A cyber claim can cost far more than the ransom headline suggests. For a UK SME, the real damage usually comes from downtime, lost orders, recovery work, and customers who cannot be served while systems are down. If the sum is set too low, the gap can land on the business at the worst possible moment.
Choosing the right sum insured: means matching cover to real and projected turnover, while also accounting for seasonality, growth plans and how much revenue a cyber incident could disrupt. The right limit helps reduce underinsurance, rejected claims and renewal problems.
Will your cyber cover be enough for 2026's turnover?
The right limit matches the business you run now, not the one you ran 2025. If turnover is rising, seasonal, or tied to online systems, 2025’s sales can leave the sum insured too low even when the number looks tidy on paper.
The legal and commercial risk is simple: underdeclared turnover can reduce the payout, delay agreement with the insurer, or create renewal friction when the figures no longer match the business profile.
A cyber policy limit should protect the revenue you can lose during interruption, not just the revenue you recorded 2025.
Start with 2025’s gross revenue
Use 2025’s gross revenue as the starting point, then check whether it still fits today. Gross revenue means the money the business brought in before costs, not profit after rent, wages, or stock.
Adjust for growth
Add realistic growth if sales are moving up, and do not ignore peak trading periods. A retailer, an accountancy practice, or a firm with busy seasonal income can need a higher limit than a business with even monthly income.
Use a simple limit test before you buy
A useful test is this: if systems went down for 30 days, could the chosen limit cover lost sales, recovery work, and key third-party costs? If the answer is no, the limit is probably too low.
The National Cyber Security Centre pushes firms to reduce the chance and impact of incidents. The Information Commissioner’s Office can become relevant when personal data is involved, especially under UK GDPR and the Data Protection Act 2018.
How to calculate the insured turnover correctly
Insured turnover should be a forward-looking figure that reflects the business you expect to trade for during the period. If the firm is stable, 2025’s gross revenue may be enough.
Should you use 2025 or forecast sales?
Use 2025’s turnover when the business is steady and sales patterns barely move. Use forecast turnover when sales are rising, the customer base is changing, or a new channel has started to bring in real income.
What counts as gross revenue here?
Gross revenue is the top-line money the business earns before costs. It is not profit, and it is not cash left after wages, stock, rent, or tax.
When does turnover need a stress test?
A turnover figure needs a stress test when the business has changed more than a little. That includes faster sales, more staff, new suppliers, online payments, or a move into regulated work.
Insurers ask about projection because the business they insure at renewal is not always the same business they saw at quote stage. That is normal underwriting, and it is why a clean estimate helps.
A practical way to set the right sum insured is to work from three numbers: 2025’s gross revenue, 2026’s projection, and the likely cost of interruption. For a business with £1.2 million in insured turnover 2025 and an expected rise to £1.35 million 2026, using the higher figure is usually safer if the increase is real and already visible in contracts or order books. Then add a buffer for business interruption, recovery support, and third-party costs that could arise during a cyber policy claim.
In commercial insurance, a small margin can make a big difference when downtime runs longer than expected, because the loss is rarely limited to one week of missed sales.
How UK SMEs should set their cyber insurance limit
Different businesses need different limits because cyber loss follows how money moves, not just how much money exists.
Retail and ecommerce firms
Retail and ecommerce businesses usually need a higher limit than their annual average suggests, because peak trading months can drive a large share of yearly income. A Christmas-driven ecommerce brand, for example, may generate 40% of annual gross revenue in a short trading window, so an average monthly view understates the risk if systems fail during peak demand.
Professional services and agencies
Professional services firms often need cover that reflects client deadlines, not only revenue. A law firm, accountancy practice, marketing agency, or IT services business can lose income quickly if email, file access, or billing stops.
Manufacturers and wholesalers
Manufacturers and wholesalers should think beyond sales and include supply chain delay. A cyber event can stop ordering, dispatch, or stock control even when customer demand stays strong.
The limit most owners underestimate
The most underestimated part is often not the yearly turnover. It is the cost of staying closed while systems come back, people are paid, and customers are reassured.
Seasonality and fast growth need a different approach from a stable business. Likewise, a software agency that has just won several new contracts may need to base its cyber cover on forecast turnover rather than historic figures. The best next step is to compare 2025’s turnover, 2027’s forecast, and the longest likely downtime.
What is the difference between insured turnover, sum insured and policy limit?
The insured turnover is the figure the insurer uses for the policy. It should reflect the business’s expected revenue during the cover period. Choose the highest realistic turnover for the policy year, then trim away anything clearly one-off or outside normal trading. If turnover is seasonal, use the peak pattern, not the average month.
The sum insured is the amount chosen to cover the risk. The policy limit is the maximum the insurer will pay. The wording matters because it determines what the insurer pays for first, and what sits outside the cap. Sometimes one number is enough for a small, simple SME. Often it is not.
A low sum insured can reduce the claim payment, create arguments at settlement, and leave the business paying part of the loss itself. Underdeclaration can lead to proportionate settlement, where the insurer reduces payment because the insured amount was too low for the real exposure. Renewal can also become harder when the insurer sees a mismatch between the declared turnover and the latest accounts; it may ask for more detail, a higher premium, or a corrected limit.
First-party and third-party limits
First-party cover pays for the business’s own loss, such as business interruption and recovery work. Third-party cover responds when customers, suppliers, or other outside parties claim harm.
Claim size outgrows the limit when downtime runs longer than expected or when recovery needs more hands than planned. That often happens after ransomware, supplier lockouts, or a breach with customer notification duties.
Imagine a retailer that declared £800,000 of insured turnover but actually traded at £1 million during the period. If a cyber event causes £100,000 of business interruption loss, the insurer may reduce the payment if the declared figure was too low for the real exposure.
Check your limit before renewal and growth
A yearly review of the limit catches most mistakes before they become claim problems.
Your annual review checklist
Use this checklist before renewal, after a big sales jump, or after a major system change:
- Compare 2025’s turnover with 2026’s expected turnover.
- Check whether peak trading months now bring in a larger share of sales.
- Review any new ecommerce, payment, or customer data systems.
- Ask whether supplier dependency has grown.
- Check if more staff now rely on digital systems every day.
- Review any contract wins, mergers, or new locations.
- Confirm the limit still makes sense if systems were down for 30 days.
Signs the limit is already too small
The limit is probably too small if new sales keep coming in faster than the policy was built for, if clients now expect faster delivery, or if the business depends more heavily on a single platform than it did before.
A simple update rule that works
A practical rule is to review the figure whenever turnover moves by about 10% to 15%, or whenever the business changes in a way that affects downtime.
What is the threshold limit sum insured?
The threshold limit sum insured is the amount above which the insurer may treat the loss differently, depending on the wording.
Is it the same as the policy limit?
No, it is not always the same as the overall policy limit. The policy limit is the maximum the insurer will pay under the cover.
Why do insurers use thresholds?
Insurers use thresholds to separate smaller losses from larger ones. It helps them price the risk and decide what kind of exposure they are taking.
What should a buyer ask the broker?
Ask whether the limit covers business interruption, data breach response, ransomware, and third-party claims in one pot or several.
What does policy limit mean in insurance?
A policy limit is the maximum amount the insurer will pay under the policy or a part of it.
Does higher always mean better?
Not always. A higher limit costs more, so the aim is not the biggest number available.
What is the one-line rule to remember?
The one-line rule is this: match the limit to the worst realistic interruption, not the easiest year in the accounts.
Frequently asked questions
What is the threshold limit sum insured?
The threshold limit sum insured is the point at which policy treatment can change. It may affect how the insurer applies cover, especially where the wording sets different rules for larger losses. For a buyer, the key is to check whether that threshold sits inside a broader cyber policy limit or acts as a separate trigger.
What is the difference between sum insured and policy limit?
The sum insured is the amount chosen to cover the risk, while the policy limit is the maximum the insurer pays. They can be the same in simple policies, but not always. In cyber insurance, this difference matters because interruption, breach, and liability cover can each have their own ceiling.
What is the insured turnover?
The insured turnover is the revenue figure the insurer uses for the policy. It should reflect expected gross revenue during the cover period, not profit or a stripped-down estimate. If turnover is seasonal or growing, the figure should reflect that, or the cyber limit can end up too low.
What does policy limit mean in insurance?
A policy limit is the top amount the insurer will pay under the cover. Once the limit is reached, the insurer stops paying for that section. In practice, that means the buyer should set the limit with real interruption cost in mind, not just with 2025’s accounts.
How often should turnover-based cyber limits be reviewed?
Review them once a year at renewal, and sooner if turnover moves by about 10% to 15%. That is the point where many SMEs start drifting away from the original figure. A review should also follow new systems, bigger contracts, or heavier seasonal trading.
Yes, it can. If the insured turnover is too low, the insurer may reduce the settlement or question the basis of the cover. The exact result depends on wording, but the practical risk is the same: the business may recover less than expected after a cyber incident.
Should a fast-growing SME use forecast or historic turnover?
A fast-growing SME should usually use forecast turnover if the next 12 months will look different from the last 12. Historic turnover can be a poor guide when sales are rising quickly or trading is shifting online. The safer choice is the highest realistic figure that can be explained clearly at renewal.
