,500 VAT are due.
In that case, a £500 to £2,000 excess may be realistic. A £5,000 excess creates a cash gap.
Your lowest bank balance matters more than your best month.
Compare savings against claim-day cash
A higher excess can cut the annual premium. But the saving may be too small to justify the added risk.
If a £1,000 excess becomes £5,000, the premium may fall by £350 yearly. The business then accepts another £4,000 of claim-day risk.
That £350 saving covers 12 months. The extra £4,000 may be due during an attack.
| Illustrative option |
Annual premium change |
Cash needed after a covered claim |
Usually suits |
| £500 fixed excess |
Higher premium |
£500, subject to wording |
Firms with very limited spare cash |
| £1,000 fixed excess |
Middle position |
£1,000, subject to wording |
Many SMEs with a small emergency reserve |
| £5,000 voluntary excess |
Could save £350 a year |
Up to £5,000 or more if excesses combine |
Firms with ring-fenced reserves above £5,000 |
A practical cash test: Write down the excess. Add the first three days of lost gross profit. Then add likely uninsured costs. If you cannot pay that total from cleared cash today, reduce the excess. Or build a reserve before renewal.
Compare fixed, voluntary and aggregate excesses
A compulsory excess is set by the insurer. A voluntary excess is an extra amount accepted for a lower premium.
Both excesses can apply to one claim. This is like two separate bills for the same repair.
Some policies have a £1,000 compulsory excess and a £2,000 voluntary excess. The firm then pays £3,000 on a covered £20,000 claim.
Ask for written confirmation of how both excesses work. Ask this for every cyber cover section.
The most common mistake is assuming a voluntary excess replaces a compulsory excess. It may instead be added to it.
An aggregate excess may cap excess payments across claims in one policy year. This only applies where the policy wording clearly says so.
Percentage and stepped excesses need extra care. Ten per cent of a £50,000 loss is £5,000.
A fixed amount is usually easier for a small finance team to budget. It gives you one known sum to plan for.
A fixed excess is usually the easiest cyber insurance excess to plan for. On a £15,000 covered investigation and data restoration claim, a £1,000 fixed excess normally leaves the insurer paying the balance.
This always remains subject to the policy wording. A percentage or stepped excess can be less predictable.
For example, a 10% excess on a £60,000 ransomware claim creates a £6,000 contribution. A stepped excess may rise after the loss passes a stated threshold.
A franchise excess works differently. If the loss exceeds its threshold, the insurer may pay the full covered loss.
Ask the insurer to name the exact excess type. A cheap quote may become unaffordable once minimums or section terms apply.
Test each cover section, not just the policy limit
A £1 million cyber limit can still leave an SME short. Individual sections may have separate limits, excesses or waiting periods.
Check waiting periods and sub-limits
Business interruption may have a 12- to 48-hour waiting period. Early lost trading may then remain uninsured, even with a low money excess.
Check sub-limits before relying on the overall policy limit. Look at ransomware, cyber extortion, data restoration, forensic work, legal advice and public relations.
Also check the limit for funds transfer fraud. This covers money sent to criminals after a fake payment request.
A large policy limit does not guarantee early cash support.
Check security terms before a claim
Policies may require multi-factor authentication, backups, patching and staff controls. They may also require prompt notice of an incident.
Compare these conditions with what your business actually does. The National Cyber Security Centre gives small organisations practical security advice.
Do not treat GDPR fines and penalties as automatic insurance payments. Cover depends on the wording and the facts of the case.
An encrypted external drive can keep an offline copy of key records. It helps when ransomware affects main systems.
It supports a backup plan. But it does not replace tested backups or cyber insurance.
⭐
Selección para ti
An encrypted external drive can give a small firm an offline copy of key records. It helps when ransomware affects main systems. It supports backup planning, but does not replace tested backups or cyber insurance.
- Keeps critical files away from a compromised business network
- Encryption can protect customer and finance data if the drive is lost
- Helps cut data recovery time and cost after an incident
Ver en Amazon →
Cyber Essentials can support a stronger security baseline. It does not promise a lower price or replace policy conditions.
Before buying or renewing, confirm the insurer's exact requirements. These may include Cyber Essentials, Cyber Essentials Plus and multi-factor authentication for email and remote access.
They may also include immutable or offline backups, endpoint protection and timely patching. Employee controls for payment fraud may also be required.
These terms can affect eligibility and cyber insurance premiums. They matter most where ransomware, business interruption and data restoration are major risks.
Record the controls you have in place. Keep evidence that they remained in place.
A control declared during underwriting can cause a claim dispute if it later lapses. A Cyber Essentials certificate does not remove that risk.
For a cash-tight SME, choose a fixed excess you can pay today. Check each section, waiting period and security duty before choosing a higher excess. A higher voluntary excess only makes sense when ring-fenced cash covers it, plus early uninsured losses. If one breach could trigger several section excesses, treat their combined total as the real exposure.
Avoid cheap quotes that create a cash gap
The cheapest quote can cost more after an attack. Excesses, exclusions and waiting periods may force borrowing.
Match the excess to your trading model
Use this matrix as a starting point. Then ask a broker or insurer to confirm the wording and excluded activities.
| Business position |
Likely excess starting point |
Main reason to check |
| Under £2,000 spare cash, high digital dependence |
£500 to £1,000 fixed excess |
Avoid delaying incident response or payroll |
| £2,000 to £7,500 ring-fenced cash, mixed trading |
£1,000 to £2,500 after a cash test |
Compare premium saving with waiting-period losses |
| Over £10,000 reserves, tested recovery plan |
Higher or aggregate excess may fit |
Confirm all section-specific excesses and fraud limits |
Questions to ask before renewing
Ask whether compulsory and voluntary excesses stack. Ask whether one incident creates separate excesses by section.
Check waiting periods, sub-limits, security duties and notice deadlines. Compare Aviva cyber insurance, Hiscox cyber insurance and other UK quotes on equal terms.
Use your first-72-hour cash-gap test for every quote. It shows what you must fund before insurance payments help.
This framework is less relevant if your firm can self-insure small losses from ample reserves. It is also less relevant if a client or lender sets the excess. Seek specialist advice for excluded or high-risk activities. This guide does not replace policy wording or advice from a broker or insurer.
Use turnover only as a sense-check. Do not use it instead of available cash.
An SME may have £500,000 annual turnover but only £1,500 free cash. It may need a lower excess than a £250,000-turnover firm with £10,000 ring-fenced reserves.
Also consider cash swings and risk tolerance. A retailer with sharp changes in takings may struggle after an interruption.
An agency that relies on one online platform may face the same problem. Annual revenue does not show this pressure.
A firm that can fund small incidents may accept a higher voluntary excess. A firm unable to absorb a £3,000 shock should choose a lower fixed excess.
Keep a tested emergency reserve beside the policy. It is the part you control.
FAQs
What is the best cyber insurance excess for a cash-tight SME?
The best excess is the lowest amount you can pay within 24 hours. Protect payroll, tax and essential suppliers first.
For many cash-tight SMEs, this is between £500 and £2,000. Your cleared bank position matters more than turnover.
Does a voluntary excess reduce cyber insurance premiums?
Yes, a voluntary excess can reduce the annual premium. But the saving may be small beside the extra claim payment.
Saving £350 yearly for another £4,000 excess only works if £4,000 is available immediately.
Can compulsory and voluntary excesses apply to one claim?
Yes, they can apply together when the wording makes the voluntary excess additional. Ask for a written payment example for a £20,000 ransomware or data breach claim.
Does cyber insurance pay during a business interruption?
Usually no, not during the first part of the stated waiting period. If the time excess is 24 hours, early losses may remain uninsured.
If daily gross profit is £2,000, that £2,000 may remain uninsured.
Are ransomware and bank transfer fraud covered by cyber insurance?
Not always, because ransomware and funds transfer fraud may sit in separate sections. Check each section's excess, sub-limit and security conditions.
Do this before assuming one figure covers both risks.
Does Cyber Essentials guarantee a cyber insurance payout?
No, Cyber Essentials certification does not override policy conditions. Insurers may still require multi-factor authentication, backups, patching and prompt incident notice.
What happens if my business cannot afford the excess?
The insurer may deduct the excess from its payment. Your firm must then fund that amount while the incident is active.
Choose a lower excess if paying it delays payroll or urgent recovery work. You can also build a ring-fenced reserve before renewal.
Learn more
Here are some additional resources on this subject:
