A low premium can make first-party cover attractive, but it can also leave a costly gap after a client loss. Compare premium, excess, limits and sublimits with realistic recovery costs. The real risk is often missing client-claim cover.
Price is not value: calculate your real exposure
A cyber policy is worthwhile when it cuts cash loss from a realistic incident. A low annual premium alone does not show value.
Put these costs into your estimate
Include forensic checks, data restoration, emergency IT help, customer notices, temporary software, replacement devices and lost income. Some policies cover lost gross profit. This is sales less costs you did not incur.
A first-party loss often starts with phishing. It does not need a dramatic server attack.
A false Microsoft 365 or banking login can expose email or divert supplier payments. It can also lead to ransomware or deleted cloud files. The bill may include forensic work, IT help, data restoration, customer messages and lost gross profit.
Test excesses, limits and waiting days
A waiting period delays business-interruption cover. Sublimits create smaller caps inside the main limit. Check if a £100,000 limit has lower caps for restoration, extortion or interruption.
Business interruption may help with lost trading income. It starts only after the waiting period. It also stops at the relevant limit.
Treat each item as a separate cost line. One incident can trigger several costs at once.
| Quote feature | Example to test | Why it changes value |
|---|
| Annual premium | £200 to £600 planning range | Compare it with avoided loss, not another premium alone. |
| [Policy](https://dealergen.uk/choose-a-cloud-or-on-premise-policy-you-can-defend/) excess | £250, £500 or £1,000 | A high excess weakens [cover](https://dealergen.uk/negotiating-a-ransom-can-void-cover-or-breach-sanctions/) for smaller incidents. |
| Interruption waiting period | 12 to 48 hours | The first lost day may receive no payment. |
| Data restoration sublimit | £5,000 versus £25,000 | A low cap can leave cloud rebuilding underfunded. |
When client claims make limited cover unsafe
First-party-only cover is usually unsafe when you hold customer data. It is also risky if you manage client systems. A client may say your breach caused its loss.
Client data creates a separate exposure
A personal-data breach can create duties under UK GDPR and the Data Protection Act 2018. The Information Commissioner’s Office expects firms to assess breaches. It may require prompt notification.
Client loss can cost more than restoration.
Contracts can change the answer
Read client contracts before accepting limited cover. An indemnity is a promise to meet another party’s stated losses. It can raise exposure beyond what you would otherwise owe.
First-party-only cover may not be enough for sensitive personal data, professional services, or contractual indemnities. It may also fail where clients demand liability cover. In these cases, assess combined first-party and third-party cover first.
The right answer depends on your business model. A photographer, local retailer or tradesperson may find first-party cover useful. Their main worry may be recovery after an account breach or short outage.
An e-commerce seller should test chargeback, payment-diversion and order-fulfilment risks. A web agency may hold administrator access to client sites. A bookkeeper can handle financial records.
A common case is a web agency whose compromised account takes client sites offline. First-party cover may fund its own recovery. It may not pay client claims.
Those firms should compare first-party cover with third-party cyber liability cover. Do not assume cheap microbusiness cover is enough.
Security conditions can shrink a claim to £0
A policy has value only if your business meets its security conditions. You must also follow the claims process.
Backups must be recoverable
Keep one backup separate from your main network or cloud account. Ransomware can encrypt reachable files and backups together. Test a small restore regularly to prove that files and steps work.
A backup that cannot restore is not a backup.
🎯
Useful for this risk
An encrypted external drive can hold a separate backup. It helps when main files sit in one cloud account. It does not replace backup testing or policy checks.
- It keeps one backup away from the main computer or cloud login.
- Encryption can protect customer files if the drive is lost or stolen.
- It supports a restoration test before a ransomware incident.
Find on Amazon →
Check exclusions before an incident
Check exclusions for social engineering fraud, payment diversion and voluntary transfers. Insurers may require quick notice after an incident. They may also require an approved response firm before paying forensic or ransomware costs.
Security controls can affect both price and eligibility. Insurers often ask about MFA for email, remote access and admin accounts. They also ask about patches, staff phishing training and tested separate backups.
MFA means a second proof of identity. It is like needing both a key and a code.
Stronger answers may support a lower premium or wider terms. Weak controls can lead to limits, higher excesses or lower sublimits. The wording still decides what applies.
The most frequent error here is treating proposal answers as paperwork. A stated control may become a cover condition. Keep proof of MFA, backup tests and patch routines.
This matters most after an outage or UK GDPR data breach. When setting limits, match them to downtime.
Choose cover by your longest credible outage
Choose a limit that funds your longest credible outage and recovery. Allow for the excess, waiting period and lower sublimits.
Compare the four realistic buying routes
| [Cover](https://dealergen.uk/standard-cover-may-miss-fraud-that-bespoke-cover-includes/) route | Best fit | Main gap to check |
|---|
| First-party only | Low-liability sole trader needing recovery funds | Client [claims](https://dealergen.uk/stolen-r-d-code-and-ip-claims-need-different-cover/), defence costs and [data](https://dealergen.uk/why-your-recruitment-data-cover-may-miss-payroll-fraud/) liability |
| Combined first- and third-party | [Agencies](https://dealergen.uk/missing-mfa-can-void-cyber-cover-for-remote-uk-agencies/), advisers and [firms](https://dealergen.uk/why-uk-firms-under-1m-pick-the-wrong-cyber-cover-limit/) handling client systems | Separate fraud, [fines](https://dealergen.uk/why-pricing-cyber-cover-by-fines-fails-microbusinesses/) and contract-liability limits |
| [Cyber](https://dealergen.uk/why-boutique-cyber-insurance-may-not-cover-card-fraud/) extension in another [policy](https://dealergen.uk/your-cyber-policy-may-exclude-ad-account-takeovers/) | Basic protection with clearly stated cover | Small limits and narrow incident triggers |
| Cyber Essentials-linked [insurance](https://dealergen.uk/why-pi-insurance-may-miss-cyber-claims-for-accountants/) | Eligible firms with certified basic [controls](https://dealergen.uk/your-policy-answers-can-turn-controls-into-claim-terms/) | Eligibility and cover terms differ from certification |
The cheapest route is not always the lowest-cost choice. A modest client claim can outweigh a premium saving.
Use this five-minute quote check
- Write your daily gross profit. Multiply it by three and five working days.
- Add a recovery amount from your IT provider or managed service firm.
- Subtract the excess. Remove the first 12 to 48 hours if the policy has a waiting period.
- Compare each sublimit with the cost it should pay.
- Ask if client claims, legal defence and UK GDPR costs are covered or excluded.
Comparing the main limit alone can mislead you. The next questions address the gaps that buyers often miss.
What people ask
Is first-party cyber insurance worth it?
It can help when a short outage or recovery bill would strain cash flow. Compare the premium and excess with three to five days of lost gross profit.
What does first-party cyber insurance usually cover?
It usually covers your own forensics, restoration and covered interruption costs. Terms differ by insurer and policy wording.
Does first-party cover pay a customer’s claim?
Not usually. Check for third-party liability, legal defence and privacy-liability sections. A client claim may need combined cover.
How much cyber insurance do I need in the UK?
Cover several days of lost gross profit, recovery costs and the policy excess. Check sublimits for restoration and interruption.
Does cyber insurance cover invoice fraud?
It covers invoice fraud only when social engineering or funds-transfer fraud is stated. Check the relevant limit and transfer exclusions.
Is Cyber Essentials the same as cyber insurance?
No. Cyber Essentials is a security certification. Insurance eligibility and cover terms remain separate.
Can an insurer refuse a claim if MFA was missing?
It may challenge a claim if required MFA was declared but inactive. Keep proof that MFA protects email and admin accounts.
What is a cyber insurance excess?
It is the first part of a covered loss that your business pays. Common examples include £250, £500 and £1,000.
Make the policy earn its premium
First-party-only cover can suit a microbusiness with low client liability. Its main threat must be restoring systems and surviving a short trading halt. Compare a like-for-like combined quote when client data, contracts or services create third-party risk.
A first-party policy earns its premium when recovery and short-term lost profit exceed the premium and excess. Coverage always depends on the insurer’s wording and conditions.
The essentials:
- A first-party policy can pay off when recovery and lost profit exceed its premium and excess.
- Sublimits, waiting periods and exclusions often matter more than the headline limit.
- Client data, professional services and indemnities justify a combined-cover comparison.
- MFA, tested backups and quick reporting can affect whether an insurer pays a claim.
Learn more
Here are some additional resources on this subject:
